Karm
العربية

Last updated: 5 October 2026

Privacy Policy

This policy explains how the Karm platform ("Karm", "we", "us") collects, uses and protects data when you use our website karm.om, our promotional campaigns, and our Instagram-connected application.

Data we collect

  • Contact details you give us directly, such as your name, phone number and email address when you fill in a form or enter a draw.
  • Approximate location when you take part in a location-based campaign, used only to verify eligibility.
  • Instagram data: when someone interacts with a client's Instagram account (a comment or message), we receive from Meta the comment or message ID and text, the sender ID and public username, via the Instagram API.
  • Technical data such as IP address, browser type and pages visited, for security and analytics.
  • When you open a tracked KARM link from an Instagram funnel, we use first-party cookies with random anonymous tokens to count unique browser visitors and connect the latest click to a website action for seven days. The visitor token expires after 90 days; neither token contains your name or Instagram ID.

How we use data

  • To run campaigns and draws and contact participants about their entries.
  • To automatically reply to Instagram comments and messages that contain a campaign keyword, with a private message that includes the entry link.
  • To manage comments and messages on client Instagram accounts and help their teams respond.
  • To improve our services and measure campaign performance in aggregate.
  • To measure funnel stages and suggest changes based on past results for an operator to review.

Meta and Instagram data

  • We access Instagram data only after the business account owner authorises our app through Instagram Business Login; they can revoke this at any time from their Instagram settings.
  • We use Meta data in accordance with the Meta Platform Terms and Developer Policies; we do not sell it or use it for targeted advertising.
  • Access tokens are stored securely on our servers and are never shared with third parties.
  • When a comment or message contains a campaign keyword, we keep its text and the sender's username for up to 90 days to provide the client with campaign reports, after which the text is deleted automatically. Other comments and messages are not stored.
  • You can request deletion of Instagram data related to you by emailing us at the address below; we will delete it within 30 days. See karm.om/DataDeletion/ for details.

Sharing data

  • We do not sell your personal data. We share it only with the client whose campaign you take part in, with service providers acting on our behalf (such as hosting), and where required by law.

Retention and security

  • We keep data only for as long as needed for the purpose it was collected for, or as required by law, after which it is deleted or anonymised.
  • We apply appropriate technical and organisational measures to protect data from unauthorised access, including encryption in transit.

Your rights

  • You may request access to, correction or deletion of your data, or object to its processing. Email info@karm.om and we will respond within 30 days.

Changes to this policy

  • We may update this policy from time to time. Any changes will be posted on this page with the updated date.

For privacy enquiries: info@karm.om