Privacy Policy
Last updated: 28 October 2026
Riplo Panel (panel.riplo.co, "the Panel") lets a business manage its Instagram and WhatsApp presence from one place: publish videos to Instagram, and send and receive WhatsApp messages. It is run by the Riplo team (the same team that runs riplo.co and app.riplo.co). This policy explains what we process, why, and how you can have it deleted.
The short version
- We connect to Instagram and WhatsApp only through Meta's official login and APIs. We never see or store your Instagram or Facebook password.
- We use the data Meta gives us only to run the features you switch on for your own accounts. We do not sell it, share it for advertising, or use it to train AI models.
- Access tokens are stored encrypted. Disconnecting an account deletes its token immediately.
- You can delete everything yourself inside the Panel, through Meta's data deletion callback, or by emailing us. See Data deletion.
Who is responsible
Two groups of people have data in the Panel, and our role differs for each:
- Account holders are the people who use the Panel. For their login, connected accounts and usage, we decide how the data is used.
- Contacts are people who message a connected WhatsApp number. For their messages, the account holder decides what happens, because the account holder runs the number. We process those messages on the account holder's behalf and only to show them in the Panel.
What we process
| Category | What it includes | Where it comes from |
|---|---|---|
| Panel account | Email address and a salted hash of the password (never the password itself). | You (accounts are created by Riplo for invited users). |
| Instagram connection | Instagram account ID, username, display name, profile picture link, account type, the permissions you granted, the token's expiry date, and the access token (encrypted). | Meta, after you log in with Instagram. |
| Videos you publish | The video file you upload, the caption you write, the post's status and its public link. The file is kept only until Instagram has fetched it and the post is published or has failed, and is deleted at that point (at the latest after 24 hours). | You. |
| Instagram profile and recent posts | Shown live in the Panel (profile details, your recent posts, your daily publishing quota). Not stored by us. | Meta. |
| WhatsApp connection | WhatsApp Business Account ID, Phone number ID, the displayed phone number and verified name, and the access token (encrypted). | You and Meta. |
| WhatsApp messages | For each message sent or received on the connected number: the other party's phone number and profile name, the text, the type, the time and the delivery status. | You (sent) and Meta's webhook (received, delivery status). |
| MCP waitlist | A single flag saying you asked to be told when MCP access launches. | You. |
| Technical logs | Standard server logs (time, path, status). Logs do not contain tokens, passwords or message text. | Your browser. |
Meta permissions we use and why
| Permission | What the Panel does with it |
|---|---|
instagram_business_basic | Reads your professional account's name, username, picture, follower and media counts, and your recent posts, to show which account is connected and what was published. |
instagram_business_content_publish | Publishes the video that you upload and choose to post (as a Reel or a Story) to your account, and reads your daily publishing limit. Nothing is ever posted without you pressing Publish. |
whatsapp_business_messaging | Sends the messages you write (and approved templates you choose) from your WhatsApp Business number, and receives replies and delivery statuses through Meta's webhook so you can read them in the Panel inbox. |
whatsapp_business_management | Lists the phone numbers on your WhatsApp Business Account and lets you list, create and delete your own message templates. |
We request only these permissions, and only use each for the purpose above.
How we use it
- To provide the features you use: publishing, messaging, showing your accounts and message history.
- To keep the service secure and working: preventing abuse, fixing errors, renewing Instagram tokens before they expire.
- To answer your requests, including deletion requests.
We do not sell personal data, use it for advertising or profiling, or use it to train machine-learning models. We do not use Instagram or WhatsApp data for any purpose other than showing it to the account holder who connected it.
Who we share it with
- Meta Platforms receives what you ask us to send: the videos you publish and the WhatsApp messages you send.
- Infrastructure providers that host the Panel and route traffic to it (a server host and Cloudflare, which proxies requests). They process data only to deliver the service.
- Authorities only where the law requires it.
Security
Connections use HTTPS. Access tokens are encrypted at rest with a key that is not stored in the database. Passwords are hashed with scrypt. Sessions use HttpOnly cookies and every change requires an anti-forgery token. Meta webhooks are accepted only with a valid signature.
How long we keep it
- Instagram and WhatsApp tokens: until you disconnect, delete your account, or Meta revokes access.
- Uploaded videos: removed as soon as the post is published or fails, and in any case within 24 hours.
- WhatsApp messages and post history: until you delete your account or ask us to delete them.
- Deletion requests are recorded (a confirmation code and the date) so you can check their status.
Your rights
You can ask to see, correct or delete your data, and to stop any processing, at any time. The quickest way is the Delete my account and data button in the Panel. You can also email [email protected]. If you are a contact whose WhatsApp messages sit in someone's Panel, ask the business you wrote to, or email us and we will pass your request on or act on it.
Cookies
We use one strictly necessary cookie to keep you signed in. We use no advertising or analytics cookies.
Children
The Panel is for businesses and is not directed at anyone under 18.
MCP access (planned)
We plan to let account holders connect AI assistants to their own Panel through the Model Context Protocol (MCP). This is not available yet and nothing about it is switched on. Before it launches it will be opt-in per account holder, limited to the access the account holder grants, revocable at any time, and this policy will be updated first.
Changes
If we change this policy in a way that matters, we will update the date above and tell account holders in the Panel.
Contact
Email [email protected]. Website: riplo.co.