Privacy policy

In short

InstaForge is a platform that runs automated Instagram assistants for businesses. We use personal data only to run those assistants and the platform, we never sell it, and we never use it for advertising. Anyone who writes to an assistant can have everything about them deleted by writing "delete my data".

Who runs InstaForge

Contact
https://instaforge.app

Who we are

InstaForge is run by InstaForge ("we", "us"). Our details are at the top of this page. Questions about privacy can go to https://instaforge.app.

Two different roles

We handle two kinds of personal data, in two different roles:

• People who write to a business's Instagram account that uses one of our assistants. Here the business decides what its assistant does and is responsible for that data (the controller). We process the data on the business's behalf and only on its instructions (the processor).
• People who use the InstaForge dashboard: the business's and our own team members. Here we are responsible for the data (the controller).

Each assistant also has its own privacy page, which describes exactly how that assistant is set up: what it stores, which services it uses and for how long it keeps conversations.

When a business connects its Instagram account

With the business's permission, InstaForge accesses:

• the account's basic profile (its ID and username);
• messages, comments, mentions and story replies sent to the account, so the assistant can answer them;
• permission to publish the posts the business schedules.

The business can disconnect at any time, in InstaForge or in its Instagram settings.

If you write to a business's Instagram assistant

What is stored, depending on how the business set up its assistant:

• your Instagram username and the account ID Instagram gives us;
• the messages, comments and story replies you exchange with the assistant;
• answers you give to its questions, for example a name and phone number for a booking or an order;
• appointments you book, and whether a deposit was paid (card details never reach us: payments happen on Stripe's own page);
• a short summary of facts from your conversation (for example your name or preferences), so the assistant can help you better next time;
• a text version of voice messages and a short description of photos you send (the audio and images themselves are not kept).

Why: to answer your questions, handle your bookings and requests for the business, and pass your request to its team. Where the business turned it on, the assistant asks for your permission before it stores the conversation, and only remembers facts about you once you have agreed.

The assistant tells you at the start that it is an automated assistant using AI. You can ask for a person from the team at any time.

If you use the dashboard

• Account data: your name, email address, role, language, a password hash (never the password itself) and, if you turn it on, the secret for two-step sign-in.
• Security records: sign-in times and failed sign-in attempts, kept to protect accounts.
• What you do in the dashboard that changes a business's assistant is kept in its version history, so changes can be undone.
• Usage analytics, only if an admin turns it on for your account: the screens you open, the changes you save, when you sign in and how many minutes you are active. It never includes what you type or read. You can see in your Settings whether it is on. It is used to understand how the platform is used and to improve it, it is deleted after 180 days, and you can ask an admin or us to turn it off or delete it. Nothing is stored on your device for it.

Why: to give you access, keep accounts secure, provide the service the business signed up for and improve it.

Legal bases

Where the GDPR or a similar law applies, we rely on:

• performing a contract: running the service a business signed up for, and giving its team access;
• legitimate interests: keeping the platform secure, preventing abuse, and understanding how the dashboard is used, in a way that respects the people concerned;
• consent: storing a conversation and remembering facts about someone who writes to an assistant, where the business asks for it (you can withdraw it at any time by writing "delete my data");
• legal obligations: for example keeping records we are required to keep.

For data about people who write to an assistant, the business, as controller, decides which legal basis applies.

Who else receives data

We only share data with services that are needed to run the assistants and the platform, under agreements that limit how they may use it:

• Meta (Instagram), which delivers the messages;
• the AI provider each business chose for its assistant (for example OpenAI, Anthropic, Google or DeepSeek), which receives the messages it has to answer. The assistant's own privacy page names the provider;
• Stripe, if the business takes deposits;
• Google Calendar, Google Sheets, Google Business Profile (to read the business's Google reviews and post its replies), Telegram, YCLIENTS or Altegio, only if the business connected them;
• our hosting, network (Cloudflare) and email delivery providers.

We do not sell personal data, share it for advertising, or use it to train AI models. Under the business terms of OpenAI, Anthropic and Google's paid services, they do not use the data they receive through these services to train their models. DeepSeek's terms are different: see "International transfers" below.

International transfers

Some of these providers are outside your country, often in the United States. Where data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework for companies certified under it, or on the European Commission's standard contractual clauses.

If a business chooses DeepSeek as its AI provider, messages are processed in China, which the EU does not consider to protect data adequately, and DeepSeek may use them to improve its models unless that is switched off. We advise businesses that talk to people in the EU not to choose DeepSeek.

How long data is kept

• Conversations are deleted automatically after the period each business sets (365 days unless it chose otherwise), and a person's whole record after the same period without contact.
• Anyone can write "delete my data" to an assistant to have everything about them deleted immediately.
• Dashboard accounts are kept while they are in use and deleted when an admin removes them.
• Usage analytics are deleted after 180 days.
• Data about a business's customers is deleted when the business stops using InstaForge, unless the law requires us to keep it.

Security

Connections are encrypted. Access keys for Instagram, AI providers and other services are stored encrypted. Each person's data is separated in the database. Team accounts have roles, can be limited to particular businesses, and can use two-step sign-in.

Your rights

Depending on where you live, you can ask to see your data, correct it, delete it, restrict or object to how it is used, or receive it in a portable format. You can also withdraw consent at any time.

If you wrote to a business's assistant, the quickest way is to write "delete my data" to it, or to contact the business. You can also contact us and we will pass your request on and help the business answer it.

If you removed our app from your Instagram account, Instagram may send us a deletion request on your behalf. We then delete the connection and the conversations, and you receive a confirmation code with a page to check its status.

You can complain to a data protection authority, for example the one in the EU country where you live, or Israel's Privacy Protection Authority.

Automated decisions

The assistants answer questions, offer free times and collect details for requests. They do not make decisions that have legal or similarly significant effects on you. Whenever you want, a person from the business can take over the conversation.

Children

InstaForge is not meant for children. Businesses should not use their assistants to target people under 16.

Changes to this policy

If we change this policy, we update the date at the top. If a change is significant, we tell the businesses that use InstaForge before it takes effect.