Varcsoft · India
Privacy Policy
Effective 27 September 2026
How Reflect handles account information and connected-platform data.
1. Who we are
Reflect is provided by Varcsoft, India. Contact support@varcbytes.com for privacy questions or requests. This policy describes how information is handled when you use Reflect and connect supported social accounts.
2. Information processed
Reflect processes your name, email address, account identifiers, and authentication/session information. Session records may include IP address, browser, device, operating system, and timestamps. When you connect Instagram, we store the access token and platform identifiers needed to operate that connection.
3. Connected accounts and conversations
Depending on permissions and interactions, we receive webhook payloads containing comments, messages, media references, participant identifiers, and timestamps. We also process account profile information, contact information available through the platform API, automation settings, execution history, and delivery errors. Some contact information is fetched on demand rather than held as a permanent address book.
4. How information is used
We use information to authenticate users, connect authorized accounts, display account information, evaluate automation triggers, deliver configured replies, track execution progress, and investigate service errors or misuse. You are responsible for having permission to process other people’s information through your workflows.
5. Services involved
Reflect exchanges information with the connected social platform and the Varcsoft/OceanAuth sign-in service as necessary for the features you use. Hosting, database, queue, and operational service providers may process information to operate the service. Contact support for information about service providers and processing locations relevant to your account.
6. Retention and deletion
Disconnecting Instagram clears its stored token and routing identifiers and pauses automations; it does not delete your Reflect account, saved workflows, or historical records. Signing out clears this browser’s sign-in storage, not server records. Retention varies by record type and purpose. This policy does not specify a single automatic deletion deadline for webhook payloads, execution records, logs, or backups. Contact support to request deletion or ask about retention of specific records.
7. Your choices and requests
You can edit your name, disconnect Instagram, and delete individual automations in the app. To request access, correction, or deletion of other information, email support@varcbytes.com from your account email and identify the request. We may need to verify account ownership. Do not send passwords or access tokens. Available rights and exceptions depend on applicable law.
8. Security and changes
Access tokens authorize activity on connected accounts and must be kept confidential. No service can guarantee absolute security. We update this policy when our data practices change and communicate material changes where required by applicable law.