Last reviewed: 22 October 2026. XreviaTech operates XreviaTech AI Workforce, a locally run application for supervised AI tasks, company records, and opportunity research. This policy describes the current application and a proposed, disabled Instagram integration. It does not mean the proposed integration is active.
The application stores information entered or approved by its operator, including tasks, plans, reports, source evidence, opportunity findings and alerts, schedules, approval decisions, and audit events. These records may contain personal or business information entered by an authorized user. The primary application database is SQLite on the operator's Mac, under the application's data directory outside the signed app bundle. App-managed database backups may also contain these records and are not automatically encrypted by the application's backup feature.
For Instagram Login, the operator's access token is stored in the current macOS user's Keychain, not in source code or the application database. Meta processes account authentication and messages under its own terms and policies. The currently installed application does not receive Instagram messaging webhooks or automatically send Instagram messages.
If the separately approved Instagram webhook integration is enabled, an HTTPS relay on Cloudflare Workers will verify Meta's signed requests. It is designed to discard message text and attachments, retain the receiving professional account ID, sender's Instagram-scoped ID and event time in an encrypted queue payload, and use a hash of the account and message IDs for deduplication. Cloudflare D1 also holds queue bookkeeping such as record ID and creation, expiry, and acknowledgement times outside that encrypted payload. A Mac client would retrieve events over authenticated outbound HTTPS and store the sender ID, receiving account ID, event time, event ID, and an audit record in a separate private local SQLite inbox. The existing primary SQLite schema can also hold a recipient Instagram-scoped ID, last inbound time and message ID, and alert delivery records if separately connected. The sender identity remains unconfirmed until an authorized account-linking step verifies it. The relay does not start AI tasks or send replies.
Information is used to operate the requested local workflows, preserve review and approval history, prevent duplicate processing, diagnose failures, and, if later enabled, receive an authorized Instagram message event. The optional Instagram flow involves Meta and Cloudflare as service providers. Cloudflare may process queued metadata outside the operator's country. Surge hosts the existing policy pages; Cloudflare Pages hosts this policy site. The app's approved public-source discovery may contact event organizers' websites. The app does not sell Instagram message metadata.
The tested relay code assigns queued message-event records a seven-day expiry and includes scheduled cleanup. The production relay is not deployed, and live cleanup has not been verified. The source-only local Instagram inbox does not implement an automatic retention period or self-service deletion. Other application records and backups have no fixed deletion period established here. A deleted current record may persist in an existing backup or a provider-managed recovery copy until that copy is handled under an approved retention process. Before enabling the live integration, XreviaTech must test a specific request and deletion process for local records, Cloudflare queue records, audit history, and backups.
The proposed relay validates Meta's signature on the raw request body, encrypts queued metadata, limits requests, and authenticates Mac retrieval. The local API remains private. macOS Keychain holds Instagram and relay retrieval credentials. No system can guarantee absolute security; access to the Mac, backups, Meta account, Cloudflare account, and hosting account must also be protected by the operator.
You may ask what information relating to you is held, request correction, or request deletion where applicable. We will need enough information to verify the request and locate the relevant records without disclosing someone else's data. Some records may need to be retained for security, audit, backup integrity, or applicable legal obligations. No automatic reply or scheduled Instagram notification is enabled by this policy.
For a request, contact xreviatech@gmail.com. See the data-deletion instructions for the request process. We will update this policy before activating a materially different data flow.