Instagram privacy policy

Krekib is responsible for the personal information handled by this integration. Contact hello@krekib.com for privacy questions, security concerns, or requests about your data.

These tools are for Krekib’s internal editorial use. This policy covers connecting a professional Instagram account, publishing Krekib editions, and researching product links sent to that account. It applies to the administrator and people whose message events reach the integration. Instagram’s own services are governed by Meta’s policies.

When Instagram is connected, we store its account ID and username, an encrypted access token, token expiry, permissions, publishing preferences, and connection dates. Administrator sign-in and connection-management records can include an email address and account identifiers.

Meta delivers new message events, which can contain sender and recipient IDs, a message ID, text, and attachment information. We check these events and extract supported links only from the designated sender. We do not retrieve historical conversations or save full message bodies or raw message attachments in our research records.

For an accepted link, we store the URL, account/sender/message IDs, dates, identified product and category, processing status, and associated research records. A URL may itself contain personal information. Publishing records include captions, media URLs, publication IDs and dates, and workflow results or errors.

We use connection information to maintain the account connection and publish editions when requested by the administrator or through enabled automatic posting. Instagram authorization is optional and covers basic account information, content publishing, and message access when message research is enabled. These features cannot operate without the relevant permission.

For shared product links, we verify deliveries and sender identity, prevent duplicate work, retrieve public product pages and evidence, and use AI tools to identify and research products. Editorial checks determine whether a product appears in an edition. The administrator can follow the result in Shared products. This workflow does not send automated direct-message replies.

We rely on our legitimate interests in operating and securing internal editorial tools, processing product leads deliberately submitted for research, and maintaining evidence for our recommendations. Handling privacy requests also supports our legal obligations. You can object to processing by contacting us.

Cloudflare hosts the application, database, workflows, media, and AI request routing. Meta provides account authorization, account lookups, message delivery, and publishing. WorkOS handles administrator authentication.

OpenAI helps identify and assess products, write editorial content and captions, and generate or check product images. Exa retrieves research and evidence. SerpAPI supplies product-image search results when needed. Research requests can include submitted URLs, public product-page content, public product images, and product-related queries. The link-identification request does not include stored sender/message IDs or the full Instagram message body. Source websites receive requests when we retrieve their pages and images.

Nonpublic integration records are accessible to Krekib’s administrator and the services needed to operate the tools. Shared products history is private. Researched product information, citations, images, and captions can appear publicly in editions, media URLs, or Instagram posts. Sender and message IDs are not public catalog fields.

These services can process information internationally, including in the United States. Processing locations, retention, and transfer arrangements depend on the service, account configuration, and applicable agreements. The providers publish information about their data protection practices below; contact us for information about a particular request or record.

• Cloudflare privacy policy
• OpenAI API data controls
• Exa privacy policy
• SerpAPI policies
• WorkOS privacy policy

We encrypt stored Instagram access tokens, require administrator authentication, and verify message-delivery signatures. Instagram authorization uses a temporary security cookie that expires after 15 minutes; administrator sign-in uses session cookies.

We keep account credentials while connected. Accepted-link records support research, review of outcomes, and prevention of duplicate processing. They are not automatically erased when processing ends or the account disconnects. Removal is handled manually when records are no longer needed for these purposes or in response to an applicable deletion request. Research evidence and published editorial material are assessed separately.

Operational records and copies held by service providers are handled according to their actual retention settings and applicable deletion actions. Initial link identification disables AI Gateway request/response content logging and AI input/output telemetry. Later research and provider-side operations can retain logs; this is not a service-wide promise of zero retention.

Email hello@krekib.com with the subject Instagram data deletion. Include your Instagram username and enough information to identify the account or shared link concerned. Anyone whose data is processed by this integration can make a request; you do not need a Krekib login. Never send a password, access token, or unrelated messages.

We may ask for limited additional information to verify that the request concerns your data. We review requests manually, locate the relevant records, stop affected pending work where necessary, and remove or redact personal information covered by the request. We also address relevant service-provider copies and public material. If some information must be retained under an applicable exception, we explain what remains and why. We respond within the applicable legal deadlines.

Disconnecting Instagram removes the active connected-account row, encrypted token, and related Instagram post-history rows. It does not erase accepted links, research inputs, separate workflow/log records, public media, or posts already published on Instagram, and it does not revoke permissions within Meta. Work already running is not immediately cancelled. Use this deletion-request process when you want retained information assessed for removal.

Deleting or unsending a message in Instagram does not automatically erase a link already accepted by Krekib.

• Email a data deletion request

Where the GDPR applies, you can request access, correction, erasure, or restriction of processing of your personal information. Rights to object or receive portable data depend on the processing and legal basis. You may complain to the CNIL or another competent data-protection authority. Contact hello@krekib.com to exercise your rights.

We update this policy when the integration’s handling of personal information changes and display the revised date. Material changes will be communicated as required by applicable law.

• Contact the CNIL