1Introduction
Inflow is a product operated by Attrio, Inc. (“Attrio,” “we,” “us,” or “our”). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Inflow website and services.
2Information We Collect
We may collect information about you in a variety of ways:
- Personal information you provide to us (name, email address, etc.)
- Information automatically collected when you visit our website
- Information from third-party sources, including connected Instagram accounts
3How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain our services
- Improve, personalize, and expand our services
- Communicate with you about our services
- Send you marketing and promotional communications (with your consent)
- Find and prevent fraud
4Information Sharing and Disclosure
We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:
- With your consent
- To comply with legal obligations
- To protect our rights and safety
- With service providers who assist us in operating our services
5Instagram Integration
What Data We Access
When you connect your Instagram professional (Business or Creator) account through Instagram Login for Business, we access:
- Your Instagram account profile information (username, account ID, profile picture, follower count, account type)
- Your Instagram media (posts, reels, stories), including captions, media URLs, thumbnails, permalinks, and timestamps
- Comments on your Instagram media, including the comment text, commenter username, commenter Instagram-scoped ID, and timestamp
- Direct messages (DMs) sent to your Instagram account, including message content, sender identifiers, and timestamps
- Insights and analytics for your Instagram account and individual posts (reach, impressions, views, saves, shares, and similar metrics)
How We Use This Data
We use your Instagram data solely to provide the Inflow attribution service, specifically to:
- Display your Instagram posts, captions, and performance in the Inflow dashboard
- Detect and attribute direct messages back to the organic posts, reels, or comment-triggered interactions that originated them
- Compute per-post conversion metrics (for example, how many DMs each post generated and the resulting outcomes)
- Help you understand which content drives customer conversations and revenue
Data Storage
- We store Instagram account connection metadata, media references, comment records, and message records in our database to enable attribution and reporting
- We store your Instagram access tokens securely (encrypted at rest) to maintain the connection and receive webhook events
- We do NOT sell, rent, or transfer your Instagram data to third parties, except to service providers who process data on our behalf under confidentiality and data protection obligations
- We do NOT use your Instagram data for advertising or marketing purposes unrelated to the service you explicitly connected
- We do NOT allow human access to your Instagram data except where required for support (with your explicit request), security investigations, or legal compliance
Your Control
You can disconnect your Instagram account at any time by:
- Going to your Inflow dashboard and clicking "Disconnect" next to your connected Instagram account
- Revoking access directly in Instagram at Settings -> Apps and Websites -> Active
When you disconnect, we immediately stop accessing your Instagram data, stop receiving webhook events for that account, and delete your access tokens. Historical attribution data associated with your account is handled according to the Data Retention section below.
Meta Platform Compliance
Our use of data received from the Meta/Instagram APIs adheres to the Meta Platform Terms and Developer Policies. We only use access to your Instagram data for the purposes you authorized when connecting your account. We will NOT:
- Transfer Instagram data to third parties except as necessary to provide the service, comply with law, or protect against fraud and security threats
- Use Instagram data for serving advertisements
- Allow humans to read Instagram data unless we have your explicit consent, the data is necessary to address a support issue you raised, or we are required to do so for legal or security reasons
6Data Security
We implement appropriate technical and organizational security measures to protect your personal information, including encryption of access tokens and transport-layer security for all data in transit. However, no method of transmission over the Internet or electronic storage is 100% secure.
7Data Retention
Instagram Data
- Access Tokens: Stored encrypted until you disconnect your account or delete your Inflow account
- Media, Comments, and Messages: Stored for as long as your Instagram account is connected and your Inflow account is active, to support ongoing attribution and historical reporting
- Insights: Stored as long as needed to provide reporting features
When You Disconnect
When you disconnect your Instagram account:
- Access tokens are immediately deleted
- No new Instagram data is accessed or ingested for that account
- Previously ingested data may be retained for historical reporting unless you request deletion
Account Deletion and Data Deletion Requests
If you delete your Inflow account, or submit a data deletion request (including via the Instagram-initiated data deletion request flow), all associated Instagram data—including access tokens, media records, comment records, message records, and insights—is permanently deleted from our systems within 30 days, except where retention is required to comply with legal obligations.
8Your Rights
You have the right to:
- Access your personal information
- Correct inaccurate information
- Request deletion of your information
- Object to processing of your information
- Request restriction of processing
- Data portability
9Cookies and Tracking Technologies
We use cookies and similar tracking technologies to track activity on our website and hold certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.
10Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites.
11Children’s Privacy
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children.
12Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date.
13Contact Us
If you have any questions about this Privacy Policy, please contact us at:
Email: hey@getattrio.com