This policy covers two kinds of data: the account data you give us when you use Instadata, and the publicly available Instagram data the API retrieves on your behalf.
We run no third-party advertising trackers and do not sell personal data. First-touch referrer attribution is stored in your own browser and attached to your account at signup; it holds a referring host, never an identity.
When you call the API we retrieve publicly available data from Instagram and the Meta Ad Library (post statistics, comments, public profile information, captions, media and ad creatives) and return it to you. Some of it relates to identifiable people, such as a public profile's follower count or a public comment. For this data we act on your instructions: you choose what to request and what to do with the result, and you are responsible for your own legal basis to use it.
We store responses for a bounded time to keep the API fast. Storage lifetimes are documented per endpoint and expire automatically; transcripts are kept once made. If you want specific stored content removed, email the URLs (see contact) and we will process the removal promptly. We only access data that is publicly reachable without logging in.
Account data lives as long as the account does. Request logs are kept long enough for billing disputes, debugging and abuse prevention, then deleted or aggregated. Stored content expires on the documented schedule. When you delete your account we delete your personal data within 30 days, except records we must keep for tax and accounting.
Depending on where you live (including under GDPR and CCPA) you may have rights to access, correct, export, delete or restrict the use of your personal data. Email us and we will honour them; you can also complain to your local supervisory authority. For data about you that appears on Instagram, Instagram is the primary controller; if our storage is serving it, we remove it on request as described above.
API traffic is encrypted in transit. API keys are stored hashed; dashboard access requires authentication; production access is limited and logged. No system is perfectly secure. If we learn of a breach affecting your data we notify you without undue delay.
Material changes get a new date above and an email to active customers. Privacy questions and data requests: support@instadata.dev.