Privacy Policy

Which rules apply depends on who you are, so this comes first.

• If you are a business using InstaRep, we decide how your data is handled, and this policy governs it.
• If you contacted a business through a site we host — a quote request or a booking — that business decides what happens to your information. We only store and deliver it on their behalf. To correct or delete it, contact the business directly; if you can’t reach them, email us and we’ll route the request.

• Your business details — name, trade, city and service area, phone number, what you want the site to achieve, optional brand colors or logo, and the address of an existing website if you ask us to import from it.
• Account and billing — your email address and subscription status. Card payments are handled entirely by Stripe; we never see or store your card number.
• Advertising measurement — a first-party cookie (ir_click_id) plus campaign identifiers from the ad you clicked, so we can tell which ads actually work. The funnel also loads the Meta pixel.
• Visitor statistics — we count visits to the sites we host so the owner can see their traffic.
• Enquiries sent to a business — name, phone, email, message, and preferred time, held for that business (see §1).
• Google Calendar data, only if you connect it — see §3.
• Facebook and Instagram ad data, only if you buy Paid Ads and connect your Meta account — see §4.
• Technical data — IP address and request metadata, used to rate-limit abuse and to diagnose errors.

We do not ask for, and ask that you don’t send us, sensitive information such as government IDs or health data.

Booking is optional. If you connect Google Calendar, we ask only for what booking needs, and nothing else in your Google account:

• calendar.readonly — to read your busy times so we only offer slots when you are actually free. We read availability, not the contents of your meetings.
• calendar.events — to add a booking to your calendar when someone books you.
• userinfo.email / openid — to show which Google account is connected.

Concretely: we do not sell Google data, do not use it for advertising, and do not use it to train AI models. No human at InstaRep reads it, except where you explicitly ask us for support, or where security or the law requires it. Access tokens are encrypted before they are stored.

You can disconnect at any time from your booking settings, or revoke access directly at myaccount.google.com/permissions. Disconnecting stops all future access; bookings already on your calendar stay there.

Paid Ads is an optional add-on. To use it, you connect your own Meta business account to InstaRep with Facebook Login for Business (our Meta app is called “IR Analytics Sync”), or share your ad account and Page with InstaRep as a partner in Meta Business Settings. You choose the business, Facebook Page and ad account to share, and we use only those:

• Your business’s name, so your InstaRep Ads page shows which business is connected.
• The Facebook Pages you shared (name and picture), so you can pick the Page your ads run from, and that Page’s three most recent posts (text, photo, date and link), so you can check it’s the right Page.
• Your ad account’s name and pixel, and the campaigns, ad sets and ads we create in it. We create ads only after you approve them, and change your budget only when you ask.
• Ad results from Meta (spend, impressions, clicks and leads), shown on your InstaRep Ads page.

The access token Meta gives us is encrypted before it is stored. To stop our access, remove IR Analytics Sync (or InstaRep’s partner access) in Meta Business Settings, or ask us. To have us delete the Meta data we hold, use the data request form or email privacy@instarep.io; we delete it within 30 days. Ads already in your ad account stay there, under your control.

• To generate, host, and edit your website, and to register a domain for you when you ask.
• To take payment and manage your subscription.
• To deliver enquiries and bookings to you.
• To run and report on your Facebook and Instagram ads, if you use Paid Ads (see §4).
• To measure which ads bring real customers, so we can spend advertising money sensibly.
• To keep the service up, prevent abuse, and fix errors.

We do not sell your personal information, and we do not show third-party ads on the sites we host for you.

AI-written copy can be wrong. Review your site before it goes live; you are responsible for what it says about your business (see the Terms).

We use these providers to run InstaRep, and share only what each one needs:

• Vercel — hosting and content delivery.
• Supabase — the database your site and account live in.
• Stripe — payments and subscriptions.
• Resend — transactional email.
• OpenRouter and its model providers — website generation (see §6).
• Google — Calendar, if you connect it; business reviews via Google Places, if shown on your site.
• Meta — advertising measurement for the InstaRep funnel, and running your ads if you use Paid Ads (see §4).
• Upstash — rate limiting. Sentry — error diagnostics.

We may also disclose information if the law requires it, or to protect InstaRep’s rights and safety. If the business is ever sold, your information may transfer with it; this policy would still apply.

We keep your account and site data for as long as your subscription is active, and for a reasonable period afterwards so you can come back. Billing records are kept as long as tax and accounting law requires. Advertising-measurement data is kept in aggregate. You can ask us to delete your data sooner — see §9.

To get a copy of your data, correct it, delete it, or close your account, use our data request form or email privacy@instarep.io. We act within 30 days. Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA; we honour those requests regardless of where you live. We do not sell personal information.

Data is encrypted in transit, access to it is restricted at the database level per business, and calendar and Meta access tokens are encrypted at rest. No system is perfectly secure, but if a breach affects you we will tell you.

InstaRep is a tool for businesses and is not directed at anyone under 18. We don’t knowingly collect their data.

If you give us your phone number on the intake form, you are agreeing to receive follow-up texts about the website we built for you — a link to see it and help getting it live.

• Opting out — reply STOP to any text at any time to stop further messages, or HELP for help. Message frequency may vary. Message and data rates may apply.
• We never sell or share it — your phone number and your SMS opt-in and consent are not shared with any third party or affiliate for their marketing or promotional purposes. Your mobile opt-in data stays with InstaRep and the carriers that deliver the message.
• Questions about our texts — email help@instarep.io.

If we change this policy materially we’ll update the date above and, for significant changes, tell you by email. Questions, requests, or complaints: privacy@instarep.io.