CigWarts Privacy Policy

Effective on first publication.

Who operates CigWarts

CigWarts is an owner-operated Instagram research integration based in Germany. Responsible operator: Çağrı Ünlü, operating the CigWarts project; contact: glaner306@gmail.com. Operator service address: Schmidstr. 2H 10179 Berlin Germany. CigWarts is a personally operated project for research and experimentation, with possible future commercial use. It currently has no registered company or customers. It is not presented as exclusively household activity. For privacy, deletion or support requests, email glaner306@gmail.com.

What the integration does now

CigWarts receives Instagram message events from Meta and verifies their authenticity. General message collection is currently disabled. Message content is processed temporarily to validate and acknowledge incoming events, but is not retained as research records in this state. There is no currently authorized research sender and no enrollment test is open.

The intended future use is for the owner's personal account to send research references and explanatory notes to the owner's professional account. Collection would accept only one explicitly authorized Instagram sender. This requires separate activation. Message association and owner-authorized AI analysis are intended later steps; they are not currently performed automatically.

There is no public inbox access, automatic AI analysis, automatic publishing or downloading of linked content. Ordinary messages and tester-role acceptance are not treated as blanket consent to research retention.

Information processed and why

Incoming events can contain message text, shared links, sender and recipient identifiers, message identifiers and timestamps. They are processed for authentication, validation and delivery handling. Unrelated senders' message content is not intentionally logged or stored by the integration.

If collection is enabled later, authorized messages, shared post/Reel URLs, accompanying notes and necessary identifiers/timestamps may be kept privately for the owner's research. Separate messages remain separate records; automatic association is not yet provided. Profile links can be retained as ordinary message text; automatic profile-link extraction or resolution is not promised.

A separately authorized enrollment test may temporarily retain a candidate sender identifier and limited test metadata. The operator removes this temporary information after the bounded test. It does not retain unrelated DM content.

For email requests, the operator processes your email address, request and the minimum information needed to locate a record and verify that you control the relevant account. For the current limited webhook authentication, validation and secure acknowledgement, CigWarts relies on Article 6(1)(f) GDPR: the legitimate interest in securing the integration and checking controlled delivery. The assessment is limited to necessary temporary processing, with general collection disabled, no intentional message-content logging or onward analysis, and no research-message retention. It does not authorize unrelated research, profiling or AI use. Handling applicable GDPR rights requests relies on Article 6(1)(c), in conjunction with Articles 12 to 22 GDPR. Necessary ordinary support correspondence and proportionate records needed to address disputes rely on Article 6(1)(f), subject to necessity and the rights of the person concerned. Any future research collection requires its legal basis and retention rule to be settled before activation.

Storage, retention and providers

General research collection is disabled, so research message content is not currently retained. No automatic retention purge exists. The operator will publish a defined retention rule before enabling future collection.

Deletion requests are handled manually as described in the User Data Deletion Instructions. The operator monitors the contact mailbox and spam folder and handles deletion requests manually. When a request is received, the operator keeps a private request log containing only a reference number, received and due dates, a correspondence reference, verification outcome, affected data categories, action and response dates, outcome and any exception reason, and a review date. It does not copy Instagram message content, credentials or identity documents. Ninety days after closure, the operator reviews continued necessity and deletes unnecessary log entries and correspondence unless an open dispute or another documented need requires retention. Any retained information is limited to what that need requires and assigned a further review date. Deleted active records can remain temporarily in provider-managed recovery copies until the applicable expiry; a restore must respect prior deletion requests.

Meta operates Instagram and supplies the events. Cloudflare provides hosting and private storage. Google provides the ordinary personal Gmail correspondence channel; no Google Workspace subscription or customer data-processing agreement is claimed. Do not email Instagram conversation contents or other unnecessary sensitive information. Providers may process technical connection, delivery and security data. These documentation pages add no advertising, analytics scripts or application cookies.

CigWarts does not sell messages, publish them or send them to AI providers. No unnecessary third-party sharing is authorized. Necessary provider processing and legally required disclosures remain subject to applicable requirements. Provider processing can take place outside Germany and the European Economic Area, including in the United States. No Germany-only or EU-only processing guarantee is made. Cloudflare processes customer content under its Data Processing Addendum, incorporated into its self-service terms, including standard contractual clauses for applicable restricted transfers. Meta independently operates Instagram under its applicable privacy and platform terms; its independent processing is distinct from CigWarts processing. See the Meta Privacy Policy. Google describes global processing and its use of applicable adequacy decisions, the EU-US Data Privacy Framework and standard contractual clauses in its data-transfer explanation. Those provider statements are not a claim that every operation uses the same mechanism or that CigWarts has a Workspace agreement. Contact the operator for information about applicable safeguards and copies or references to them.

Your rights and contact

Contact glaner306@gmail.com to request access, correction, deletion, restriction, portability where applicable, or to object to processing. You may withdraw consent where processing relies on it and complain to a competent data-protection authority. The operator must respond without undue delay and normally within one month, explaining any lawful extension. No automated decision-making or profiling is performed.

Do not send passwords, access tokens, identity documents or private conversation copies. See the Terms of Service. Material changes to collection, sharing, retention or AI use will be described before they are activated.