Privacy Policy

This Privacy Policy explains how Averon Labs (Proprietor: Akash Sinha), trading as Brumo (“Brumo”, “we”, “us”, or “our”) collects, uses, stores, discloses, and otherwise processes personal data in connection with the Brumo platform, website, applications, features, and related services (collectively, the “Services”).

Effective date: 10 September 2026 | Last updated: 15 September 2026

This Privacy Policy explains how Brumo (“Brumo”, “we”, “us”, or “our”) collects, uses, stores, discloses, and otherwise processes personal data in connection with the Brumo platform, website, applications, features, and related services (collectively, the “Services”). It also explains the rights and choices available to individuals whose personal data is processed in connection with the Services.

This Privacy Policy should be read together with Brumo’s Terms & Conditions, Cookie Policy, Data Processing Agreement (DPA), Refund & Cancellation Policy and Fair Usage Policy, as applicable. These documents collectively govern the relationship between Brumo and users of the Services and describe the respective responsibilities of Brumo and its customers in relation to personal data.

Brumo acts as a data fiduciary, or equivalent responsible entity where applicable law uses different terminology, in relation to personal data that Brumo collects and processes for its own purposes, including information relating to Brumo accounts, users, billing, authentication, security, support, communications, and operation of the Services.

In relation to personal data contained in or arising from interactions with a customer’s connected Instagram account, including comments, direct messages, Story interactions, and related information concerning individuals who interact with that account, the relevant Brumo customer determines the purpose for which such personal data is processed. Accordingly, the customer, whether an individual creator, sole proprietor, business, brand, organisation, coach, or other customer, acts as the relevant data fiduciary, while Brumo acts as a data processor or service provider processing such information on the customer’s behalf.

Where applicable, the DPA between Brumo and the customer governs the processing of personal data undertaken by Brumo as a processor.

This Privacy Policy applies to individuals who use or access the Brumo Services, create or maintain a Brumo account, connect an Instagram account to Brumo, configure or use automation features, communicate with Brumo, or otherwise interact with Brumo in connection with the Services.

It also addresses the processing of information relating to individuals who interact with a customer’s connected Instagram account, including individuals who comment on posts, send direct messages, respond to Stories, or otherwise interact with the account. In such circumstances, Brumo generally processes the relevant information on behalf of the customer and in accordance with the customer’s instructions.

Brumo is an independent service provider and is not affiliated with, endorsed by, or otherwise controlled by Meta Platforms, Inc. or Instagram. The processing of information by Meta or Instagram is governed by their respective terms and privacy policies.

Brumo may collect personal data that is necessary to provide, maintain, secure, and improve the Services. This may include information provided when creating or maintaining a Brumo account, such as a name, email address, account credentials, business or creator information, contact information, subscription information, and other information voluntarily provided by the user.

Where a user connects an Instagram account to Brumo, Brumo may receive information made available through the applicable Meta or Instagram APIs and permissions. Depending on the permissions granted and the features used, this may include Instagram account identifiers, usernames, profile information, posts, comments, direct messages, Story interactions, automation-related information, keywords, and other information required to execute customer-configured workflows.

Brumo may also collect technical and operational information, such as IP address, browser and device information, operating system, timestamps, diagnostic information, logs, usage information, and information relating to interactions with the Services. Such information is used for purposes including authentication, security, troubleshooting, service operation, and maintaining the reliability of the Services.

Where Brumo processes information relating to individuals who interact with a customer’s connected Instagram account, including commenters, direct-message senders, and Story interactors, the customer is responsible for determining the purposes for which that information is processed. Brumo processes such information as a data processor or service provider solely to provide the Services and perform the automation and other functions configured or authorised by the customer.

Brumo does not independently determine the purposes for which such Instagram interaction data is used. The customer remains responsible for providing appropriate notices, obtaining any consent required by applicable law, responding to requests from individuals whose information is processed on the customer’s behalf, and ensuring that its use of the Services complies with applicable law.

6.1 Provision of Services

Brumo processes personal data to create and maintain user accounts, authenticate users, connect and maintain integrations, execute automation workflows, process customer-configured instructions, provide customer support, communicate with users, and otherwise provide the Services.

6.2 Security, Fraud Prevention and Service Integrity

Brumo may process personal data and technical information where reasonably necessary to maintain the security, integrity, availability, and reliability of the Services, detect and prevent fraud, abuse, unauthorised access, malicious activity, and other security threats, investigate incidents, and enforce applicable terms and policies.

6.3 Service Improvement

Brumo may monitor and analyse the performance and use of the Services for the purpose of maintaining, troubleshooting, evaluating, and improving the Services. Any data used for service improvement and analytics under this section will be used only in aggregated and de-identified form, such that it is not used to identify or directly relate the analysis to an individual person.

Brumo will not use the content of individual messages, comments, or other personally identifiable interaction data for general service improvement purposes except where such processing is otherwise necessary for the provision, security, or operation of the Services or is required or permitted by applicable law.

6.4 Compliance with Law

Brumo may process and retain personal data where necessary to comply with applicable laws, regulations, legal processes, governmental requirements, court orders, or other lawful obligations, and where reasonably necessary to establish, exercise, or defend legal rights or claims.

Brumo provides technical infrastructure that enables customers to configure automated responses, workflows, and other actions relating to their connected Instagram accounts. The customer determines the instructions, triggers, keywords, responses, and other parameters governing such automation.

Customers are responsible for ensuring that their automated communications and processing activities comply with applicable law, platform rules, and the rights of individuals interacting with their accounts. Brumo processes relevant information to the extent necessary to execute the customer-configured automation and provide the Services.

Brumo processes personal data in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), to the extent applicable, and other applicable data protection and privacy laws.

Where consent is required under applicable law, Brumo will process personal data on the basis of valid consent obtained from the relevant individual. Brumo may also process personal data where such processing falls within a legitimate use or other lawful ground recognised under the DPDP Act or other applicable law, including where processing is necessary for compliance with a legal obligation, response to a lawful request, protection of security, prevention of fraud or misuse, or other purposes permitted by applicable law.

Where Brumo acts as a processor on behalf of a customer, the customer is responsible for determining the appropriate lawful basis for processing personal data under its control and for providing any notices or obtaining any consent required by applicable law. Brumo will process such personal data in accordance with the customer’s documented instructions and applicable legal requirements.

Brumo acts as a data fiduciary for personal data that it processes for its own independent purposes, including account administration, security, service operation, support, communications, billing, and compliance.

Where Brumo processes personal data on behalf of a customer in connection with the customer’s connected Instagram account, Brumo acts as a data processor or service provider. The customer remains responsible for determining the purposes and means of processing such information, subject to the terms of the DPA and applicable law.

Brumo may disclose personal data to service providers, contractors, infrastructure providers, technology providers, and other third parties where such disclosure is reasonably necessary to provide, maintain, secure, or support the Services. Such parties may process information only to the extent necessary for the services they provide to Brumo and subject to appropriate contractual or other safeguards where required by applicable law.

Brumo may also disclose personal data where required or permitted by applicable law, including in response to lawful requests, court orders, regulatory requirements, or governmental authorities, or where reasonably necessary to protect the rights, property, security, or safety of Brumo, its users, or other persons.

In the event of a merger, acquisition, restructuring, financing, sale of assets, or similar corporate transaction, personal data may be transferred as part of the relevant transaction, subject to applicable law and appropriate safeguards.

Brumo does not sell personal data for monetary consideration.

Where a customer connects an Instagram account to Brumo, Brumo accesses and processes information made available through Meta and Instagram APIs and permissions granted by the customer. The availability and scope of such information may depend on Meta’s platform rules, APIs, permissions, and technical requirements.

Brumo uses such information only to provide the Services, execute customer-configured workflows, maintain security and reliability, comply with applicable law, and perform other processing expressly permitted under this Privacy Policy, the DPA, or applicable customer instructions.

Brumo retains personal data only for as long as reasonably necessary for the purposes for which it was collected or processed, subject to applicable law and legitimate business, security, and legal requirements.

Instagram access tokens and equivalent authentication credentials will be deleted immediately upon disconnection of the relevant Instagram account or deletion of the associated Brumo account, subject to any technically necessary processing required to complete the deletion.

Message content, comment content, conversation information, and similar Instagram interaction data may be retained for up to twelve (12) months while the relevant account and Services remain in use, unless a shorter period is required by the customer, applicable law, or the nature of the processing. Following disconnection of the relevant Instagram account or deletion of the associated Brumo account, such information will be deleted within thirty (30) days, subject to applicable legal, security, dispute-resolution, or other lawful retention requirements.

Operational and security logs that do not contain message content may be retained for up to one (1) year, or for such other period as may be reasonably necessary to maintain security, investigate incidents, comply with applicable law, or establish, exercise, or defend legal claims.

Notwithstanding the foregoing, following deletion of a Brumo account, Brumo retains (a) the connected Instagram account's unique identifier (not the associated username) and its monthly message usage counter for thirty (30) days, solely to prevent abuse of free-plan usage limits, and (b) technical delivery and security records — containing no message content, usernames, or other personal data of End Users — for up to one (1) year, to investigate incidents, resolve disputes, and meet Brumo's obligations under applicable law and Meta's Platform Terms. Further detail is available in Brumo's Data Deletion Instructions.

Brumo users may request deletion of personal data associated with their Brumo account, subject to applicable law and any information that Brumo is required or permitted to retain.

Where a customer disconnects its Instagram account from Brumo, Brumo will cease future processing of the relevant Instagram data for the customer’s automation workflows and will process deletion in accordance with the retention periods described in this Privacy Policy.

For personal data relating to an individual who has commented on, sent a direct message to, or otherwise interacted with a customer’s Instagram account, the relevant customer is the data fiduciary and Brumo acts as the data processor. Accordingly, such individuals should ordinarily direct requests relating to their personal data to the relevant Instagram account owner or customer.

If such an individual submits a request directly to Brumo, Brumo may inform the individual that the relevant customer is responsible for the processing of that data, forward or communicate the request to the customer, and provide reasonable assistance to the customer in responding to the request. Upon receiving an appropriate instruction from the relevant customer, Brumo will take the required action, including deletion of the relevant data, subject to applicable law and any lawful retention requirement.

Brumo may retain limited records relating to a request where reasonably necessary to demonstrate compliance, prevent abuse, resolve disputes, or comply with applicable law.

Brumo maintains reasonable technical and organisational safeguards designed to protect personal data against unauthorised access, alteration, disclosure, loss, misuse, or destruction. The safeguards applied may include access controls, authentication mechanisms, monitoring, security procedures, and other measures appropriate to the nature of the information and the risks associated with its processing.

No method of transmission, storage, or electronic processing can be guaranteed to be completely secure. Accordingly, while Brumo takes reasonable measures to protect personal data, it cannot guarantee absolute security.

Where Brumo becomes aware of a personal data breach affecting personal data processed by Brumo, it will take reasonable steps to investigate, contain, mitigate, and remediate the incident and will make notifications to affected customers, individuals, governmental authorities, regulatory bodies, the Data Protection Board of India, CERT-In, Meta or Instagram, or other relevant parties where required by applicable law, contractual obligations, or applicable platform requirements.

Where Brumo acts as a processor, it will provide appropriate assistance to the relevant customer in relation to breach investigation, notification, mitigation, and remediation, in accordance with the DPA and applicable law.

Where personal data is transferred, stored, or processed outside India, Brumo will undertake such transfer or processing in accordance with applicable law and any requirements imposed by applicable governmental authorities, contractual arrangements, or other lawful mechanisms.

Brumo may use cookies and similar technologies to operate the website and Services, maintain sessions, remember preferences, understand usage, maintain security, and improve functionality. Further information regarding the use of cookies and similar technologies is provided in Brumo’s Cookie Policy.

The Services may integrate with or depend upon third-party platforms and service providers, including Meta and Instagram and other infrastructure, payment, authentication, communication, analytics, or technology providers.

Where a user interacts with a third-party service, the processing of personal data by that third party may be governed by its own terms and privacy policy. Brumo does not control the privacy practices of independent third parties and users should review the applicable policies of those services.

Subject to applicable law, individuals may have rights in relation to their personal data, including the right to request access to information concerning processing, correction or updating of inaccurate information, deletion of personal data where applicable, withdrawal of consent where processing is based on consent, and the right to raise a grievance regarding the processing of personal data.

An individual may also have the right to nominate another individual who may exercise the individual’s rights in accordance with the DPDP Act and applicable rules, subject to the requirements and procedures prescribed by applicable law.

Requests may be submitted using the contact details provided in Section 23 of this Privacy Policy. Brumo may take reasonable steps to verify the identity and authority of the person making a request before taking action.

Where the relevant personal data is processed by Brumo solely as a processor on behalf of a customer, the request may be referred to the relevant customer, and Brumo will provide reasonable assistance in accordance with its contractual obligations and applicable law.

The Brumo Services are intended for use only by individuals who are at least eighteen (18) years of age. By creating or using a Brumo account, an individual represents and confirms that they are at least eighteen (18) years old.

Brumo does not knowingly offer the Services directly to individuals under eighteen (18) or knowingly collect personal data directly from individuals under eighteen (18) where such collection or processing is prohibited by applicable law.

Brumo recognises, however, that it may receive information relating to individuals who interact with a customer’s Instagram account, including commenters, direct-message senders, and Story interactors, whose age may not be known or reasonably determinable by Brumo. The fact that Brumo receives such information through a customer’s connected Instagram account does not mean that Brumo has independently verified the age of the individual.

Where Brumo becomes aware that personal data relating to an individual under eighteen (18) has been improperly processed in connection with the Services, Brumo will take reasonable steps appropriate to the circumstances and applicable law, including deletion or restriction of the relevant information where required.

Any individual who has a concern, complaint, or grievance regarding Brumo’s processing of personal data may contact Brumo using the privacy or grievance contact details provided in Section 23 of this Privacy Policy. Brumo will acknowledge and address the grievance within the timeline prescribed by applicable law and will communicate the outcome or other appropriate response to the individual.

Where the grievance concerns personal data processed by Brumo as a processor on behalf of a customer, Brumo may forward or refer the grievance to the relevant customer, who is responsible for the relevant processing as the data fiduciary. Brumo will provide reasonable assistance to the customer in addressing such grievance in accordance with the DPA and applicable law.

Where an individual has exhausted the applicable grievance redressal process and remains dissatisfied, or where otherwise permitted or required by applicable law, the individual may approach the Data Protection Board of India in accordance with the procedure and requirements prescribed under the DPDP Act and applicable rules. Information concerning the applicable process, filing requirements, jurisdiction, and procedure should be obtained from the Data Protection Board or the applicable government authority, as these requirements may be updated from time to time.

Brumo may update or modify this Privacy Policy from time to time to reflect changes to the Services, applicable law, regulatory requirements, security practices, or other operational requirements. Where appropriate, Brumo will provide notice of material changes through the website, Services, email, or another reasonable means.

The updated Privacy Policy will become effective on the date stated at the beginning of the revised policy. Users should periodically review this Privacy Policy to remain informed about how Brumo processes personal data.

Questions, requests, notices, or grievances relating to this Privacy Policy or Brumo’s processing of personal data may be submitted to Brumo using the contact details made available through the Brumo website and Services.

Brumo / Averon Labs

Proprietor: Akash Sinha

Address: Karawal Nagar, New Delhi, North East Delhi, Delhi 110094, India

Website: https://brumo.io

Brumo is an independent service and is not affiliated with, sponsored by, endorsed by, or administered by Meta Platforms, Inc., Instagram, or their respective affiliates. Brumo’s integration with Instagram is dependent upon the APIs, permissions, policies, and technical requirements made available by Meta and Instagram from time to time.

Use of Instagram through Brumo remains subject to Instagram’s and Meta’s applicable terms, policies, and requirements. Brumo does not represent that any particular Instagram functionality, API access, permission, or feature will remain available for any particular period.