Privacy Policy

Pavly Commerce ("we") operates Pavly. This policy explains what personal data we process, why, and the choices you have. It covers sellers who use Pavly, their customers, and people who interact with sellers on Instagram. Each store's own policies (linked from its storefront) cover that store's use of data as an independent business.

Seller data. Name, email, phone number, business and GST details, billing records and sign-in data, used to run your account, bill you and provide support.

Customer data, on behalf of sellers. Name, phone number, delivery address, order history and saved measurements. This data belongs to the store that collected it, is never shared across stores, and is used only to process orders, send order-related WhatsApp messages and show analytics to that store.

Instagram data. When a seller connects their Instagram professional account through Instagram Login, we receive an access token for that account, stored encrypted, and, for that account only: media (post and reel IDs, captions, thumbnails, permalinks, timestamps) and comments on that media (comment ID and text, commenter's username and Instagram-scoped user ID). We use this data only to show the seller their reels, match comments against the seller's keyword rules, send the commenter a single private reply and, if the seller set one, a public reply under the comment, and report reply counts to the seller. We do not use Instagram data for advertising, profiling, or any purpose other than the service the seller set up.

Sharing. We do not sell personal data or share Instagram data with third parties. We use service providers to run the platform (cloud hosting, database, payment processing, Meta's WhatsApp and Instagram APIs), bound to process data only on our instructions. We may disclose data where required by law.

Cookies. We use first-party cookies for sign-in, the cart, and to attribute orders to the reel, post or influencer link that brought a visitor (kept for up to 30 days).

Retention. Account and order data is kept while the account is open and as long as tax law requires afterwards. When a seller disconnects Instagram (in our dashboard or from Instagram's settings), we delete the access token and all comment records (commenter usernames, IDs and comment text) immediately and clear Instagram captions and thumbnails; the seller's own reel links stay until the seller deletes them. All remaining Instagram data is deleted within 30 days of account deletion or a deletion request. Data is stored with timestamps in Asia/Kolkata.

Your rights. You can request access to, correction of, or deletion of your data at any time. See our Data Deletion page (/legal/data-deletion) or write to support@getpavly.com. We reply within 30 days.

Security. Data is encrypted in transit, access is restricted to staff who need it, and webhook requests from Meta are signature-verified.

Changes. We will post any change to this policy on this page and update the date above.