Privacy Policy

1. Overview

Instalen ("we", "us", or "our") is an Instagram analytics platform that helps creators understand their post performance. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding that data.

Data controller: Instalen / ZapMedia CC (mayank@zapmedia.cc).

2. Data We Collect

When you connect your Instagram Business or Creator Account, we collect:

• Your Instagram username and profile picture URL
• Follower count, following count, and media count
• Post metrics: likes, comments, reach, impressions, saves, and shares
• Post captions, hashtags, timestamps, and media type
• An Instagram User Access Token (encrypted at rest) to query the Meta Graph API on your behalf

We do not collect your Instagram password, direct messages, payment information, or any data from private accounts you follow.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your data under the following legal bases:

• Consent — You explicitly connect your Instagram account and agree to this policy before any data is collected.
• Contract performance — Processing is necessary to provide the analytics service you signed up for.
• Legitimate interests — We maintain service logs and error tracking to keep Instalen secure and functional.

You may withdraw consent at any time by disconnecting your account in Settings.

4. How We Use Your Data

• To display analytics dashboards and engagement insights within Instalen
• To generate AI-powered caption, hook, and reel suggestions based on your post history
• To identify posting patterns, optimal publishing times, and viral content signals
• To refresh your Instagram access token before it expires (token maintenance)

We never sell your data to third parties, use it for advertising, or share it with other users.

5. Cookies and Session Data

Instalen uses a single session cookie (instalens_session) to keep you logged in. This cookie is:

• HttpOnly — not accessible by JavaScript
• Secure — only sent over HTTPS
• SameSite=Lax — protected against cross-site request forgery
• Valid for 30 days, then automatically expires

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. No cookie consent banner is required for strictly necessary session cookies under the ePrivacy Directive.

6. Third-Party Services

Instalen shares data with the following processors only to the extent necessary to provide the service:

• Meta (Facebook/Instagram) Graph API— Your access token is used to fetch post metrics directly from Meta's servers. Governed by Meta's Privacy Policy.
• OpenAI — Post captions (not your username or account identifiers) are sent to OpenAI to generate AI suggestions. Governed by OpenAI's Privacy Policy.
• Neon (database hosting)— Your analytics data is stored on Neon's PostgreSQL infrastructure hosted in the United States.
• Stripe — Billing and subscription management. Stripe processes payment card data on your behalf; we never see or store card numbers. Governed by Stripe's Privacy Policy.

7. International Data Transfers

Instalen's servers and third-party processors (Neon, OpenAI, Stripe) are located in the United States. If you are located in the EEA, UK, or Switzerland, your data is transferred to the US under appropriate safeguards including the EU-US Data Privacy Framework and Standard Contractual Clauses where applicable.

8. Data Retention

We retain your Instagram data for as long as your account is active. If you disconnect your account or request deletion, all personal data is permanently erased within 30 days. Subscription billing records may be retained for up to 7 years as required by financial regulations.

9. Your Rights

Depending on your location, you have the following rights:

• Access — Request a copy of the personal data we hold about you.
• Erasure ("right to be forgotten") — Request deletion of all your data. You can do this instantly in Settings → Disconnect & Log Out, or by emailing us.
• Rectification — Request correction of inaccurate data.
• Portability — Request your data in a machine-readable format.
• Restriction — Request that we limit how we process your data.
• Objection — Object to processing based on legitimate interests.
• Withdraw consent — Disconnect your Instagram account at any time to stop all data processing.

To exercise any right, email mayank@zapmedia.cc. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your EEA Member State's DPA).

10. Children's Privacy

Instalen is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If we learn that we have collected data from a child under 13 without verifiable parental consent, we will delete it immediately. If you believe a minor has connected an account, please contact us at mayank@zapmedia.cc.

11. Meta Data Deletion

In accordance with Meta Platform Terms, users may request deletion of data Instalen collected via Instagram by revoking app access in their Instagram App Settings. Meta will notify us automatically and all associated data will be deleted. You can also delete your data directly from the Instalen Settings page.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on the dashboard. Continued use after changes constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions or data requests, contact us at mayank@zapmedia.cc.