Last updated 21 July 2026
Braid provides an operations platform used by hospitality venues. This policy explains what personal information we handle and why. For most data, the venue is responsible for how it is used and Braid processes it on the venue's behalf.
When a venue connects its Instagram professional account to Braid, we process direct messages exchanged between that venue and the people who message it, so the venue's staff can read and respond from within Braid.
What we collect.For each connected account and conversation we receive from Meta and store: message content (text, and attachments such as images, shared posts, story mentions, or voice notes), message reactions, delivery and read status, timestamps, and limited sender information (the sender's Instagram username, Instagram-scoped user ID, and profile picture). We also store the connected account's own metadata and the access tokens needed to send and receive messages on the venue's behalf.
Why we collect it.Solely to provide the messaging inbox: to display incoming messages to authorised venue staff, to let staff reply, to draft suggested replies and categorise message topics using automated processing, and, where the venue has linked a sender to a customer record, to show that customer's history alongside the conversation.
How we collect it.Through Meta's official Instagram messaging API, under the permissions the venue grants when it connects its account. We only receive messages after a person has messaged the venue's account, and we do not send unsolicited or marketing messages through this channel.
Automated processing. Message content may be processed by a third-party AI service to draft suggested replies for staff and to tag the topic and sentiment of a conversation. Suggested replies are never sent automatically; a staff member reviews and sends every message.
Who can access it. Authorised staff of the connecting venue, according to the venue's own permission settings. We do not sell message data or use it for advertising.
Retention and deletion.If a person deletes (unsends) a message on Instagram, we delete our stored copy. Media such as images and voice notes is retained for up to 90 days after a conversation's most recent message. Message text is retained for up to 24 months after a conversation's last activity and is then de-identified. When a venue disconnects its Instagram account or closes its Braid account, the associated messaging data is deleted or de-identified within 30 days. You can request deletion of your data at any time, and we will action it within 30 days.
Your rights.If you have messaged a venue that uses Braid and want to access or delete the information we hold about you, contact us or contact the venue directly. You can also remove Braid's access at any time from your Instagram settings.
Braid's use of information received from Meta's APIs complies with Meta's Platform Terms and Developer Policies.
To provide the service we share data with our infrastructure and service providers (cloud hosting and database, file storage, our AI provider, and transactional email), some of which process data outside Australia. We take reasonable steps to ensure these providers handle the data consistently with this policy and applicable law, including the Australian Privacy Principles.
To exercise any of these rights or ask a question about this policy, contact Braid at the address published on our website.