Privacy Policy

InstaFlow AI ("InstaFlow", "we", "us", or "our") is operated by CrewHub and provides an Instagram automation platform available at insta.crewhub.in. This Privacy Policy explains how we collect, use, store, and share information when you use our website, applications, and services (collectively, the "Service"). By creating an account or connecting your Instagram account, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

We collect information in the following categories: Account information — When you sign up, we collect your name, email address, password (stored as a secure hash), and workspace preferences. Instagram data — When you connect an Instagram Business or Creator account through Meta's official OAuth flow, we receive and store: • Instagram user ID and username • Profile picture URL and follower count (where permitted by Meta) • Access tokens required to act on your behalf (encrypted at rest) • Posts and media metadata needed to configure automations • Comments and direct messages that trigger your automations • Automation configuration you create (keywords, replies, DM templates) Usage data — We collect logs of automation runs, API requests, error reports, and product analytics to operate and improve the Service. Payment information — If you subscribe to a paid plan, payment processing is handled by Stripe. We do not store full card numbers on our servers. Communications — If you contact us for support, we retain those messages.

We use collected information to: • Provide, maintain, and improve the Service • Execute automations you configure (comment replies, direct messages, lead capture) • Authenticate your account and connected Instagram accounts • Send transactional emails (account verification, security alerts, billing receipts) • Enforce rate limits and prevent abuse • Comply with legal obligations and Meta Platform Terms • Analyze aggregated usage to improve product features We do not sell your personal information to third parties.

InstaFlow uses the Instagram API with Instagram Login. We request only the permissions required for our features: • instagram_business_basic — profile and media access • instagram_business_manage_comments — comment automation • instagram_business_manage_messages — direct message automation We access Instagram data solely to provide features you explicitly configure. We do not use Instagram data for advertising, profiling unrelated to the Service, or any purpose outside what you authorize. You may disconnect your Instagram account at any time from the Accounts page in InstaFlow. Disconnecting revokes our ability to access your Instagram data going forward. Previously stored tokens are deleted when you disconnect. Our use of Meta Platform data complies with the Meta Platform Terms and Developer Policies.

We share information only in these circumstances: Service providers — Trusted third parties that help us operate the Service, including: • Meta / Instagram (API interactions you authorize) • Cloud hosting (Vercel) • Database hosting (Neon) • Redis / queue infrastructure (Upstash) • Email delivery (Resend) • File uploads (Uploadthing) • Payment processing (Stripe) • Error monitoring (Sentry, if enabled) These providers process data only on our instructions and under appropriate agreements. Legal requirements — We may disclose information if required by law, court order, or to protect the rights, safety, and security of InstaFlow, our users, or others. Business transfers — If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction with notice to you.

We retain your account data for as long as your account is active. Instagram access tokens are refreshed periodically and deleted when you disconnect your account or close your workspace. Automation logs are retained to provide history and analytics within your dashboard. You may request deletion of your account and associated data by contacting us. We may retain limited information where required for legal, security, or fraud-prevention purposes.

We implement industry-standard safeguards including: • Encryption of Instagram access tokens at rest (AES-256) • HTTPS for all data in transit • Role-based access controls within workspaces • Rate limiting and audit logging No method of transmission or storage is 100% secure. We encourage you to use a strong password and enable two-factor authentication where available.

Depending on your location, you may have the right to: • Access the personal data we hold about you • Correct inaccurate data • Request deletion of your data • Export your data (including leads and automation logs) • Withdraw consent for Instagram data processing by disconnecting your account • Object to or restrict certain processing To exercise these rights, contact us at privacy@crewhub.in. We will respond within a reasonable timeframe as required by applicable law.

We use essential cookies and session tokens to keep you signed in and secure your account. We do not use third-party advertising cookies. You can control cookies through your browser settings, but disabling essential cookies may prevent you from using the Service.

Your information may be processed in countries other than your own, including the United States and regions where our infrastructure providers operate. We ensure appropriate safeguards are in place for such transfers.

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Material changes may be communicated via email or an in-app notice.

For privacy-related questions or requests: CrewHub / InstaFlow AI Email: privacy@crewhub.in Website: https://insta.crewhub.in