Privacy Policy
Salty, operated by Amaracus Ltd · Last updated 15 September 2026
Salty is a tool that businesses connect to their own Instagram account. When someone contacts that business — by commenting on its posts or sending it a direct message — Salty helps the business reply.
Who is responsible for your data
If you commented on or messaged a business that uses Salty, that business is the data controller. It decides what to do with your message. Amaracus Ltd is a data processor: we handle the data only on that business's instructions, and we do not use it for our own purposes.
To exercise your rights, you can contact the business directly, or contact us at filippos@amaracus.org and we will act on the controller's instruction.
What we process, and why
| Data | Why |
|---|---|
| The text of your comment or message | To understand what you asked and write a relevant reply |
| Your Instagram username and the account ID Instagram gives us | To address you, and to send the reply to the right conversation |
| Which post you commented on | To give the reply context, and to report to the business which posts lead to conversations |
| Whether a reply was delivered, read, or clicked | To report on whether the business's replies are useful |
| Contact details and enquiry notes recorded by the business | To manage your enquiry in its CRM. This may include your name, email and phone number shared for follow-up. |
| What you asked to see, and when it suits you | If the business uses appointment requests, so its team can arrange it with you. Nothing is booked until they confirm it with you. |
| A reference to an order, if you buy something | To tell the business the conversation led to a sale. We receive an order reference and amount, not your payment details. |
Message text and CRM contact details are handled separately.
We redact recognized email addresses, phone numbers and card-like numbers
from inbound text before saving new queued messages or conversation history
and before sending it to the AI model. A recognized phone number becomes
[REDACTED_PHONE]. Detection is pattern-based and may not catch
every format.
The business can separately record contact details and enquiry notes in its own CRM card for follow-up. These fields are available to the business and authorized Salty operators, are not included in the agent's message history or reply-monitoring copies, and can be corrected or cleared. Change history records which fields changed without retaining their old values.
A business can also let its assistant save contact details for follow-up. If it has turned this on and you send a phone number or email in a comment or message when asking to be contacted — or agree when the assistant asks — it is saved to that business's CRM card instead of being kept in the message text. Until then it is held separately for at most 24 hours, and deleted if you did not ask to be contacted. It is never sent to the AI model.
What we never do
- We never message you first. Salty only acts after you have contacted the business.
- We do not scrape your profile. We use only what Instagram's official API provides and what you wrote to the business.
- We do not sell your data, and we do not use it for advertising or to build profiles across businesses. Each business's data is kept separate from every other's.
- We do not use your messages to train AI models.
How we check the agent is behaving
Salty writes replies automatically, so we monitor what it actually says. A copy of each reply the agent sends on a business's behalf is delivered to Amaracus Ltd's own internal Slack workspace, where our staff read it to catch mistakes — a wrong price, an invented product, the wrong tone — and to fix them.
What this includes: the text of the reply, the Instagram username or account ID it was sent to, and which business it was sent for. It does not include anything already removed by the redaction described above: email addresses, phone numbers and card numbers are stripped before this point, so they are never in the copy we read.
This is quality assurance on the tool, carried out for the business as its processor. It is not used for advertising, not used to train AI models, and not shared outside Amaracus Ltd. A business can ask us to turn it off for its account.
The website itself
Separately from anything above: our own website, usesalty.com, uses Vercel Web Analytics to count visits. It is cookieless — it sets nothing on your device, does not follow you to other sites, and does not build a profile of you. What it records is aggregate: how many people opened a page, roughly where in the world from, and which page they came from.
This is about visitors to our marketing site. It has nothing to do with messages sent to a business using Salty, which are covered above.
Who else processes it
| Who | What for |
|---|---|
| Anthropic | Generating the reply. Message text is sent for processing and is not used to train their models. |
| Meta (Instagram) | The platform the conversation happens on |
| Fly.io | Hosting. Data is stored in Frankfurt, Germany (EU). |
| Vercel | Hosts our website and counts visits to it, without cookies. Not involved in your conversations. |
| Shopify | Only where the business uses it, for order matching |
| The business's own Slack | Where the business reviews replies before they are sent, if it has chosen to do so |
| Amaracus Ltd's own Slack | Where our staff read a copy of the agent's replies to check it is behaving correctly, as described above |
Where it is stored, and for how long
Data is stored in the European Union (Frankfurt, Germany). We keep conversation records for as long as the business is a Salty customer, so it can see its own history, and we delete them within 30 days of the business ending its use of Salty or asking us to erase them.
Your rights
Under the GDPR you can ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted. See how to request deletion. We respond within 30 days.
You can also stop Salty from processing anything new at any time, by not messaging or commenting on the business's account, or by blocking it on Instagram.
Contact
Amaracus Ltd — filippos@amaracus.org
If you are in the EU and believe we have handled your data improperly, you have the right to complain to your national data protection authority.