Privacy Policy

Account data: your email, password (hashed with bcrypt), and organization details.

Operational data you provide: Instagram usernames, message sequences, campaign targets, conversations, and resulting activity logs and statistics. For accounts in server-side mode only, also Instagram account credentials (encrypted at rest) and proxy details.

Browser extension data: when you use the extension, it sends us the results of the actions it carries out on Instagram (for example which messages were sent and whether they succeeded), the Instagram conversations it syncs to your inbox, Instagram profiles you choose to collect as leads, and basic technical data (extension version, browser time zone, error reports and an identifier for that installation). The extension only works on instagram.com and instaoutreach.com. It does not read other sites, your browsing history, bookmarks or saved passwords, and it never collects your Instagram password.

Billing data: handled by Stripe. We store your Stripe customer/subscription identifiers and plan status, never your full card number.

Solely to operate the Service for you: running campaigns, showing your dashboard and stats, sending transactional email (verification, password reset, billing), and providing support. We do not sell your data or use it for third-party advertising.

The use of information received from the browser extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to provide the features you use, we do not transfer it to third parties except the processors listed below as needed to run the Service, and we never use it for advertising, to determine creditworthiness, or for lending. No person at instaoutreach reads it except with your permission, for security, or where the law requires.

We rely on a small set of sub-processors: Stripe (payments), Brevo (transactional email), and our hosting provider (Hetzner). Each processes data only to provide its function, under its own privacy terms.

Instagram credentials for server-side accounts are encrypted at rest; the app and the extension communicate over TLS. We retain your data while your account is active and delete your organization's data on account deletion, subject to legal retention requirements (e.g. invoicing records).

You can request access, export, correction, or deletion of your personal data, and object to certain processing, by emailing rk@coldabry.com. Deleting your account removes your organization's operational data.