Privacy Policy
Last updated: 2026-11-04
Operator and data controller
Tokkma is operated by Al-Amal Al-Thahabi for General Trading and Digital Services LLC, Private Company (الأمل الذهبي للتجارة العامة والخدمات الرقمية محدودة المسؤولية شركة خاصة), Abu Nuwas Street 23, Al-Mansour, Baghdad 10011, Iraq, tax ID 902282867, phone +964 783 288 2348, email omfus14@gmail.com. This company is the data controller for personal data processed through Tokkma and the operator bound by these documents.
Who runs this
Tokkma is a private tool operated by a single account owner to manage messages and comments on their own Instagram professional account.
What we process
When someone comments on a post, replies to a story or sends a direct message to the connected account, Instagram delivers the event to us. We store the Instagram-scoped user ID, username, the message or comment text, timestamps, and, if a person voluntarily types it, an email address. We also log when a link we sent is opened, including a country code supplied by our hosting provider.
Why
Solely to send the replies the account owner configured, to show the owner simple statistics, and to let the owner reply manually.
AI replies
If enabled, the text of an incoming message and the owner's own business notes are sent to OpenAI to draft a reply. No other data is shared.
Sharing
We do not sell or rent data. Data leaves our database only to Meta (to send messages) and, when enabled, OpenAI.
Retention and deletion
Data is kept while the Instagram account stays connected. Disconnecting deletes all contacts, messages and statistics. To request deletion of your data, send the word DELETE to the connected account by direct message, or contact the account owner; we act within 30 days.
Security
Access tokens are stored server-side; the dashboard is password-protected; webhooks are verified with Meta's signature.
Meta / Instagram permissions and how each is used
instagram_basic: read the connected account's username, profile picture, follower count and list of posts so the owner can pick a post for an automation. instagram_manage_messages: read incoming direct messages and send the automated or manual replies the owner configured. instagram_manage_comments: read comments on the owner's posts and post public replies or private replies to them. instagram_content_publish: publish posts or stories that the owner explicitly creates in the dashboard; nothing is published automatically without the owner's action. instagram_manage_insights: show the owner reach, engagement and follower statistics for their own account and posts. pages_show_list: find the Facebook Page linked to the owner's Instagram professional account. pages_read_engagement: read the Page's linked Instagram account and Page-level metadata needed to send messages. Data obtained through these permissions is used only to provide these features to the account owner, is never sold, and is never used for advertising or profiling.
Contact
Questions or deletion requests: omfus14@gmail.com. See also our Data Deletion page at /data-deletion.