Your information. Clear choices.

Apps you connect to BIGI

MCP lets you allow an AI app or an API key to use selected BIGI information and actions. This is optional and separate from Instagram access and BIGI sign in. The connection screen shows what will be shared. Instagram tokens and BIGI sign in credentials are never shared with that app.

External apps process the results you allow under their own terms and privacy settings. Check those controls before sharing personal information. Manage permissions and limits under MCP. Disconnecting stops new access, but cannot erase copies already received or undo published posts and delivered messages. Work you approved inside BIGI can continue.

API keys are stored as hashes. Consent and security records support access control and abuse prevention. Temporary authorisation and upload records expire; copied results follow their source's deletion and retention. Detailed completed operation results are kept for at most 90 days, or less when the source requires it. Non content receipts prevent repeated charges or sends.

Optional analytics

With your consent, BIGI uses its existing hosting and database infrastructure to understand marketing visits, signup clicks, new accounts, Instagram connections and completed workspace setup with an owner saved Brain item or draft. This processing is optional and does not affect access or pricing. The reports cover consenting visitors only and are separate from Search Console totals.

We store approved page paths, predefined button locations, broad source categories, timestamps and random references. Account outcomes can be linked privately to a workspace; analytics excludes messages, email addresses, Instagram handles, credentials and raw query strings. No advertising tracker or new analytics vendor is used.

We ask during onboarding. Profile and our privacy and cookie pages provide inline controls to change or withdraw your choice. There is no automatic website popup. Earlier visits, signup actions and connections are not reconstructed after consent. Choices last 180 days, attribution references expire after 30 days, raw events remain for 90 days and identifier free aggregate reports for 13 months. Withdrawal removes linked raw records and stops collection; completed account deletion also removes linked measurement records. The cookie policy explains temporary collection or deletion failures.

Who is responsible

BIGI is operated by Stockholm IT Academi AB, organisation number 559337-9141, VAT number SE559337914101, Fallskärmsgatan 1 lgh 1302, 128 34 Skarpnäck, Stockholm, Sweden. Contact info@heybigi.com for service questions or gdpr@sita.dev for privacy matters.

We act as controller for account administration, security and our own business records. The connected Instagram account owner normally acts as controller for follower conversations and leads; BIGI processes those records on that owner’s instructions. A follower can contact the account owner or contact us for help locating the responsible workspace.

Information we process

Account information includes your email, account identifiers, session information and professional Instagram profile. Workspace information includes onboarding answers, business links, approved knowledge, corrections, chats, campaign settings and uploaded files.

Connected Instagram data can include permitted media, comments, messages, usernames, identifiers and interaction events. Lead forms contain the fields the workspace owner chooses to request. Technical information includes IP addresses, request metadata, delivery records and security logs. We receive data from you, your authorised Instagram connection, people interacting with that account and the sources you ask us to read.

Purposes and lawful bases

We use account details and workspace instructions to provide the service you request and administer our agreement. Providing the necessary account information is required to create and secure your workspace; optional profile information is not required.

Security, fraud prevention and limited operational troubleshooting rely on our legitimate interests in protecting the service and its users. We balance these interests against the effect on individuals. Statutory accounting and lawful disclosure obligations rely on applicable law. Optional processing that requires consent starts only after consent; it can be withdrawn without affecting earlier lawful use.

The Instagram account owner is responsible for the lawful basis and notices for processing follower data, including any lead collection. Granting a Meta permission is not a substitute for a lawful basis under data protection law.

AI, business context and memory

Relevant messages, instructions and approved knowledge are sent to the AI provider used for the requested feature to prepare replies or suggestions. Requested media processing may send the relevant audio or image to a transcription or generation provider. Do not add unnecessary sensitive personal information to business knowledge or prompts.

Brain can store workspace specific context and corrections. Owners can inspect, correct and remove this information. Workspace memory supports later requests; it is not a separately trained foundation model. BIGI is not intended to make decisions with legal or similarly significant effects about individuals. AI output can be wrong and needs appropriate human review.

Recipients and international processing

Authorised workspace users can access their workspace records. Meta receives replies and other permitted Instagram actions. Hosting, database, AI, transcription and service email providers process the information required for their functions. Our subprocessor page identifies the services used in BIGI’s hosted configuration and optional processing paths. We do not sell personal information.

Providers may process information outside the European Economic Area. BIGI does not promise EEA only processing. Transfers requiring a Chapter V safeguard must be covered by an applicable adequacy decision or appropriate contractual safeguards, with additional measures where necessary. You may request information or a copy of applicable transfer safeguards at gdpr@sita.dev; confidential commercial material may be redacted.

How long information stays

Conversations, chats and leads have a default retention period of 90 days. A workspace owner can set a period from 7 to 730 days; conversation retention is measured from its last update. Knowledge, campaigns and saved media remain until removed or the workspace is deleted. Some memory episodes expire after 90 days.

Scheduled maintenance removes processed webhook envelopes after 7 days, completed service email records after 30 days and audit records after 365 days. Detailed before and after audit content is cleared after 30 days. Cleanup is scheduled rather than instantaneous; failed jobs are retried and unresolved events can remain while delivery failures are investigated.

We retain legally required business records for the period applicable to the record and jurisdiction. Deletion of live records does not instantly remove provider backups. Backup copies remain restricted and follow the relevant provider’s retention cycle. We explain any applicable retention exception when responding to a deletion request.

Your rights and how to use them

Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to processing. You may withdraw consent for processing based on consent. Exercising these rights does not require a paid plan.

Email gdpr@sita.dev with the relevant account or Instagram username and the request. We may ask for proportionate identity verification and coordinate with the relevant workspace controller. We respond without undue delay and normally within one month. For complex or numerous requests, a lawful extension of up to two further months may apply; we explain it within the first month.

You can complain to the Swedish Authority for Privacy Protection, IMY, or another competent supervisory authority. You do not have to contact BIGI first to exercise that right.

Security, children and changes

We use controls including encrypted connection token storage, access restrictions, workspace isolation and signed webhook verification. No internet service is immune from every risk. Report a suspected issue privately to info@heybigi.com.

BIGI accounts are intended for adults acting for a business or professional activity. Do not use BIGI to target children or intentionally collect children’s sensitive information. If you believe such information has been added, contact the privacy address for assistance.

We update this notice when processing changes. Material changes affecting account holders will be communicated through the service or the registered contact channel. The revision date identifies the current website notice.

Useful links

Contact the privacy team · Legal centre · Privacy notice · User Agreement · Request deletion

Your rights: Swedish Authority for Privacy Protection · EU General Data Protection Regulation