Brand Privacy Policy

Last updated: July 4, 2026

1. Introduction

Instoly ("we", "our", or "us"), operated by ISTPL, provides the Instoly Brands platform — a creator discovery and partnership tool that helps brands find, evaluate, and connect with Instagram creators. This Privacy Policy explains how we collect, use, and protect information from brands and advertisers using our service.

2. Information We Collect

2.1 Business Account Information

When you register a brand account on Instoly, we collect:

  • Business name and contact email
  • Brand representative name
  • Password (stored in hashed form — we never see your password)
  • Brand logo (if provided)
  • Team member details (name, email, role) if you invite collaborators

2.2 Instagram Business Account Data

When you connect your Instagram Business Account via Facebook Login, we receive:

  • Instagram Business Account ID and username
  • Facebook Page ID linked to your Instagram account
  • Profile picture URL
  • OAuth access token (encrypted and stored securely)

2.3 Creator Data via Creator Marketplace API

To power creator discovery, we access publicly available and API-provided creator information through Meta's Creator Marketplace API, including:

  • Creator profile information (username, bio, profile picture)
  • Follower count and engagement metrics
  • Audience demographics (age ranges, gender distribution, top locations)
  • Content categories and interests
  • Creator partnership eligibility status

This data is accessed on behalf of your connected Instagram Business Account and in accordance with Meta's Platform Terms.

2.4 Usage Data

We collect basic analytics such as search queries, creator profiles viewed, shortlists created, and feature usage to improve the service.

3. How We Use Your Information

  • Creator Discovery: Searching and filtering creators based on your criteria (niche, audience size, demographics)
  • AI-Powered Matching: Using Google Gemini AI to analyze creator-brand compatibility, generate relevance scores, and suggest partnership opportunities
  • Campaign Briefs: Generating AI-assisted campaign briefs and outreach suggestions based on creator profiles
  • Partnership Messaging: Facilitating communication between brands and creators through the platform
  • Analytics: Providing you with insights on creator performance and audience fit
  • Service Improvement: Improving search accuracy, AI recommendations, and platform performance

4. Data Storage and Security

We implement industry-standard security measures including:

  • HTTPS encryption for all data in transit
  • Hashed passwords using bcrypt
  • Encrypted OAuth access tokens stored in MongoDB Atlas with encryption at rest
  • JWT-based authentication with httpOnly cookies
  • Role-based access control for team accounts
  • Cached creator data is stored temporarily and refreshed regularly

5. Third-Party Services

We interact with the following third-party services:

  • Meta / Facebook: We use the Instagram Graph API, Facebook Login, and Creator Marketplace API to authenticate your account and access creator data. Your data is processed in accordance with Meta's Platform Terms.
  • Google Gemini AI: We use Google's Gemini AI to analyze creator profiles, generate compatibility scores, and produce AI-powered recommendations. Creator profile data sent to Gemini is not used to train AI models.
  • MongoDB Atlas: Your data is stored securely on MongoDB Atlas cloud infrastructure with encryption at rest.

We do not sell your personal or business information to third parties.

6. Data Retention

  • Brand account data: Retained for as long as your account is active. You may request deletion at any time.
  • Cached creator data: Creator profiles, audience demographics, and search results are cached for up to 24 hours to improve performance and reduce API calls.
  • AI analysis results: Creator compatibility scores, summaries, and AI-generated insights are stored alongside your shortlists and cleared when the associated data is deleted.
  • OAuth tokens: Deleted immediately when you disconnect your Instagram Business Account.

7. Your Rights

You have the right to:

  • Access the personal and business data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data and account
  • Disconnect your Instagram Business Account at any time
  • Export your data in a portable format
  • Revoke Instoly's access directly from Facebook Settings > Business Integrations

8. Children's Privacy

Our service is designed for businesses and is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on the platform.

10. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at: contact@istpl.in

Instoly is operated by ISTPL.