Privacy Policy

1. Information We Collect

We may collect the following categories of information.

Account Information

When you register an account, we may collect:

• Name
• Email address
• Password (encrypted)
• Profile image
• Company name
• Country
• Language preferences
• Account settings

User Content

You may voluntarily provide information including:

• Campaigns
• Email templates
• Outreach messages
• Notes
• Influencer lists
• Saved searches
• Uploaded files
• Custom fields

Platform Usage Data

We automatically collect information including:

• Browser type
• Device information
• Operating system
• IP address
• Pages visited
• Session duration
• Referring URLs
• Feature usage
• Error logs
• Diagnostic information

Cookies

Instme uses cookies and similar technologies for:

• Authentication
• Security
• Preferences
• Analytics
• Performance optimization
• Fraud prevention

2. Google Account Connection

Instme allows users to connect their Google account using Google OAuth 2.0.

This connection is optional.

When you connect your Google account, Instme may request permission to:

• Authenticate your Google account
• Identify your Google profile
• Send emails using your Gmail account

Gmail API Scope

Instme requests:

https://www.googleapis.com/auth/gmail.send

This permission allows Instme to send emails on your behalf.

Instme does not request access to:

• Read Gmail messages
• Delete Gmail messages
• Modify Gmail messages
• Download mailbox contents
• Search mailbox contents

3. Microsoft Account Connection

Instme allows users to connect Microsoft Outlook and Microsoft 365 accounts using Microsoft OAuth.

When connecting a Microsoft account, Instme may request permission to:

• Authenticate your Microsoft account
• Access your basic profile
• Send emails through Microsoft Graph

Typical permissions include:

• Mail.Send
• User.Read
• offline_access

Instme does not request permission to:

• Read mailbox contents
• Delete messages
• Modify mailbox data

4. How We Use Connected Email Accounts

Connected email accounts are used solely to enable users to send outreach emails from their own mailbox.

Examples include:

• Influencer outreach
• Brand collaboration
• Partnership requests
• Campaign communication
• Customer communication
• Scheduled email campaigns

Emails are sent only:

• after explicit authorization by the user;
• according to campaigns configured by the user;
• through the user's own connected email account.

Instme never sends marketing emails from a connected account without user authorization.

5. OAuth Tokens

When you connect Google or Microsoft accounts, Instme receives OAuth access tokens and, where applicable, refresh tokens.

These tokens are used solely to:

• authenticate API requests;
• maintain your connection;
• send emails requested by you.

Tokens are stored securely using industry-standard security practices and are never intentionally exposed publicly.

6. Google User Data

Google user data is used exclusively to provide the requested functionality.

Instme does not:

• sell Google user data;
• share Google user data for advertising;
• build advertising profiles;
• use Google data for AI training;
• use Google user data for unrelated purposes.

Instme's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Microsoft User Data

Microsoft account data is used only for:

• authentication;
• maintaining account connections;
• sending emails requested by users.

Microsoft user data is never sold or shared for advertising purposes.

8. Email Content

Instme processes email content solely for the purpose of delivering emails that users create or schedule.

Instme does not access, monitor, or analyze users' inboxes.

Email content is not used to build marketing profiles.

9. AI Features

Where available, AI-powered features assist users in generating outreach content, campaign suggestions, and workflow improvements.

AI-generated content is created only upon user request.

Instme does not use private connected mailbox data to train public AI models.

10. Data Sharing

We may share information only:

• with infrastructure providers;
• payment processors;
• cloud hosting providers;
• email delivery providers;
• analytics providers;
• legal authorities when required by law.

We never sell personal information.

11. Data Retention

We retain information only as long as necessary to:

• provide our services;
• comply with legal obligations;
• resolve disputes;
• enforce agreements.

Users may request deletion of their accounts.

12. Security

Instme implements reasonable administrative, technical, and organizational safeguards including:

• HTTPS encryption
• encrypted credentials
• access controls
• secure cloud infrastructure
• monitoring
• logging
• authentication controls

No system can guarantee absolute security.

13. International Transfers

Information may be processed in countries where our infrastructure providers operate.

We take reasonable measures to protect transferred information.

14. Your Rights

Depending on your jurisdiction, you may have rights to:

• access your data;
• correct inaccurate information;
• delete your information;
• export your information;
• withdraw consent;
• object to processing;
• restrict processing.

Requests may be submitted through our support channels.

15. Disconnecting Google or Microsoft Accounts

You may disconnect connected accounts at any time.

You may also revoke Instme's access directly through:

Google Account Permissions

• https://myaccount.google.com/permissions

Microsoft Account Permissions

• https://mysignins.microsoft.com/

Revoking access will prevent Instme from sending future emails through that account.

16. Children's Privacy

Instme is not intended for individuals under the age of 18.

We do not knowingly collect personal information from children.

17. Third-Party Services

Instme may integrate with third-party services including:

• Google
• Microsoft
• Stripe
• Resend
• Supabase
• Railway
• Vercel
• Analytics providers
• Payment providers

Each provider maintains its own privacy practices.

18. Compliance

Instme is designed to support compliance with applicable privacy regulations, including, where applicable:

• GDPR
• UK GDPR
• CCPA/CPRA
• Other applicable privacy laws

Users remain responsible for ensuring that their outreach campaigns comply with applicable anti-spam and email marketing laws, including CAN-SPAM, CASL, GDPR, PECR, and other local regulations.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Material changes will be reflected by updating the "Last Updated" date above.

Continued use of Instme after changes become effective constitutes acceptance of the revised Privacy Policy.

20. Contact Us

If you have any questions regarding this Privacy Policy or our privacy practices, please contact us through:

• Website: https://instme.com
• Support: https://instme.com/contact