Last updated: 29th April 2026

This Privacy Policy explains how Rupa LLC ("Rupa," "we," "us," or "our"), a Wyoming-registered company, collects, uses, discloses, and protects personal information when you visit our website (rupa.pro), create an account, or use the Rupa platform and related services (collectively, the "Services").

We encourage you to read this Policy carefully. If you do not agree with any part of it, please discontinue the use of our Services.

1. Who We Are

Rupa is a digital platform that helps creators launch, market, and sell digital products, courses, challenges, memberships, bookings, and other offerings to their audiences. We provide tools that analyze creator content, suggest product ideas, facilitate scheduling and appointments, automate engagement on connected social platforms such as Instagram, support marketing and delivery, process payments, and enable creators to build and grow their businesses.

Controller and Processor Roles. When you create a Rupa account and use our Services, we act as the data controller for your account and profile information. When creators use Rupa to collect information from their customers (for example, when a customer purchases a product or books an appointment), we act as a data processor on behalf of the creator. If you are a customer interacting with a creator's offerings on Rupa, please refer to that creator's own privacy practices regarding how they handle your data.

If you have any privacy-related questions, you can contact us at: hi@rupa.pro

2. Information We Collect

A. Information You Provide

Account details (name, email address, password, profile information)
Payment-related information handled through third-party processors
Creator content you upload (digital products, text, media, files)
Inputs provided to our AI-assisted features (such as product idea suggestions, content generation, or marketing tools)
Booking and scheduling preferences
Communication preferences
Messages or requests you send to us

B. Information Collected Automatically

When you visit or use the Services, we may automatically collect:

Device and browser information
IP address
Log data (timestamps, pages viewed, actions performed)
Usage analytics
Cookies and similar tracking identifiers

C. Payment Information

Payments on Rupa are processed by Stripe. We do not store full credit card numbers; we receive only limited and tokenized information necessary for payment verification and billing history.

D. User-Generated Content

Creators may upload content, products, media, or other materials. Users interacting with creator products may also generate content such as messages, form responses, booking requests, or activity logs.

E. Information From Third-Party Services

We integrate with third-party services to operate the platform. These include:

Analytics: PostHog, Google Analytics
Payments: Stripe
Storage: Cloudflare R2
Calendar and Scheduling: Google Calendar (see Section 2F below)
Other service providers essential for operating Rupa

F. Google Account Data

If you connect your Google account to use scheduling or booking features on Rupa, we may access the following data from your Google account through Google's APIs:

Calendar data: Your calendar events, availability, and event details necessary to display open time slots and manage bookings.
Basic profile information: Your name and email address associated with your Google account.

We access only the minimum data necessary to provide the scheduling and booking features visible in the Services. Your Google account data is handled in accordance with Google's API Services User Data Policy, including the Limited Use requirements described in Section 4 of this Policy.

G. Meta/Instagram Account Data

If you connect your Instagram Business or Creator account to Rupa, we access the following data through Meta's Instagram API:

Account profile: Instagram user ID, username, name, profile picture, account type, and media count.
Media metadata: IDs, captions, permalinks, media type, timestamps, and engagement counts of your posts, Reels, and Stories. We do not download or store your media files themselves; we cache only thumbnails and metadata.
Comments on your media: Comment text, comment ID, commenter Instagram user ID and username, and the parent media ID.
Direct messages: Message text, attachments metadata, sender Instagram user ID and username, message timestamps, and Story-reply context where applicable. Messages are only accessed to enable the automation features you configure.
Webhook events: Real-time notifications from Meta when comments, mentions, or messages are received on your account.

We access this data only to provide the Instagram automation features you have enabled in Rupa (such as keyword-triggered comment replies and direct messages). We do not access data from accounts other than the one you have explicitly connected.

Your Instagram account data is handled in accordance with Meta's Platform Terms and Developer Policies, including the disclosures in Section 4.5 of this Policy.

3. How We Use Your Information

Providing the Services: Creating and managing user accounts, processing payments, facilitating transactions, enabling scheduling and bookings, and delivering digital products. Legal basis: performance of a contract.
Operating and improving the platform: Maintaining, monitoring, analyzing usage patterns, and improving the Services. Legal basis: legitimate interest.
AI-assisted features: Suggesting product ideas, generating content, or providing insights to creators based on their inputs. Your inputs to AI features are processed by third-party AI providers solely to generate outputs for you. Your content is not used to train general AI models. Legal basis: performance of a contract / legitimate interest.
Instagram automation features: Sending direct messages and posting comment replies on your behalf based on the keyword triggers and rules you configure. Processing incoming Instagram comments, Story replies, and direct messages to determine whether your configured automations should fire. Legal basis: performance of a contract.
Communications: Sending service-related messages, responding to support requests, and (with your consent) sending marketing updates and product news. You may unsubscribe from marketing at any time. Legal basis: performance of a contract / consent.
Security and fraud prevention: Detecting and preventing fraud, abuse, or misuse of the Services. Legal basis: legitimate interest.
Legal compliance: Complying with applicable laws, regulations, and legal obligations. Legal basis: legal obligation.

4. Google API Services - Limited Use Disclosure

Rupa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only use Google user data to provide and improve the scheduling and booking features that are visible and prominent in the Rupa user interface.
We do not transfer Google user data to third parties, except as necessary to provide the scheduling feature, for security purposes (such as investigating abuse), or to comply with applicable laws.
We do not use Google user data for serving advertisements, retargeting, personalized or interest-based advertising, or for any purpose unrelated to the scheduling features.
We do not allow humans to read Google user data unless you provide affirmative consent, it is necessary for security purposes, it is required by law, or the data is aggregated and anonymized for internal operations.

4.5 Meta/Instagram Platform Terms Compliance

Rupa's use and transfer of information received from the Meta/Instagram APIs adheres to Meta's Platform Terms and Developer Policies. Specifically:

Limited purpose. We only use Instagram account data to provide and improve the automation features that are visible and prominent in the Rupa user interface — including comment-to-DM automations, Story-reply automations, and the activity logs and analytics that report on these features.
No advertising use. We do not use Instagram account data to serve advertisements, build advertising audiences, retarget users, or train advertising models.
No sale or transfer to data brokers. We do not sell, license, or transfer Instagram account data to data brokers, information resellers, or any third party for advertising or marketing purposes unrelated to the features you have enabled.
AI processing. When you enable AI-assisted reply features, the text content of incoming comments or DMs may be sent to our AI processing partner (Anthropic, the creators of Claude) solely to generate a reply on your behalf. This data is not used to train Anthropic's models. See Section 6A.
Human access. We do not allow human review of Instagram message or comment content unless: (a) you provide affirmative consent (for example, when contacting support about a specific automation), (b) it is necessary to investigate abuse or security issues, (c) it is required by law, or (d) the data is aggregated and de-identified for internal operations.
Audience data. When followers comment on your posts or send you Instagram messages, Rupa processes their Instagram-scoped user IDs and message content on your behalf as a data processor. As the connected account holder, you are responsible for ensuring your audience is informed of automated messaging in accordance with applicable laws.
Disconnection. You can disconnect Instagram from Rupa at any time in your account settings or by revoking access from your Instagram app permissions. See Section 8 and Section 9 for retention and deletion details.

5. Cookies and Tracking Technologies

Rupa uses cookies and similar technologies to:

Keep the platform secure and functional
Understand how users navigate the site
Improve performance and user experience
Enable analytics and attribution

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the Services.

6. How We Share Information

A. Service Providers

We share information with third-party service providers who perform tasks on our behalf, including:

PostHog (product analytics)
Stripe (payment processing)
Google Analytics (website analytics)
Cloudflare R2 (file storage)
Anthropic (AI processing — generates reply suggestions and personalizes auto-replies based on incoming Instagram comment or DM content; data is not used to train Anthropic's models)
Meta Platforms, Inc. (Instagram API provider)
Hosting, email delivery, and customer support partners

These providers access your information only to perform services for us and are contractually obligated to protect it.

B. Creators and Customers

When you purchase a creator's product or book an appointment, certain information (such as your name and email) is shared with the creator so they can deliver the product or service and communicate with you. Creators are responsible for their own handling of your information.

C. Legal Requirements

We may disclose information if required by law, regulation, or governmental request, or to protect the safety and legal rights of Rupa or its users.

D. Business Transfers

If Rupa is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change.

7. International Data Transfers

We operate globally. Your information may be stored or processed in the United States or other countries where our service providers are located.

Where required, we use appropriate safeguards (such as Standard Contractual Clauses) to protect international data transfers in accordance with applicable data protection laws.

8. How Long We Keep Information

We retain personal information only as long as necessary to provide the Services and meet legal requirements. Specific retention windows include:

Account and profile data: retained while your Rupa account is active; deleted within 30 days of account closure.
Instagram account data (profile, media metadata): retained while your Instagram integration is connected; deleted within 30 days of disconnection or account closure.
Instagram messages and comments processed by automations: retained for 90 days for activity log and analytics purposes, after which they are deleted or de-identified.
Automation activity logs (counts, timestamps, success/failure): retained for 12 months for analytics, after which they are aggregated and de-identified.
Financial and tax records: retained for the period required by applicable law (typically 7 years).

If you close your account or disconnect Instagram, we will delete the corresponding data within the windows above, except where retention is required by law.

9. Your Rights

Depending on your location, you may have rights including:

Access your personal data
Correct inaccurate or incomplete information
Delete your personal data
Restrict certain processing
Port your data to another service
Withdraw consent where processing is based on consent
Object to processing based on legitimate interest
Lodge a complaint with your local data protection authority

To exercise any of these rights, email us at hi@rupa.pro. We will respond within the timeframe required by applicable law.

If you are in the EU, UK, or other regions with data protection laws, we will honor your rights under GDPR or equivalent regulations.

Disconnecting Instagram and deleting Instagram data. You can disconnect your Instagram account from Rupa at any time in Account Settings → Integrations → Instagram, which will trigger deletion of your Instagram account data within 30 days. You can also revoke Rupa's access from your Instagram app settings (Settings → Apps and websites → Active → Rupa → Remove); when you do, Meta notifies us automatically and we delete your Instagram account data within 30 days. To request immediate deletion, email hi@rupa.pro.

10. Security

We protect your information using administrative, technical, and physical safeguards, including encryption, access controls, and monitoring.

However, no system is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

11. Children's Privacy

Rupa is strictly for users 18 years of age or older.

We do not knowingly collect information from minors. If you believe a minor has created an account, please contact us so we can delete it promptly.

Because Rupa includes Instagram automation features, creators are responsible for ensuring their automation rules do not specifically target minors. We will not knowingly enable automations directed at users under 18.

12. Links to Third-Party Sites

Rupa may contain links to external websites or integrations. We are not responsible for their privacy practices. You should review their policies before engaging with them.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will notify users by email or via a notice on the platform. The "Last updated" date at the top of this page reflects the latest revision. Continued use of the Services after changes are posted constitutes acceptance of the updated Policy.

14. Automated Messaging

Some Rupa features send messages, comment replies, or other communications on behalf of creators automatically based on rules the creator configures. When Rupa sends a direct message or comment reply on your behalf:

The message is sent from your connected Instagram account, not from a Rupa account.
You are responsible for the content of automations you configure and for compliance with Meta's Platform Terms, applicable consumer protection laws, and any disclosure requirements in your jurisdiction (including, where applicable, EU, UK, California, and other jurisdictions that require disclosure of automated communications).
Rupa may include a disclosure on automated messages where required to comply with platform policies and applicable law.

15. Contact Us

If you have questions, concerns, or requests related to privacy:

Email: hi@rupa.pro

Mail: Rupa LLC 30 N Gould St Sheridan, WY 82801-6317 United States

Privacy Policy