RebusAI

Privacy Policy

Last updated: October 5, 2026

1. Who we are

RebusAI Inc. ("RebusAI", "we", "us") runs the RebusAI platform at www.rebusai.com (the "Service"). The Service helps coaches, consultants and small businesses win clients: it builds lead magnets and landing pages, sends follow-up email, runs AI chat and phone assistants, drafts social posts, and can reply automatically to comments and direct messages on a connected Instagram account.

This policy explains what we collect, how we use it and the choices you have. In it, "you" is the person or business with a RebusAI account, and "your contacts" are the people who interact with your pages, emails, assistants or Instagram account.

2. Information we collect

A. Your account

  • Your name, email address and sign-in details.
  • Your plan and billing history. Card payments are handled by Stripe; we never see or store your full card number.
  • Messages you send our support team.

B. Your business

  • What you tell us about your business: descriptions you write, links you add and documents you upload, and the brand details and content we create from them.
  • Your settings, such as your booking link, domain and sending address.

C. Your Instagram account, if you connect it

You can connect an Instagram professional account through Meta's official Instagram login. We only receive what you approve on Meta's consent screen, and only for the account you connect:

  • Profile: the account's ID, username, name, profile picture and account type, and an access token that lets the Service act for the account.
  • Your own posts and captions: used during onboarding, if you choose to, to draft a description of your business (what you offer, who it is for, your tone of voice). You review and edit the draft before it is saved.
  • Comments and direct messages sent to your account: used only to run the Auto-replies you set up. When a comment or message matches one of your rules, we send the reply you wrote and keep a record that we sent it, including the person's Instagram username and ID.

We do not read other people's accounts, we do not use Instagram data for advertising, we do not sell it, and we do not use it to train AI models.

D. Your contacts

When your contacts fill in a form on your pages, open your emails, chat with your assistant, call your phone assistant or message your Instagram account, we process their details (such as name, email address, phone number, messages and call transcripts) on your behalf, to provide the Service to you. You decide which contacts to collect and are responsible for having a lawful basis to contact them.

E. How you use the Service

Technical information such as your IP address, browser, pages visited and error reports, which we use to keep the Service working, secure and free of abuse.

3. How we use information

  • To provide the Service: create your content, publish your pages, send your emails and run your assistants and Auto-replies.
  • To draft your business description from what you give us, including your Instagram posts if you choose.
  • To bill you, answer support requests and tell you about changes to the Service.
  • To keep the Service secure, prevent spam and abuse, and comply with the law.
  • To improve the Service, using aggregated or de-identified information only.

Automated replies on Instagram are only ever sent in response to someone who commented or messaged first, and the first one tells the person it is automated.

4. Who processes information for us

We do not sell personal information. We share it only with service providers that process it for us under contract, and only as needed to run the Service:

  • Supabase: database, sign-in and file storage.
  • Vercel: hosting and privacy-friendly site analytics.
  • Trigger.dev: background jobs, such as sending replies and refreshing connections.
  • OpenAI: generating content and drafts from what you provide.
  • Resend: sending email.
  • Stripe: payments.
  • Retell AI and Telnyx: phone calls for the phone assistant.
  • Sentry: error monitoring.
  • Cloudflare: bot protection on public forms.
  • Meta: the Instagram platform, when you connect an account.

We may also disclose information when the law requires it, or to protect the rights, safety and property of our users, the public or RebusAI.

5. How long we keep it

  • Account and business information: while your account is open, then deleted unless the law requires us to keep it longer.
  • Your Instagram access token: until you disconnect Instagram or remove RebusAI from your Instagram settings, when we delete it.
  • Records of Auto-replies sent: the recipient's Instagram username and ID are removed after 90 days, leaving only a count.

6. Deleting your data and your rights

You can have your data deleted at any time:

  • Instagram data: remove RebusAI in Instagram under Settings > Apps and websites. Meta tells us, we delete the data we hold from that account, and you get a confirmation code you can check on our data deletion page.
  • Your whole account: email admin@rebusai.com or use our contact form from the address on your account. We delete your account and its data within 30 days and confirm by email.

Depending on where you live, you may also have the right to access, correct, export or object to the use of your information. Contact us and we will respond within 30 days. If your contacts ask us about data we hold for you, we will refer them to you.

7. Security

Data is encrypted in transit, access tokens are stored encrypted at rest in tables only our servers can read, and access to production systems is limited to the people who need it. No system is perfectly secure, so we cannot guarantee absolute security.

8. Children

The Service is for businesses and is not directed to children under 13. We do not knowingly collect information from them.

9. Changes to this policy

When we change this policy we update the date above, and for significant changes we tell you by email or in the Service before they take effect.

10. Contact us

RebusAI Inc.
Email: admin@rebusai.com
Website: www.rebusai.com