Privacy policy
Last updated: 29 October 2026
Reactable helps businesses post to Instagram. To do that we hold information about you, and we handle photos of the people in your business on your behalf. This page explains what we hold, why, where it is, how long we keep it, and what you can do about it. It is written to be read, not skimmed; if anything is unclear, email privacy@reactable.ai.
Who we are, and who is responsible for what
Reactable is run by Reactable AI Limited, a private company limited by shares registered in Ireland (company number 742770), 23 Redleaf House, Townparks, Longford, Co. Longford, N39 KV60, Ireland. Reactable is a trading name of Reactable AI Limited.
For information about you, our customer (your account, your business profile, your subscription, your device, your messages to us and your use of the service) we are the “data controller”. We decide how that information is used, and we are responsible for it.
For the people in your photos (your clients, your staff, anyone else who appears) you are the controller. You decide to take the photo and to post it, and you are responsible for having their permission. We process those photos, your notes about them and your permission answers only on your instructions, as your “processor”. The schedule to our terms is the contract for that work, and there is a section for the people in your photos further down this page.
For questions about your data, email privacy@reactable.ai. For help with the product, email support@reactable.ai.
Who this applies to
- You, our customer. Reactable is for businesses and professionals aged 18 or over, including sole traders and creators.
- People in your photos. See “If you are in a photo a business has posted”.
- Visitors to our website. We don't use cookies, analytics or trackers. Like almost every website, our servers keep a standard log of requests, including your IP address, for 30 days, for security. That's all.
What we collect about you
What's required and what's optional. To open an account we need your email address, a password and your first name; to use Reactable you also need to connect an Instagram business or creator account. Everything else is optional, though posts are better with it. Photos are only needed if you want posts made from them.
Your account. Your email address, a password (stored scrambled, so even we can't read it), your first name and, if you give it, your last name. Your language and timezone, so posts go out at the right time.
Your business. Business name, type, town, services, brand colours, logo, branded hashtag, website address and Instagram username. You type these in. If you give us your website address or Instagram username at sign-up, we read the public pages you point us to, your own site and your own profile, and keep only these business details from them. For the Instagram profile we use a profile lookup service that reads your public profile from the username you give us.
Your photos and what you say about them. Every photo you add, your notes about it (typed, or spoken and turned into text), and your answers about who is in it: no one identifiable, adults in your own photo, someone under 18 with a parent's agreement, or a photo taken by someone else with their permission. We remove location data from photos before we store them.
Your posts and your decisions. The captions and images we create, your edits, approvals, rejections and the reasons you give. We keep a note of your preferences from these, what you like and don't, and use it only for your account.
Your Instagram connection. Your Instagram account ID, username and profile picture, and the access key Instagram gives us to post on your behalf, stored encrypted. Disconnecting Instagram in Settings deletes the key straight away. If your subscription ends we keep the key so you can pick up where you left off, but we stop renewing it, so it expires on its own within 60 days; it is deleted with your account. We record what we published and when.
Your subscription and credits. Which plan you're on, its status and dates, the credits included with it and how you've used them, and the customer and subscription IDs our payment provider gives us. We never see or store your card details; you type them into Paddle's secure form.
Your device. The token that lets us send push notifications, your device type and app version, and basic details of your login sessions. Your IP address appears in our server logs, kept for 30 days.
Your messages to us. If you email support, we keep the conversation for two years after it's closed.
What we don't collect. We don't ask for your phone's location (you may tell us your business's town), your contacts or your calendar. We don't use advertising trackers, analytics tools or session recording, in the app or on the website. We don't track whether you open our emails, and we only email you about the service: receipts, security, changes to our terms and account notices. No marketing, apart from emails about the beta if you've applied to join it.
If you apply to join the beta
The form on our website asks for your name, business name, type of business, Instagram handle, email address and website. We use them to check that you run a working salon or similar business, to decide on your application, and to contact you about the beta, which you agree to when you tick the box. We look at your public Instagram profile as part of that check. Applications are kept until the beta ends or you ask us to delete yours, whichever is sooner; email privacy@reactable.ai to withdraw an application.
Why we use it
Data protection law requires us to say which legal ground we rely on for each use. In plain terms:
- To provide the service you signed up for, including the free trial: creating your posts, publishing them, scheduling, notifications, billing, support and learning your preferences. Where you sign up as a sole trader, this is performing our contract with you. Where you act for a company or someone else's business, it's our and that business's legitimate interest in running the account.
- To keep the service safe and working (our legitimate interest): preventing abuse, securing accounts, keeping logs, fixing faults.
- To keep your account for a while after your subscription ends (our legitimate interest in letting you come back, and in not deleting an account without warning): 30 days if you never paid, 120 days if you did, with an email seven days before deletion.
- To keep a record that you confirmed permission for each photo (our legitimate interest in being able to answer a question about a post, even years later). See “How long we keep it”.
- To meet legal obligations: accounting and tax records, and lawful requests from authorities.
We don't ask for your consent as the legal basis for any of this. Where we rely on legitimate interests you can object, and we'll stop unless we have a compelling reason that outweighs your objection. We don't use your data for advertising, and we don't sell it.
Automatic decisions. If you haven't reviewed your suggested posts for three days, we pause posting until you do, and we stop sending reminders after a month of inactivity. These are safety measures with no legal or similarly significant effect on you, and you lift a pause by reviewing your posts.
How the AI works
Reactable uses Google's Gemini models, through Google Cloud, to describe your photos, write captions, plan your week and edit or create images. We send your photos, your notes and your business details to Google for that processing. Your data is stored in the EU, but Google's Vertex AI service may run the AI processing itself in a Google data centre outside the EU, under Google Cloud's data processing terms and the European Commission's standard contractual clauses.
Google doesn't use your photos or words to train its models, and neither do we. Google may keep a short-lived copy, for up to 24 hours, to answer repeat requests faster; it stays in our project and is used for nothing else. Google may also keep a copy for up to 30 days to check for abuse of its own service; we never see those copies.
Some work happens on Reactable's own servers without any outside AI: working out where a person stands in a photo so that an edit stays away from them, and reading any lettering so it can be kept legible. We never use face recognition or any other way of identifying who someone is.
What editing means. Our edits tidy a photo: background clutter, lighting, framing. We never change a person's face, body or appearance, and we don't create realistic images of people.
Voice notes
When you record a voice note about a photo, your phone turns your speech into text using its built-in speech recognition: Apple's on iPhone, Google's on Android. Depending on your phone and its settings, that happens on the phone or by sending the recording to Apple's or Google's servers under their own privacy policies. The recording never comes to Reactable. We receive only the text, which we keep as your notes about that photo until you delete the photo or your account. The app tells you this before your first voice note, you can type instead of speaking at any time, and you can manage microphone and speech permissions in your phone's settings.
Who we share it with
Two kinds of companies see your data.
Companies that work for us. They can only use your data on our instructions, under a contract with us.
| Who | What they do | What they get |
|---|---|---|
| Google Cloud | Hosts Reactable in Belgium; runs the Gemini AI models, which may process a request outside the EU; delivers push notifications through its Firebase service | Everything we store; photos and text sent for AI processing; your push token |
| Postmark | Sends our emails | Your email address, your first name and the content of each email |
| A profile lookup service | Reads your public Instagram profile at sign-up, if you give us your username | The Instagram username you type |
Services you use through Reactable. They handle the data under their own terms and privacy policies, as independent controllers.
| Who | What they do | What they get |
|---|---|---|
| Meta (Instagram) | Publishes your approved posts to your Instagram account | The posts you approve (image and caption) and your Instagram access key |
| Paddle | Sells Reactable to you as the seller of record, takes payment and issues receipts | Your email, name, country and card details, entered directly into Paddle's form |
| Apple or Google, through your phone | Speech-to-text for voice notes, as described above | The audio of your voice note, if your phone sends it |
If Reactable is ever sold, the buyer would receive your account data; we'd email you before that happened. We'd disclose data if the law required us to. Nobody else gets it: no advertisers, no data brokers.
Where it is kept
Your photos, posts and account data are stored in Google Cloud's data centre in Belgium, inside the EU. The AI processing runs on Google's Vertex AI, which may handle a request in a Google data centre outside the EU. Some of the companies above also work outside the EU: Postmark in the United States; Google's push-notification service and Meta's Instagram service, which can both process data in the United States; and the profile lookup service, outside the EU. Paddle is in the United Kingdom, which the EU recognises as giving equivalent protection. For the others we rely on the EU–US Data Privacy Framework where the company is certified under it, and otherwise on the European Commission's standard contractual clauses. Email privacy@reactable.ai to see them.
How long we keep it
| What | How long |
|---|---|
| Your account and everything in it | Until you delete it. If your subscription ends, we keep it for 30 days (if you only had a free trial) or 120 days (if you ever paid), then delete it. We email you seven days before. |
| Your photos, notes and the posts made from them | Until you delete the photo, or your account is deleted |
| Your permission answers for each photo | While your account exists, even after you delete the photo. After your account is deleted, we keep a minimal record (the date, your answer, the version of the declaration you agreed to, the photo's reference and the Instagram post it became) for six years, without the photo and without anyone's name, in case a post is ever questioned. |
| Posts you start in Generate but don't finish | Cleared after 7 days |
| Records of AI runs we keep for fault-finding, which can include your photos and captions | 30 days |
| Server logs | 30 days |
| Support emails | Two years after the conversation is closed |
| Transaction records we receive from Paddle (what was paid, when, by which account) | Six years, as company law requires |
| Backups | Daily copies kept for 7 days, so deleted data is gone from backups within 14 days |
| Copies of emails we sent you, at our email provider | 45 days |
See Delete your account for exactly what deleting a photo or your account does.
Your rights
You can:
- See what we hold about you. Most of it is in the app; for a full copy, email privacy@reactable.ai.
- Correct it. Your name and business details are editable in Settings; email us for anything else.
- Take your data elsewhere. Download every original photo in your Library, in one go, from the web app, whether or not you're currently subscribed. For your notes, captions, business details and permission answers as a file, email us.
- Delete a photo, or your whole account, at any time, in the app or on the web.
- Object to any use of your data that rests on our legitimate interests, and ask us to restrict it while we look into your objection.
- Complain to the Data Protection Commission, Ireland's regulator, at dataprotection.ie. We'd rather hear from you first.
We answer within a month. For a complex request the law allows up to three months, and we'll tell you if we need longer. We may ask you to confirm it's really you.
If you are in a photo a business has posted
If a salon, barber or other business uses Reactable and you appear in their photos, that business decided to post them and is responsible for having your permission. Here's what happens to your photo: the business's copy is stored privately on our servers in the EU; it is sent to Google's AI service to write the caption and, if the business chooses, to tidy the background, never to change you; and it is published to the business's Instagram account only when the business approves the post. Nothing we hold is public, and we keep the photo only while the business keeps it, plus the short backup and fault-finding periods above.
To have a photo taken down, ask the business, or report the post to Instagram. We can't remove posts from Instagram ourselves. If you contact us directly at privacy@reactable.ai, we'll pass your request to the business, pause any post with your photo that hasn't gone out yet, and remove the photo from our systems if we have good reason to think it shouldn't be there. If the business has already deleted its account, we hold nothing of yours except a short record that the business confirmed it had permission, which contains no image and no name. You can complain to the Data Protection Commission about the business or about us.
Children
Reactable is for people aged 18 or over, and we don't knowingly hold an account for anyone younger. If you think we do, email privacy@reactable.ai and we'll delete it. Before adding a photo of anyone under 18, the business must confirm that a parent or guardian has agreed; we ask, we don't verify, and the responsibility is the business's.
Customers in the United Kingdom
If you're in the UK, the UK GDPR applies to you in the same way as described on this page. You can complain to the Information Commissioner's Office at ico.org.uk.
Security
Everything travels encrypted between your device and our servers, and everything is stored encrypted. Passwords are stored hashed and Instagram access keys encrypted. Our storage is private: your photos are reachable only through time-limited links the app creates, which last 90 minutes; anyone holding a link can view the photo while it lasts, and the pages can't be found by search engines. Access inside Reactable is limited to the people who need it to support you. No system is perfectly secure; if you believe your account has been compromised, change your password in Settings and email support@reactable.ai.
Cookies and browser storage
Our website and web app don't use advertising, analytics or tracking cookies. When you sign in to the web app it keeps your login in your browser's storage, which is strictly necessary to keep you signed in, and your light-or-dark preference if you set one; signing out clears the login. Paddle's payment form, which appears only on the payment step, may set its own cookies under Paddle's privacy policy.
Changes
If we change this page in a way that matters, we'll email you before it takes effect. Smaller edits are noted by the date at the top. Older versions are available from privacy@reactable.ai.