Legal
Privacy Policy
This policy explains what data Instalow collects, how we use it, who we share it with, how long we keep it, and how you can delete it, including the data we access through Instagram's official APIs on your behalf.
1. Who we are
Instalow (“Instalow”, “we”, “us”) is a multi-tenant SaaS operated by {{LEGAL ENTITY NAME}}, registered at Fulya Mahallesi Yeşilçimen Sokak Polat Tower Bağımsız Bölüm No:12/430, 34394 Şişli/İstanbul. Instalow lets agencies, brands and creators manage multiple Instagram Professional (Business/Creator) accounts from a single dashboard, exclusively through Meta's official Instagram APIs. This policy covers personal data processed through the Instalow web application and API. Instagram's own data practices are governed by Meta's privacy policy.
2. Data we collect
2.1 Account data you give us
- Name, email, password (stored hashed), role/permissions, tenant and workspace membership.
- Subscription and billing details (handled by our payment provider; card data is never stored by us).
- Support requests and the messages you send us.
2.2 Meta/Instagram data we access with your permission
When you connect an Instagram Professional account, we access the following through the Meta Graph API, only within the scopes you grant:
| Permission (scope) | Data accessed | Purpose |
|---|---|---|
instagram_business_basic | Profile info, media list, account ID | Show the connected account, basic management |
instagram_business_content_publish | Publishing endpoints | Scheduled and immediate posting |
instagram_business_manage_messages | Direct messages (DMs), IGSID | Reply to messages and run automation flows |
instagram_business_manage_comments | Comments | Comment moderation (reply/hide/delete) |
instagram_business_manage_insights | Reach/engagement metrics | Analytics and reporting |
We also receive an Instagram access token when you connect an account, which we store encrypted (see Security).
2.3 Technical data collected automatically
IP address, browser/device information, session cookies, usage and log records, and API error identifiers such as fbtrace_id (for support and security).
What we do not collect: Instalow does not access personal (non-Professional) Instagram accounts, does not scrape, and does not use unofficial endpoints or fake engagement. Only Meta's official APIs are used.
3. How we use data
- To provide the service for the accounts you connect: publishing, messaging, moderation, analytics.
- To schedule content, manage quotas/rate limits and run compliance checks.
- For account security, fraud prevention, debugging and support.
- For billing and subscription management.
- To comply with legal obligations.
We do not sell, rent or share Meta Platform data with third parties for advertising. Meta Platform data is used solely to provide the service to you, in line with the Meta Platform Terms and Developer Policies. We do not use Meta data to build or augment user profiles.
4. AI features & message data
Instalow offers optional AI-assisted replies for direct messages. If you enable an AI automation flow, the content of the relevant conversation message is sent to our AI sub-processor, OpenAI, for the sole purpose of generating a suggested or automatic reply on your behalf. This data is not used to train AI models and is processed only to produce the reply. Rule-based automation (welcome messages, keyword replies) does not use third-party AI. You can disable AI automation at any time. Instalow is an independent product and is not affiliated with, or endorsed by, OpenAI.
5. Legal basis (KVKK / GDPR)
- Performance of a contract, to deliver the service.
- Explicit consent, the permissions you grant when connecting an Instagram account.
- Legitimate interests, security, fraud prevention, service improvement.
- Legal obligation, accounting, tax, and lawful requests.
6. Sharing & sub-processors
We share data only with parties strictly necessary to provide the service:
| Sub-processor | Purpose |
|---|---|
| DigitalOcean | Cloud hosting & infrastructure |
| Creem | Payments & subscriptions (Merchant of Record; handles tax/VAT) |
| OpenAI | AI-assisted DM replies (only if you enable AI automation) |
| Resend | Transactional email and notifications |
| Meta Platforms | The Instagram APIs your requests are sent to |
We may also disclose data to legal authorities where a valid legal request applies. Multi-tenant isolation: each tenant's data is logically isolated; one tenant cannot access another tenant's data.
7. Security
- Instagram access tokens and sensitive data are encrypted at rest (application-layer envelope encryption + key management).
- Application secrets (such as the Meta App Secret) are kept in a secret manager, never in source code.
- All transport is encrypted over TLS/HTTPS.
- Access is role-based (RBAC) and follows the principle of least privilege.
- Audit logs are maintained.
8. Retention
- Account and content data is kept while your account is active.
- Disconnecting an Instagram account immediately revokes/deletes the associated tokens.
- Closing your account deletes or anonymizes your data within 30 days (except records we must keep by law, e.g. billing).
- Logs and technical records are kept for up to 90 days.
9. Your rights
Under GDPR and Turkish KVKK you may request access, correction, deletion (“erasure”), restriction, portability, or object to processing. Contact team@instalow.com. We respond within 30 days.
10. Data deletion
You can delete your Instagram/Meta data and your account at any time, in-app (Settings → disconnect account / delete account), via our Data Deletion page, or by emailing team@instalow.com. See the Data Deletion Instructions for details.
11. Cookies
We use strictly necessary cookies for session management, security and core functionality, and optional analytics cookies with your consent. See our Cookie Policy.
12. International transfers
Data may be processed on servers outside your country. Where transfers occur, we apply GDPR Standard Contractual Clauses (SCCs) and KVKK requirements.
13. Children
Instalow is not directed to anyone under 18 and we do not knowingly collect data from them.
14. Changes
We may update this policy; for material changes we notify you by email or in-app. The current version is always published on this page.
15. Contact
{{LEGAL ENTITY NAME}}, Fulya Mahallesi Yeşilçimen Sokak Polat Tower Bağımsız Bölüm No:12/430, 34394 Şişli/İstanbul
Email (support & data protection): team@instalow.com
See also: Terms of Service · Acceptable Use Policy · Data Deletion · Cookies