Privacy Policy

TRIGMAZE is operated by PAIDGUY DIGITAL SERVICES (“we”, “us”), a business registered in Moradabad, Uttar Pradesh, India. TRIGMAZE turns Instagram comments, story replies, and DMs into automatic conversations for creators and small businesses. This policy explains, in plain language, what data we collect, why, who touches it, how long we keep it, and exactly how to get it corrected or deleted.

This policy covers two different groups of people, and we’ve tried to be clear about which section applies to which:

• Account holders — people who sign up for TRIGMAZE and connect their own Instagram account.
• Contacts — people who comment on, DM, or reply to a story of an Instagram account that runs TRIGMAZE. If you’ve never signed up for TRIGMAZE yourself but received an automated reply from someone who has, you’re a contact, and the “If you’re a contact, not an account holder” section below is written specifically for you.

PAIDGUY DIGITAL SERVICES is not currently required to hold GST registration — TRIGMAZE is a new business below the applicable turnover threshold. This is reviewed as the business grows, and this page will be updated the moment that changes.

What we collect, and why

Every category below exists to make a specific, real part of the product work — nothing is collected speculatively.

• Account details. Your name, email, and password (hashed, never stored in plain text) — created when you sign up, used to log you in and identify your workspace. Not shared with Instagram or anyone else.
• Your connected Instagram account’s public profile. Its Instagram user id, username, display name, account type, and profile picture URL — shown back to you in the dashboard so you can confirm you’re connected to the right account.
• An encrypted access token. Issued by Instagram when you connect, encrypted at rest before it ever touches our database, and used only to send the messages your automations are configured to send and to read the recent posts you choose as triggers. We never see or store your Instagram password — the connection uses Instagram’s own official login, not ours.
• Comments, DMs, and story interactions your automations react to. The text and media of the interaction, the sender’s Instagram id and username, and a timestamp — this is what lets your Live Inbox show a real conversation and what an automation reads to decide whether to reply.
• The automations you build. Trigger keywords, message text, flow logic, and any webhook URLs you configure — this is your own content, stored so your automations keep running and so you can edit them later.
• Payment and billing metadata. Your plan, billing cycle, and Razorpay subscription/payment ids — never your full card number or bank account details, which Razorpay handles directly (see “Who else touches this data” below).
• Basic technical logs. IP address and timestamp on login and security-relevant events (password changes, new sign-ins), kept so we can show you your own active-sessions list and detect account takeover attempts — see Trust & Security.

What we deliberately don’t collect: we don’t run any third-party analytics or advertising trackers on this site or in the app (no Google Analytics, no ad pixels, no session-recording tools) — the only cookies TRIGMAZE sets are strictly functional (keeping you logged in) or a single local preference for whether you’ve dismissed a banner, stored in your browser only. We also don’t read or store anything from your connected Instagram account beyond what your own automations are configured to act on — TRIGMAZE never scrapes your followers list, your DM history with people you haven’t set up an automation for, or any content you haven’t explicitly connected an automation to.

What we never do

• We never sell your data, or your contacts’ data, to anyone, for any reason.
• We never send message content, contact data, or automation logic to a third-party AI or analytics service. Every automation runs entirely on servers we operate directly.
• We never message someone who hasn’t interacted with your account first — TRIGMAZE has no cold-outreach capability at all, by design, not just by policy.
• We never share your Instagram access token with anyone, including our own support staff in plain form — it’s encrypted at rest and only decrypted in memory at send time.

Who else touches this data

Only infrastructure providers that make the product work — never data brokers, advertisers, or resellers:

• Meta/Instagram — the platform your automations run on. Every send and read goes through Instagram’s own official Graph API; see Meta’s own data policies for what they separately retain on their side.
• Database hosting. Our production database runs on managed cloud infrastructure located in Singapore. If you’re in India, this means your data is transferred to and stored in Singapore, not India — we chose that region for latency to our application server, not to avoid any obligation, and the same DPDP-consistent protections in this policy apply to it regardless of where the bytes physically sit.
• Network and DNS infrastructure for pi7t.app can see connection metadata (IP address, requested URL) as part of routing traffic to our server; it does not see message content, which is only ever decrypted on our own application server.
• Razorpay — a licensed Indian payment aggregator that processes your payment when you upgrade to a paid plan or buy a DM top-up. Razorpay collects and stores your card/UPI/bank details directly under its own PCI-DSS-compliant systems — we never see or store your full card number, CVV, or bank account number ourselves, only the subscription/payment reference id Razorpay gives back to us.
• Cloud object storage used for two things only: a CSV file when you export your Contacts list, and media attachments sent through Live Inbox or a broadcast. Files are private by default.
• Our application code and the servers that run it are operated directly by PAIDGUY DIGITAL SERVICES — not a shared, unaudited third-party SaaS backend.

How long we keep it

Deleting your data

Deleting your TRIGMAZE account (Settings → Account → Delete account) permanently removes your workspace, every connected Instagram account and its stored token, every contact, automation, and message TRIGMAZE holds for you, and your login itself. You’ll get a confirmation email first — nothing is deleted until you click the link in it, so a compromised but still-logged-in session can’t delete your account without access to your inbox too. Once confirmed, deletion is immediate and cannot be undone or recovered.

Disconnecting a single Instagram account (without deleting your whole TRIGMAZE account) removes that connection’s token and every contact/message tied specifically to that account — your other connected accounts, if any, are unaffected. The same thing happens automatically if you revoke TRIGMAZE’s access from inside Instagram’s own connected-apps settings; Meta notifies us and we process the removal without you needing to do anything on our end.

See Data & DPDP rights for the full request process, response timelines, and what to do if you’d rather email us than use the in-app controls.

If you’re a contact, not an account holder

If you commented on, DMed, or replied to the story of an Instagram account that runs TRIGMAZE, some of your interaction data is processed as described above — but you never signed up for TRIGMAZE and have no account or dashboard here. Your rights are still real:

• Opt out any time. Reply STOP or “unsubscribe” to any automated DM and you’ll get an immediate confirmation — every TRIGMAZE automation checks this before sending, permanently, for that Instagram account. This works even if you’ve never messaged that account through TRIGMAZE before.
• Ask the account owner directly. They can remove you as a contact, tag you as opted out, or export/delete your record from their side at any time.
• Contact us directly. Email [email protected] with the Instagram @username the interaction happened on (yours or the account you interacted with) and what you’re requesting — we can look up and act on your data even though you don’t have a TRIGMAZE login.

Children’s data

TRIGMAZE is not directed at children, and account holders must be old enough to hold a professional Instagram account under Meta’s own terms. We don’t knowingly collect data from anyone Meta’s policies classify as a minor for automation purposes; because comments and DMs can in principle come from anyone with an Instagram account, we rely on Instagram’s own age-related enforcement rather than performing separate age verification ourselves. If you believe a minor’s data has reached us in a way that shouldn’t have happened, email [email protected] and we’ll act on it directly and promptly.

Security

Access tokens are encrypted at rest, all traffic is TLS-encrypted, and we run two-factor authentication, breached-password checks, and an active-sessions list you control. Full detail on what’s actually deployed — not marketing claims — lives on the Trust & Security page. If you believe you’ve found a security issue, see that page’s responsible- disclosure contact ([email protected]) rather than filing it here.

Changes to this policy

If we make a material change to what we collect or how we use it, we’ll update the date at the top of this page and, for any change that meaningfully affects your rights, email account holders directly rather than relying on a quiet page edit.

Contact

Questions about this policy, or a request that doesn’t fit the in-app controls: [email protected]