1. Who we are
CodeChest Ltd is the operator and data controller for the CodeChest-operated Cavabla service. We are registered in England and Wales under company number 16912070. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
2. What Cavabla does and what this Policy covers
Cavabla enables authorised businesses and teams to connect Instagram professional accounts, configure keyword campaigns, receive Meta webhooks, send replies through official Meta APIs, track campaign links, and review delivery and performance records. This Policy covers the website, accounts, workspaces, billing, support, and those automation activities.
3. Information we collect
Account and profile information includes your name, email address, phone number, date of birth, chosen gender setting, password hash, email-verification status, consent record, workspace membership, account preferences and email language. With Google sign-in we receive your Google identifier, name, email address and profile image, but not your Google password.
Security and device information includes session identifiers, IP address, browser or device information, sign-in activity, session access times, two-factor authentication status, rate-limit and security events. Consent audit records may include date, IP address and general device type.
Workspace, campaign and Instagram information includes workspace names and roles; connected account identifiers, usernames, names, encrypted access tokens, token status and follower snapshots; campaign names, keywords, messages, public replies, links, templates and settings; webhook payloads, comment or message content and identifiers, sender identifiers, delivery results, error logs and diagnostics.
Billing and analytics information includes plan, subscription, promotion and invoice status and Stripe references. Stripe processes payment details; Cavabla does not store full card numbers. Tracked links may process a pseudonymous delivery token, Instagram sender identifier and available username, hashed IP, browser information, referrer, link, campaign and click time. We do not collect Instagram or Google passwords, full card numbers, address books, precise GPS location, data for sale to brokers, or content for AI-model training.
4. How and why we use information
We use information to provide accounts, workspaces, campaigns, Meta connections, replies and reports under our contract; to authenticate and secure the service through verification, sessions, 2FA, abuse prevention and audit records under contract and legitimate interests; and to provide support and important service communications.
We also use information to administer plans, payments, subscription changes, fraud prevention and accounting under contract and legal obligations, and for diagnostics, platform compliance, reliability and lawful requests under legitimate interests and legal obligations. We do not use account, campaign, comment, message or Instagram data to train AI models or make decisions producing legal or similarly significant effects about users.
5. Why we require a phone number
We require a phone number so authorised CodeChest support staff can reach you quickly when an important account, security, billing, Instagram integration or service problem needs timely resolution. Depending on the issue and number supplied, contact may be by phone call or service message.
We do not use your phone number for advertising or promotions without separate consent and do not sell it. Access is limited to authorised personnel and providers that need it for support or security. You may request correction or deletion, subject to account requirements and legal retention duties.
7. Service providers and disclosures
We do not sell personal information. We disclose only what is reasonably needed to operate Cavabla, process payments, deliver communications, connect Instagram, secure the service or comply with law.
Providers include Meta for Instagram OAuth, account data, webhooks, comments, messages and replies; Stripe for checkout, payments, invoices and fraud prevention; Resend or the configured mail provider for verification, security, billing and service emails; Google for optional sign-in; and hosting, database, Redis and network providers for hosting, storage, queues, backups, security and delivery.
Where lawful and protected, we may also disclose information to professional advisers, regulators, courts, law enforcement or a buyer in a genuine corporate transaction.
8. Data retention and deletion
Account, profile, phone and workspace data is kept for the life of the account; sessions for up to 30 days unless ended earlier; Instagram tokens until disconnection, deletion, expiry or no longer needed; and campaign, webhook, message, delivery-log and link data while needed to operate the workspace. Live application records are hard-deleted when the owner deletes the workspace through account deletion.
Billing, tax, fraud and accounting records are normally retained for up to 6 years or longer where law or an active dispute requires it. Consent and legal records are retained as needed to demonstrate agreement and compliance.
Disconnecting Instagram removes the stored connection and stops related campaigns. Self-service account deletion is permanent and removes authentication and profile data, memberships, and every owned workspace with its live application records, but not another owner's workspace. Active, paused, trial and other non-canceled subscriptions block deletion until CANCELED. Stripe and other processors may independently retain required transaction or compliance records.
9. Your privacy rights
Depending on applicable law, you may have rights to access, correct, delete, restrict or receive your information; object to processing; withdraw consent; and complain to a regulator. UK and EEA users may exercise UK GDPR or GDPR rights. California residents may request access, correction or deletion and information about categories collected or disclosed. We do not sell or share personal information for cross-context behavioural advertising.
Send requests to [email protected]. We may verify your identity and authority before acting and normally respond within one month or the legally required period. UK users may also complain to the Information Commissioner's Office.
10. International transfers
Cavabla and its providers may process information in the United Kingdom, European Economic Area, United States and other provider locations. Where required, we rely on adequacy regulations, the UK International Data Transfer Agreement or Addendum, standard contractual clauses, and appropriate technical and contractual safeguards.
11. Age restriction
Cavabla is intended only for people aged 18 or older. We do not knowingly permit people under 18 to create accounts or use the service. Date of birth confirms this requirement. Contact us if you believe a person under 18 supplied information so we can investigate and delete or restrict it as appropriate.
12. Security
We use measures designed to protect information, including HTTPS/TLS, password hashing, secure production session cookies, role-based workspace access, encrypted Instagram tokens, optional two-factor authentication, rate limiting, webhook verification and operational logging. No online system is completely secure. Contact us immediately if you suspect unauthorised access.
13. Changes to this Policy
We may update this Policy when the service, providers, law or data practices change. We will publish the revised date and provide additional email or in-app notice where a change materially affects users. Processing that requires new consent will not begin until that consent is available.
14. Contact
Privacy requests, deletion requests and data-protection complaints may be sent to [email protected]. You may also write to CodeChest Ltd at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.