Kurasi Privacy Policy

Last updated: 30 September 2026. Product: Kurasi (api-saas.pethalvoid.com)

Kurasi converts source content (for example articles) into publish-ready social media assets and can publish approved content to connected Instagram Professional accounts on the customer's behalf.

1. Instagram / Meta data we access

When you click Connect Instagram and authorize Kurasi via Instagram Business Login, we receive and process:

• Instagram Professional account identifiers (Instagram user id)
• Username and display name (when provided by Meta)
• Account type (Business / Creator) for eligibility checks
• Profile picture URL (when provided)
• OAuth access tokens and granted permission scopes
• Token expiry metadata
• Publishing results (media / post ids, success/failure reasons)

We request only these Meta permissions for MVP publishing:

• instagram_business_basic - identify your Instagram Professional account
• instagram_business_content_publish - create and publish media (including carousels) that you approve

We do not request messaging, comment management, insights, or Human Agent permissions for this MVP.

2. Why we access this data

To connect your Instagram Professional account to your Kurasi workspace (tenant) and to publish content that you generate and explicitly approve in Kurasi.

3. How we use the data

• Store the connected account under your tenant
• Show connection status in Kurasi (never the access token)
• Publish approved carousel / media to your Instagram account via Meta's official API
• Record publish status and error messages for operations
• Refresh long-lived tokens so publishing continues to work

4. Token storage and security

Access tokens are secrets. Kurasi encrypts tokens at rest (AES-256-GCM) on our servers. Tokens are never returned to the browser, Telegram, or n8n automation payloads. Tokens are not logged in plaintext.

5. Multi-tenant isolation

Each Instagram connection belongs to one Kurasi tenant. Other customers cannot access your Instagram account, tokens, or publications.

6. Retention

Connection and token data are retained while the Instagram account remains connected. Content you generate in Kurasi is retained according to your workspace usage until you delete it or your account is closed.

7. Disconnect and deauthorization

You may disconnect Instagram inside Kurasi. You may also remove Kurasi from Instagram/Meta app settings. When you disconnect or Meta sends a deauthorize notification, we invalidate/remove stored Instagram credentials and stop publishing for that connection.

8. Data deletion

See our dedicated instructions:

https://api-saas.pethalvoid.com/data-deletion

You can also email yafizham@pethalvoid.com. Meta's automated data deletion callback is handled by our API.

9. Third-party processing (Meta)

Publishing and authorization are processed by Meta Platforms, Inc. through Instagram APIs. Kurasi does not sell your Instagram data.

10. Other data Kurasi processes

Depending on how you use Kurasi, we may also process authentication identity (via Clerk), tenant membership, source content URLs/text you submit, generated captions/slides, Telegram chat identifiers you link, and usage metrics.

11. Contact

Privacy / data requests: yafizham@pethalvoid.com

Operator: PethalVoid / Kurasi