Privacy Policy

Baley ("we," "us," or "our") is operated by OTANAZAROV JALOLBEK, an independent contractor / self-employed entrepreneur based in Uzbekistan. This Privacy Policy explains what information we collect when you use the Baley website and WhatsApp service (together, the "Service"), why we collect it, who we share it with, and the choices you have. By using the Service, you agree to the collection and use of information as described here.

1. Information We Collect

To provide the Service, we collect the following categories of information:

• Account information: your email address, an optional display name, and the WhatsApp phone number you confirm with us.
• Connected account data (Instagram): your Instagram user ID, username, and an encrypted OAuth access token, obtained when you authorize Baley via Instagram's login flow.
• Content from your Instagram account: posts (captions, media type, timestamps, permalinks), like and comment counts, saves, views, shares, audio metadata for Reels, and the text and username of comments left on your posts.
• Performance metrics: follower count, audience demographics (aggregate age range, gender, and top locations, where Instagram makes these available), and video watch-time metrics.
• Conversation data: the messages you send to and receive from the Baley chat agent on WhatsApp, stored so the agent can hold a coherent conversation.

We do not request or store your Instagram password — authorization happens entirely through Instagram's own OAuth login, and we never see your credentials.

2. How We Use Your Information

We use your information only to operate the Service:

• Analytics: computing engagement rate, comment sentiment, best posting times, content-format performance, and trend detection. This analysis is rule-based arithmetic performed on your own data — it does not involve sending your raw posts or comments to any AI model.
• Weekly reports: sending you a summary of the above directly over WhatsApp, with a link to a fuller report on our website.
• Conversational answers: when you message the Baley WhatsApp number with a question, we send the relevant aggregated metrics (not your raw posts, comments, or commenters' usernames) to our AI provider so it can generate a plain-language answer for you.
• Security: verifying your identity at sign-in and encrypting your Instagram access token at rest.

3. Data Processors & Third Parties

We share information with the following service providers, each of whom processes it only on our behalf and only as needed to provide the Service:

• Meta Platforms, Inc.: the source of your Instagram data, and the channel through which we deliver WhatsApp messages.
• OpenAI, L.L.C.: generates the conversational responses from the Baley chat agent, using aggregated metrics and your message text — never your raw Instagram captions, comments, or commenters' usernames.
• Supabase, Inc.: hosts our database and provides passwordless email authentication (which in turn uses Resend to deliver sign-in emails).
• Railway Corporation: hosts the application infrastructure that runs the Service.

We do not sell your information, and we do not share it with advertisers or data brokers.

5. Data Retention

We retain your account information and Instagram data for as long as your account remains connected, so we can continue generating reports and answering your questions. If you disconnect an individual Instagram account without deleting your Baley account entirely, we stop pulling new data for it but retain your historical reports and insights so you can still refer back to them. If you delete your Baley account — or revoke our access from Instagram or Facebook's "Apps and Websites" settings — all of your data is permanently erased as described in Section 6 below.

6. Your Rights & Data Deletion

You can request access to, correction of, or deletion of your data at any time. We provide two ways to delete your data:

• Delete your account: use the "Delete my account" option in your settings, or email hello@getfarstar.com. This permanently and immediately erases your account, your connected Instagram authorization, and all associated reports, insights, and conversation history — there is no recovery period.
• Revoke access via Meta: removing Baley from your Instagram or Facebook "Apps and Websites" settings notifies us automatically and triggers the same permanent deletion as above.

Disconnecting a single Instagram account from within Baley (without deleting your whole account) is different: it stops new data collection for that account but keeps your historical reports intact, in case you reconnect later. Full erasure only happens through the two methods above.

If you are in the European Economic Area, the United Kingdom, or a jurisdiction with similar data protection law, you may also have the right to data portability and to lodge a complaint with your local data protection authority. California residents have rights under the CCPA, including the right to know what personal information we hold and to request its deletion, as described above.

7. International Data Transfers

Because our service providers operate internationally, your information may be processed in countries other than your own, including the United States. Where required, we rely on the safeguards those providers make available (such as standard contractual clauses) for these transfers.

8. Children's Privacy

Baley is not directed to, and is not intended for use by, anyone under the age of 13. We do not knowingly collect information from children under 13. If you believe a child has provided us with personal information, contact us at the email below and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you directly.