Privacy Policy

1. Introduction

Instoly ("we", "our", or "us") operates the Instoly platform (instoly.com), a creator engagement platform that helps you grow and connect with your Instagram community. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

2. Information We Collect

2.1 Account Information

When you create a Instoly account, we collect:

• Email address
• Mobile number (required to verify your account and sign in)
• Display name
• Password (stored in hashed form — we cannot see your password)
• Country and currency preferences

If you sign in with Apple or Google, we receive the following from them:

• Sign in with Apple (iPhone app): your Apple user ID, your email address, and your name if you share it the first time you sign in. If you choose Hide My Email, the address is Apple's private relay address, and we store it as given. We also keep a token from Apple, stored encrypted, so we can revoke Instoly's access to your Apple ID when you delete your account.
• Sign in with Google (website and app): your Google user ID, email address, name and profile picture.

We never receive your Apple or Google password.

2.2 Instagram Account Data

When you connect your Instagram account, we receive:

• Instagram username and user ID
• Profile picture URL
• Follower count
• Account type (Business or Creator)
• OAuth access token (used to send messages on your behalf)

2.3 Mobile Number and Verification Data

To verify your mobile number and secure your account, we collect:

• Your mobile number in international format
• Verification status and the date your number was verified
• One-time passcodes we generate to verify your number and your sign-ins. These are stored only in hashed form and expire within minutes
• Delivery status of the verification messages we send you (for example delivered or failed), so we can retry or offer another channel
• Details of devices you choose to trust, so you are not asked for a passcode on every sign-in

We use your mobile number for account verification, sign-in, and essential service notices only. We do not use it for marketing without your consent, and we do not sell it. The one advertising use is the hashed copy described in section 4.1, which measures our own ads.

2.4 Comment and Message Data

To provide our DM engagement service, we process:

• Comments on your Instagram posts (text and commenter's ID)
• Messages sent on your behalf
• Trigger keywords you configure in your flows

2.5 Billing Data

• Which plan or credit pack you bought, when, and for how much
• A payment reference and the payment method type (card, UPI, netbanking)
• Your subscription status and renewal date
• Invoices and receipts we generate for you

We do not collect or store card numbers, CVVs, UPI PINs or bank credentials. Those are entered on Razorpay's checkout and never reach us.

2.6 Usage Data

We collect basic analytics such as page views, feature usage, and error logs to improve the service. On our website and dashboard this includes the analytics and advertising tags described in section 4.1, and in the Instoly app, the analytics tools described in section 4.2.

2.7 Your Store

If you use Instoly Store, we store what you add to it: posts, product links and their details, pictures you upload, categories, and your store's look and settings. When you use "Fill in from link", we fetch the public page at the link you paste to read the product's name, price and picture.

2.8 People Who Visit a Store

We count visits to a store and its posts as daily totals, including where each visit came from, such as Instagram or Google. To count each visitor once a day, we keep a one-way code made from their IP address and browser for two days, then delete it. We do not store the IP address itself, and set no cookie. When a visitor taps a product link, we record the tap as we do for links in DMs: a hashed IP address, browser and device type, the referring page, approximate country and city, and the time. The creator sees only totals: views, visitors, where visits came from, and taps per store, post and product. We do not run advertising or analytics tags on store pages.

3. How We Use Your Information

• Core Service: Matching comments to trigger keywords and sending DM replies
• Account Management: Authentication, profile management, and billing
• Account Security: Verifying your mobile number and confirming sign-ins with a one-time passcode
• Analytics: Providing you with flow performance statistics (DMs sent, clicks, conversions)
• Store analytics: Showing creators how their store performs (views and taps)
• Service Improvement: Debugging issues, improving performance, and developing new features
• Communication: Sending you important service updates and notifications

4. Third-Party Services

We interact with the following third-party services:

• Meta/Instagram: We use the Instagram Graph API and Messenger Platform to send DMs and read comments. Your Instagram data is processed in accordance with Meta's Platform Terms.
• WhatsApp (Meta): We use the WhatsApp Business Platform to deliver one-time passcodes to the mobile number you provide. Your number is shared with Meta solely to deliver these messages, and is handled in accordance with WhatsApp's Privacy Policy. We may add SMS as an alternative delivery channel in future.
• Razorpay: Payments are processed by Razorpay, an RBI-authorised payment aggregator. Card numbers, UPI identifiers and bank credentials are entered on Razorpay's own checkout and never reach our servers. We receive and store only a payment reference, the amount, the payment method type, and what was bought — enough to show you a receipt and to honour our Refund & Cancellation Policy. Your name, email and phone number are shared with Razorpay to process the payment, and are handled under Razorpay's Privacy Policy.
• Google Gemini: When you use an AI feature, the text or image you submit is sent to Google's Gemini API to generate the result. We do not send your Instagram credentials, your follower data or your DM history unless it is part of what you explicitly asked the feature to work on.
• Amazon Web Services: Images and files you upload — product photos, invoice attachments, AI outputs — are stored on Amazon S3 and served through CloudFront.
• MongoDB Atlas: Your data is stored securely on MongoDB Atlas cloud infrastructure with encryption at rest.

We do not sell your personal information to third parties.

4.1 Analytics and Advertising Tags

Our website and creator dashboard load tags from four companies. They set cookies or similar identifiers in your browser and record the pages you visit and actions such as signing up, connecting Instagram, starting a checkout and completing a payment.

• Google Analytics (Google): How people find and use Instoly. It is linked to our Google Ads account, which uses it to measure our ads.
• Meta Pixel (Meta): Measures which of our ads on Facebook and Instagram brought you to us. When you sign up, connect Instagram or pay, our server also sends Meta a hashed copy of your email address and mobile number, with your IP address and browser type, so Meta can match the visit to the ad. A hash is a one-way code: Meta can compare it with what it already holds, but cannot turn it back into your email or number.
• Microsoft Clarity (Microsoft): Records how pages are used, including clicks, scrolling and session replays, so we can fix pages that confuse people.
• OpenAI Ads (OpenAI): Measures which of our ads in ChatGPT brought you to us. We send it the name of the action only, never your name, email or number.

We do not load these tags on creator stores, product links, invoices, the admin panel or the brand portal. On sign-in verification links only Google Analytics loads, and the code in the link is removed before anything is sent.

You can block or clear these cookies in your browser settings; Instoly works without them. To ask us to stop using your data for ad measurement, write to contact@instoly.com.

4.2 Analytics in the Instoly App

The Instoly app for iPhone and Android uses two analytics tools.

• Google Analytics for Firebase (Google): How people use the app, reported into the same Google Analytics as our website. It records the screens you open, by screen name only, never a link with your details in it, and actions such as signing up or signing in (and whether you used email, Google or Apple), verifying your number, connecting Instagram, using an AI feature, publishing a post, creating an Auto DM, starting a checkout and completing a purchase (the plan or pack, its price and currency). It uses a random ID for each install, your Instoly user ID once you sign in, and a device ID limited to our apps (the vendor ID on iPhone, the Android ID on Android). It also receives your device model, system and app version and language, and Google works out an approximate location (country or city) from your IP address.
• Microsoft Clarity (Microsoft): Records how app screens are used, including taps, swipes, scrolling, screen names, the names of the actions above and session replays, so we can fix screens that confuse people. All on-screen text is masked in replays. It receives your Instoly user ID, device model, and system and app version, and Microsoft works out an approximate location from your IP address.

Neither tool reads your device's advertising ID, and neither is used for advertising, shared with ad networks, or used to track you across other companies' apps and websites. We do not sell this data.

The app does not include Meta's tools. If we add them, we will update this section first.

5. Team Seats and Shared Access

An account owner can create team seats — additional logins that operate inside their account. If you are using Instoly through a seat someone created for you, you should understand what that means:

• The account owner can see the work done from your seat, because it belongs to their account rather than to you.
• The owner can see your name, the email address the seat was created with, and when you last signed in.
• The owner can remove your seat at any time, which ends your access immediately.
• You cannot see the owner's billing details, payment methods or invoices, and they cannot see any password you set.

A seat is not a separate account. If you want an account of your own, sign up with your own email address.

6. Data Retention

We retain your data for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us. When you disconnect your Instagram account, we immediately delete your access token and Instagram-specific data.

7. Data Security

We implement industry-standard security measures including:

• HTTPS encryption for all data in transit
• Hashed passwords using bcrypt
• One-time passcodes stored hashed, with short expiry and limited attempts
• JWT-based authentication with httpOnly cookies
• MongoDB Atlas encryption at rest
• Access token isolation per user

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Disconnect your Instagram account at any time
• Update your mobile number or revoke trusted devices at any time
• Export your data in a portable format

9. Instagram Data Deletion

If you remove Instoly from your Facebook/Instagram connected apps, we will receive a data deletion request from Meta. We will delete all your Instagram-related data (tokens, username, profile info, comment history) within 48 hours.

10. Children's Privacy

Our service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on our website.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at: contact@instoly.com