Privacy Policy

Last updated: November 6, 2026

This Privacy Policy describes how the provider of Buzzfy (the "Company", "we", "us" or "our") collects, uses and shares personal data when you use Buzzfy (the "Service"), available at buzzfy.co. "Buzzfy" is the brand and application name under which the Service is offered and has no separate legal personality.

1. Who Is Responsible for Your Data

The Company is the controller of the personal data described in this Policy and determines the purposes and means of processing. Web purchases are sold by our authorised reseller (the "Authorised Reseller"), acting as merchant of record. The Authorised Reseller receives only the data required to process payments, issue receipts, handle refunds, chargebacks, taxes and accounting and prevent fraud, and processes such data as an independent controller solely for those purposes. Card details are transmitted directly to payment service providers. The Company and the Authorised Reseller are identified in Section 15.

Where any other provision of this Policy identifies another company as the controller of personal data, or describes the Company as a processor acting on behalf of another company, this section prevails and this Policy shall be construed accordingly.

Buzzfy uses Instagram's official API. Buzzfy is independent and is not affiliated with, sponsored or endorsed by Meta. Instagram and Meta are trademarks of Meta Platforms, Inc.

2. Information We Collect

a) Account Information

When you sign up, we collect your name, email address, and password (hashed). If you sign up via an invite code, we record that code. We also record whether you agreed to receive marketing emails.

b) Instagram Account Data

When you connect your Instagram account, we collect and process the following via the Instagram Graph API:

Your Instagram account ID, username, and profile information
Your existing Reels (video files, metadata, view counts)
Performance metrics via the Instagram Insights API: reach, views, average watch time, likes, comments, shares, and saves
Audio data from your Reels (for transcription and variant generation)
Information we derive from your Reels: a transcript, the text shown on screen, a short summary, descriptive tags (for example format, length, language and call to action) and a mathematical representation used to find similar reels

c) YouTube and TikTok Account Data (optional)

If you choose to connect a YouTube channel or a TikTok account, we collect: the channel or account identifier, display name or handle, and profile picture; an access token (and refresh token) that lets Buzzfy upload on your behalf, stored encrypted; the settings you choose for those uploads (for example who can see the video, whether comments are allowed, and any commercial-content disclosure); and the result of each upload (the video identifier the platform returns, or the reason it was refused).

d) Payment Information

Payments for web purchases are collected by the Authorised Reseller and processed by Stripe. We do not store your card number or payment details on our servers. We receive the status of your subscription and payments (plan, amount, dates, refunds) so we can give you access to the Service. Stripe's privacy policy applies to payment data: stripe.com/privacy.

We collect information about how you use our website and the Service: pages and screens visited, features used, actions taken, the website or ad that brought you to us, your approximate location (country and region, derived from your IP address), browser, device and operating system. We collect it through cookies and similar technologies, as described in Section 11 and in our Cookie Policy.

f) Communications

If you contact us for support or respond to our emails, we retain that correspondence.

g) AI Apps You Connect (Buzzfy MCP)

If you connect an AI app (such as Claude, ChatGPT, Cursor, Codex or Grok) to your Buzzfy account, we collect the following. Section 5 has the details.

A record of each request the AI app makes to Buzzfy: which tool it used, when, which AI app sent it, whether it worked, how long it took and, if it failed, a technical error code.
A record of each action you approve (for example a reply, DM or post): which Instagram items it applied to (by ID), whether it worked, and the IDs Instagram returned. For replies and DMs we keep a fingerprint of the text, not the text itself.
Posts you schedule through an AI app, including the caption, media links and other post settings, and any automations you create through an AI app, including their keywords and message text.
Files you upload for publishing (Section 5 says when they're deleted).
Problem reports your AI app sends to Buzzfy about our tools.

3. How We Use Your Information and Our Legal Bases

Purpose	Legal basis (GDPR / UK GDPR; KVKK Art. 5)
Providing the Service: analyzing your Reels, generating variants, publishing Trial Reels and posts you approve, tracking their performance, Reel Search, AI app access	Performance of our contract with you
Managing your account, subscription and support requests	Performance of our contract with you
Transactional emails (account confirmations, receipts, trial and renewal notices)	Performance of our contract; legal obligation where a notice is required by law
Security, fraud prevention, error monitoring, usage limits	Our legitimate interest in keeping the Service and your account safe
Improving the Service and developing new features, including training our models on aggregated, anonymized A/B test results across users	Our legitimate interest in improving the Service
Analytics cookies and advertising cookies and pixels	Your consent, where the law requires consent; otherwise our legitimate interest, subject to your right to opt out
Marketing emails about Buzzfy	Your consent where the law requires it (for example in the EU, UK and Türkiye); otherwise our legitimate interest. You can unsubscribe at any time
Accounting, tax and responding to lawful requests	Legal obligation

Where we rely on consent, you can withdraw it at any time; this does not affect processing carried out before you withdrew it. Where we rely on legitimate interests, you can object as described in Section 9.

4. Instagram Data Usage

We access your Instagram account solely to provide the Service. Specifically:

We read your existing Reels to analyze and generate variants
We publish content to your account on your behalf, only as directed by you. This covers Trial Reels and, if you use an AI app with Buzzfy, the posts, replies, DMs and comment actions you approve (Section 5)
We read Insights data to measure the performance of Trial Reels
When you ask an AI app you connected, we read your Instagram stats, posts, comments and messages and pass them to that app (Section 5)
We show your Reels and information derived from them to other Buzzfy users through Reel Search, unless you opt out (Section 5A)
We do not sell your Instagram data and do not share it with advertising partners
We do not use your Instagram data for advertising purposes
Instagram data is retained only as long as necessary to provide the Service or as required by law

Our use of Instagram data, including the engagement of service providers, complies with the Meta Platform Terms and Meta Platform Policy.

4A. YouTube and TikTok Data Usage

YouTube. If you connect a YouTube channel, Buzzfy uses the YouTube API Services to upload the videos you choose to that channel, and reads your channel's name and picture once so you can see which channel is connected. We do not read your videos, comments, subscribers or analytics. Buzzfy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting YouTube you also agree to the YouTube Terms of Service and acknowledge the Google Privacy Policy. You can revoke Buzzfy's access at any time at https://myaccount.google.com/permissions.

TikTok. If you connect a TikTok account, Buzzfy uses TikTok's Content Posting API to post the videos you choose to that account, with the privacy level and interaction settings you selected, and reads your display name and avatar so you can see which account is connected. TikTok's Terms of Service and Privacy Policy apply to your TikTok account.

For both platforms:

Uploads happen only after you connect the account and turn the posting switch on; turning it off stops new uploads immediately.
Tokens are stored encrypted and used only for the uploads you enabled.
Disconnecting the account in Buzzfy Settings revokes the token with the platform and deletes it from Buzzfy within 7 days; upload history (identifiers and outcomes) is deleted with your account.
We do not sell this data and do not use it for advertising.

5. AI Apps You Connect (Buzzfy MCP)

Buzzfy offers an MCP server, a standard way for AI apps to connect to Buzzfy. It lets an AI app you choose, such as Claude, ChatGPT, Cursor, Codex or Grok, read your Instagram data and, on a paid plan, act on your account when you ask and approve. This section explains what happens to your data when you use it.

a) Connecting an AI app

You connect an AI app by signing in to Buzzfy from that app and clicking Allow on Buzzfy's consent screen. That screen names the app and lists what it can read and do. The app then receives an access token for your Buzzfy account and, depending on what it asks for, your Buzzfy email address and name. Access tokens are issued and checked by our authentication provider. They let the app use Buzzfy's MCP tools only. They can't be used to access our database directly. Your Instagram access tokens stay on Buzzfy's servers and are never given to the AI app.

If you use Buzzfy through an AI assistant, you connect it to Buzzfy through our MCP connector and sign in on a Buzzfy page, where you enter your email address. When you ask the assistant to do something in Buzzfy, we receive the name of the assistant app and the details of that request, including the content you ask us to use, such as the text of a reply or direct message or a post caption. We also receive technical information such as error messages, which we use to fix problems. We do not receive your other conversations with the assistant. Your use of the assistant itself is covered by that provider’s own terms and privacy policy.

b) What the AI app receives

When you ask, the AI app can receive the following through Buzzfy's tools:

Account statistics: reach, views, engagement, follower growth and when your followers are online
Audience insights: age, gender, top cities and countries, in the aggregate form Instagram provides
Your posts, reels and stories, with their captions and performance metrics
Comments on your posts, including the commenter's username and comment text
Your Instagram direct messages, including the sender's username and message text
Your scheduled posts and comment-to-DM automations
Whether your Instagram connection and plan allow each tool

Comments and messages are written by other people. When you ask your AI app to read them, we pass them to that app on your instruction.

c) The AI provider's privacy policy applies

Once data reaches your AI app, the company that provides that app handles it under its own terms and privacy policy. That includes whether it stores your conversations or uses them to train its models. That company is not our service provider. We don't control what it does with the data, and this Privacy Policy doesn't cover it. Only connect AI apps you trust, and review their privacy settings.

d) What Buzzfy keeps, and what it doesn't

What your AI app reads. We don't keep a copy of the stats, posts, comments or messages that Buzzfy's tools return to your AI app. We fetch them from Instagram when the app asks and pass them on. This doesn't apply to Reel Search results (Section 5A), which come from Buzzfy's own library.

Request log. For each request we record your account, the tool used, the time, which AI app sent it (its registered app ID and a general app type such as "Claude" or "ChatGPT", taken from the request), whether it worked, how long it took and, if it failed, a technical error code and a short technical description. The log doesn't include what the AI app asked for or what Buzzfy returned. We use it for security, troubleshooting, usage limits and to improve the Service.

Actions you approve. For each approved action we record the tool, the Instagram items it applied to (by ID), the result and any IDs Instagram returned. For replies and DMs we store a fingerprint (a cryptographic hash) of the text, not the text. It is used to prevent the same action from running twice.

Scheduled posts and automations. To publish a post at the time you chose, we store it until it goes out, including its caption, media links, tagged accounts, collaborators and location. Once it is published, fails or is cancelled, the record is kept as described in (e). Automations you create through an AI app are saved like the ones you create in Buzzfy, including their keywords and message text, so they can run.

Uploaded files. If your AI app uploads a photo or video for you to publish, it is stored in private storage that only Buzzfy can access. Instagram gets a temporary link that expires after one hour. Files are deleted automatically 24 hours after upload if no post uses them, or about 24 hours after the post they belong to is published, fails or is cancelled.

Problem reports. If a Buzzfy tool fails or gives a wrong result, your AI app may send us a short report. We store its category, the tool concerned, the app's description (after automatically removing email addresses, phone numbers, @usernames, links and quoted message text) and the technical facts of the related request. Our team reviews these reports to fix problems. We never act on them automatically.

Links you give us. If you ask to publish media from a public link, Buzzfy checks that the link works before showing you the preview. Instagram downloads the file directly from that link.

e) How long we keep it

We keep the request log, the records of actions you approve, problem reports and the records of scheduled posts that have been published, failed or been cancelled for 90 days, and then delete them. Scheduled posts that haven't gone out yet are kept until they do or until they are cancelled. Uploaded files are deleted as described in (d). When you delete your Buzzfy account, we delete the data described in this section and end the access of every AI app connected to it.

f) No sale, no model training on MCP data

We don't sell the data your AI app reads or sends through Buzzfy. We don't use it for advertising. We don't use it to train AI models, ours or anyone else's. (Buzzfy's own aggregated, anonymized performance data is covered in Section 3.) Reel Search results are not sold and are not used to train AI models.

g) How to disconnect an AI app

In Buzzfy. Go to Settings > Connected AI apps in your Buzzfy dashboard to see the AI apps connected to your account and disconnect any of them. A disconnected app can no longer use Buzzfy for your account.

In the AI app. Removing Buzzfy in the app's connector, plugin or MCP settings stops that app from using Buzzfy. To end its access on Buzzfy's side as well, disconnect it in Settings > Connected AI apps.

Disconnect Instagram in Buzzfy. Disconnecting Instagram in your Buzzfy settings immediately stops every AI app from reading or acting on your Instagram account. It also stops all other Buzzfy features for that account, and posts scheduled through an AI app will not be published.

Disconnecting an AI app doesn't cancel posts it already scheduled or automations it created, because you approved those. Cancel scheduled posts through the AI app before you disconnect it, or contact us at support@buzzfy.co. Pause or delete automations in your Buzzfy dashboard.

h) Service providers

AI app access runs on the same infrastructure and service providers described in Section 6. It uses our database, authentication and file-storage provider, our hosting provider and our error-monitoring service. The AI app you connect is not one of our service providers (see (c)).

5A. Reel Search for Buzzfy Users

Buzzfy lets signed-in Buzzfy users, through an AI app they connect, search a library of Reels posted by creators who connected their Instagram account to Buzzfy. If you connected your account, Reels you post while your Instagram account is connected to Buzzfy, plus recent Reels from shortly before you connected, can appear in other users' search results.

What other users can see: the link to the Reel on Instagram, your Instagram username and follower count, when the Reel was posted, and its view, like, comment and share counts. Depending on their plan they can also see the information we derive from the Reel (its transcript, on-screen text, caption, summary and tags), and a rating of its opening ("good", "bad" or "unknown") that Buzzfy works out from its performance.

What other users never see: your private Instagram insights, such as reach, saves, average watch time or skip rate, the numbers behind the opening rating, your email address, or anything about your Buzzfy account or plan.

Your choice: you can remove your Reels from Reel Search at any time by emailing support@buzzfy.co. They stop appearing in new results right away. Deleting a Reel on Instagram, disconnecting Instagram from Buzzfy, or deleting your Buzzfy account also removes it. Opting out doesn't affect any other Buzzfy feature.

Users who receive search results send them to their own AI app, whose provider handles them under its own privacy policy (see Section 5(c)).

We share personal data only as described below:

Authorised Reseller: receives the data needed to sell and charge web purchases, as described in Section 1.
Service providers acting on our instructions: payments (Stripe), product analytics (Mixpanel), database, authentication and file storage, cloud hosting and content delivery (including AWS/S3 for video storage), error monitoring (Sentry), consent management (CookieScript) and email delivery. They may use the data only to provide their services to us.
AI/ML providers: we use Google Gemini and OpenAI Whisper APIs to analyze video and audio content. They process this data under their API terms and privacy policies.
Advertising partners: if you allow advertising cookies, or if you are in a US state where these cookies load by default and you have not opted out, advertising platforms such as Meta and TikTok receive device identifiers and information about your visit and sign-up through their pixels, to measure and improve our ads. They do not receive your Instagram data. See Section 10 and our Cookie Policy.
AI apps you connect: if you connect an AI app to Buzzfy (Section 5), we send it the data you ask it to read, on your instruction. That app's provider is an independent company, and its own privacy policy governs the data it receives. It is not a service provider acting for us.
Other Buzzfy users: through Reel Search, the information listed in Section 5A, unless you opt out.
Legal requirements: we may disclose information if required by law, regulation, or valid legal process.
Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data is subject to a different privacy policy.

7. International Data Transfers

The Company is located in Türkiye, the Authorised Reseller is located in the United States (Section 15), and our service providers operate in the United States, the European Union and other countries. Your personal data may therefore be transferred to, stored in and processed in Türkiye, the United States and other countries whose data protection laws may differ from those of your country.

Where a transfer is subject to the GDPR, the UK GDPR or comparable law, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with supplementary technical and organizational measures. Transfers of personal data from Türkiye abroad are made under the safeguards provided in Article 9 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), including standard contracts. You may request a copy of the relevant safeguards by contacting us at support@buzzfy.co.

8. Data Retention

We retain your account data for as long as your account is active. Video files and analysis data are retained to power the Service and, after account deletion, for up to 30 days before permanent deletion. Payment and invoicing records are retained for as long as tax and accounting laws require. Records of your cookie choices are kept for up to 2 years as proof of consent. Records relating to AI apps you connect are kept as described in Section 5(e). Files uploaded for publishing through an AI app are deleted automatically, as described in Section 5(d).

9. Your Rights

Depending on where you live, you have some or all of these rights:

Access the personal data we hold about you and receive a copy
Correct inaccurate data
Delete your data
Restrict or object to processing, including processing based on our legitimate interests and direct marketing
Data portability
Withdraw consent at any time (including cookie consent, marketing emails, Instagram access or an AI app's access)
Object to your Reels appearing in Reel Search (Section 5A)
Not be subject to a decision based solely on automated processing that significantly affects you (we do not make such decisions)
Lodge a complaint with your data protection authority (in the EU, your local supervisory authority; in the UK, the ICO; in Türkiye, the Personal Data Protection Authority, KVKK Kurumu)

If you are in Türkiye, you also have the rights listed in Article 11 of the KVKK, including to learn whether your data is processed, the purpose of processing, the third parties to whom it is transferred in Türkiye or abroad, and to request compensation for damage arising from unlawful processing.

To exercise these rights, email support@buzzfy.co from the address on your account. We may ask you to confirm your identity. We respond within one month (30 days under the KVKK, 45 days under US state laws), and we tell you if we need more time where the law allows it.

10. Your US State Privacy Rights

This section applies to residents of US states with comprehensive privacy laws, including California, Colorado, Connecticut, Virginia, Texas, Oregon and others.

Categories of personal information we collect: identifiers (name, email address, account ID, device identifiers, IP address); commercial information (plan and purchase history); internet and network activity (use of the website and the Service); approximate geolocation; audio and video content you provide (your Reels); and inferences used to rate and tag Reels. The sources, purposes and recipients are described in Sections 2, 3 and 6. Retention is described in Section 8.

Sale and sharing. We do not sell personal information for money. When advertising cookies and pixels are active, we make identifiers and internet activity available to advertising partners for cross-context behavioral advertising. Some state laws treat this as "selling" or "sharing" personal information or as "targeted advertising". We do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes that require a right to limit.

Your rights: to know and access, to correct, to delete, to obtain a copy, to opt out of the sale or sharing of personal information and of targeted advertising, and not to be discriminated against for using these rights.

How to opt out: use the "Your Privacy Choices" link at the bottom of every page, or turn off advertising cookies in Cookie settings. We honor Global Privacy Control (GPC) browser signals as a valid opt-out request for the browser that sends them. If you are signed in, we also apply your choice to your account.

Other requests: email support@buzzfy.co. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to verify your identity. If we deny your request, you may appeal by replying to our decision email with the subject "Appeal"; we respond within the time the law requires.

11. Cookies and Similar Technologies

We use cookies and similar technologies (local storage, pixels and SDKs) in four categories: strictly necessary, functionality, performance (analytics) and targeting (advertising). Strictly necessary cookies are always active because the website and the Service do not work without them.

In the European Economic Area, the United Kingdom, Switzerland, Türkiye, California and every other region except the US states listed in our Cookie Policy, functionality, performance and targeting cookies are used only after you agree in our cookie banner. "Accept all" and "Decline all" are offered with equal prominence. In the US states listed in our Cookie Policy, these cookies may load when you visit, and you can opt out at any time through "Your Privacy Choices" or Cookie settings; a GPC signal is treated as an opt-out.

You can change your choice at any time through the "Cookie settings" link at the bottom of every page. The full list of cookies and providers is in our Cookie Policy at buzzfy.co/cookie-policy.

12. Children's Privacy

The Service is not directed to children, and our Terms of Service require you to be at least 18 years old to use the Service. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

13. Security

We implement industry-standard security measures including encrypted data transmission (HTTPS), hashed passwords, encrypted storage of access tokens and access controls. Access tokens issued to AI apps can only be used with Buzzfy's MCP tools, and we limit how many requests each account can make. However, no method of transmission over the internet is 100% secure.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a prominent notice on the Service before they take effect.

15. Data Controller and Contact

Data controller: Otto Apps Yazılım Uygulama Bilgi Teknoloji Reklamcılık Danışmanlık Sanayi ve Ticaret A.Ş., a company incorporated in Türkiye with its registered address at İçerenköy Mah. Topçu İbrahim Sk. Quick Tower No:8-10D, Ataşehir / İstanbul, Türkiye.

Authorised Reseller, independent controller for payment data of web purchases: Alvin AI Studio LLC, 447 Broadway, 2nd Floor Suite 3007, New York, NY 10013, USA.

For any question about this Policy or to exercise your rights, write to support@buzzfy.co.