Privacy Policy
This Privacy Policy explains how Body of Christ LLC (“we”, “us”), a Wyoming, USA limited liability company, processes personal data when you interact with the Instagram professional account @servant.niko and related automations operated through the Servant DM tool.
Controller: Body of Christ LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA
Contact: bizforniko@gmail.com
1. Scope
This policy covers people who comment on, message, or otherwise interact with @servant.niko automations, and operators who sign in to the admin console. Servant DM is a private automation tool for accounts we own or manage — not a public multi-tenant SaaS.
2. Data categories
- Instagram identifiers: Instagram-scoped user IDs (IGSID), usernames, profile fields Meta provides to our app (e.g. name, follow relationship when available). Follow status is used only to decide whether to send a gated offer.
- Message and comment content: text of comments, DMs, story replies, postbacks, and related metadata (timestamps, media IDs).
- Emails captured in chat: email addresses you voluntarily send in a DM after we ask (with consent language in the prompt).
- Admin logs: operator sign-in events, audit actions (e.g. pause automations), and technical logs needed to secure the service.
- Technical: IP address (via Cloudflare) for rate limiting and abuse prevention; cookie identifiers for admin sessions (see Cookies).
3. Purposes
- Run comment-to-DM and related messaging automations you triggered.
- Provide human inbox / CRM features for operators (Niko & Oscar).
- Security, fraud/abuse prevention, and rate limiting.
- Comply with Meta platform requirements and applicable law (including deletion requests).
4. Legal bases (GDPR)
- Legitimate interests (Art. 6(1)(f)): operating messaging automations for our business/ministry communications with people who chose to interact with our public Instagram content; securing the admin console.
- Consent (Art. 6(1)(a)): collecting an email address in chat when we ask and you send it; optional marketing-style broadcasts within Meta’s messaging rules where consent is required.
- Contract / steps prior to contract (Art. 6(1)(b)): where messaging is necessary to deliver something you requested (e.g. a link you asked for).
- Legal obligation (Art. 6(1)(c)): responding to valid deletion or regulatory requests.
Special category data: comments and messages may reveal religious beliefs. We process such content only where you have manifestly made it public by posting it on Instagram (Art. 9(2)(e)) or with your explicit consent (Art. 9(2)(a)), and only to reply to you. We do not use it to profile you.
5. Retention (concrete periods)
- Message/comment event logs: 90 days, then deleted or anonymized.
- Contacts (IGSID/username/tags/email/opt-out): while you remain engaged or until deletion/opt-out request, then removed within 30 days of a verified request; inactive contacts with no activity for 24 months are purged.
- Admin audit logs: 12 months.
- Webhook replay / rate-limit counters: up to 7 days.
- Session cookies: 12 hours (admin session).
Where feasible, Servant DM enforces these periods via scheduled maintenance jobs.
6. Sharing and processors
- Meta Platforms - we use the Instagram Messaging APIs to send and receive messages. Meta processes this data as an independent controller under its own Privacy Policy.
- Cloudflare, Inc. — hosting (Workers, Durable Objects / SQLite) as a processor under our instructions.
We do not sell personal data. We do not use session-replay vendors or SMS gateways.
7. International transfers
Data may be processed in the United States and other locations where Cloudflare and Meta operate. Where GDPR applies, transfers to the United States rely on the EU-US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses (GDPR Art. 46).
8. Your rights (GDPR)
Where applicable you may request access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent for email capture. Contact bizforniko@gmail.com. We respond within one month (GDPR) or 45 days (US state laws). You may lodge a complaint with your local supervisory authority.
If you are in Malaysia, you may also exercise access and correction rights under the Personal Data Protection Act 2010 by emailing us.
9. US state privacy rights ( incl. CCPA/CPRA)
Although we may not be subject to these laws, we honor the following requests: California and similar state residents may request know/access, delete, and correct. Email bizforniko@gmail.com. We do not sell or “share” personal information for cross-context behavioral advertising as those terms are commonly defined. We will not discriminate for exercising these rights.
10. Children
Servant DM and @servant.niko automations are not directed to children under 13 (COPPA). We do not knowingly collect personal information from children under 13. In the EU/EEA/UK we do not knowingly process data of children under 16 without appropriate authority. If you believe a child provided data, contact us for deletion.
11. Security
We use HTTPS, signed admin sessions (HttpOnly cookies), password hashing (PBKDF2), CSRF tokens, webhook signature verification, role-based admin access, and rate limiting. If a breach affects your data, we will notify you and regulators where the law requires.
12. Cookies
We use essential cookies only on the admin console:
mcp_session— signed admin session (HttpOnly, Secure on HTTPS, SameSite=Lax), ~12 hours.mcp_csrf— CSRF protection for admin forms (SameSite=Strict), ~24 hours.
No advertising or analytics cookies. No cookie banner is shown because only essential cookies are used.
13. Email and CAN-SPAM
Servant DM does not send email. Emails you share in chat are stored only so we can follow up with you.
14. Opt-out of broadcasts
Reply STOP or UNSUBSCRIBE in Instagram DM to opt out of broadcasts and sequences. Reply START to opt back in.
15. Changes
We may update this policy; the effective date above will change. Material changes will be reflected on this page.
16. Contact
Body of Christ LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA · bizforniko@gmail.com
Related: Terms · Data deletion