Last updated September 30, 2026
Privacy Policy
Instabids helps Instagram creators and businesses understand what works on their own account. This policy explains what we collect, why, who processes it on our behalf, how long we keep it and how you can delete it. We do not sell personal data and we do not use it for advertising.
01Who we are
Instabids is operated by Gööster Digital OÜ, a private limited company registered in Estonia (registry code 17084001), Paavli tn 5a/1, 10412 Tallinn, Estonia. Gööster Digital OÜ is the data controller for the personal data described in this policy under the EU General Data Protection Regulation (GDPR).
02What we collect
Account data. Your email address and name if you sign up with email, and a salted hash of your password (never the password itself).
Instagram data, when you connect an account. Through Instagram's official API and only with your permission (
instagram_business_basic,instagram_business_manage_insights) we read: your profile (username, name, profile picture, bio, website, follower/following/media counts); your posts and Stories (captions, media type, permalink, timestamps, like and comment counts); insights for your posts and account (reach, views, saves, shares, profile visits, follows, watch time); and aggregated audience demographics (age range, gender, country, city) as provided by Instagram. We never see your Instagram password.Usage data. Sessions, the goals and settings you choose, content you generate in the product, and a random anonymous visitor ID used to show how many people are online.
Billing data. Handled by our payment provider. We store your plan, subscription status and a customer reference — not your card details.
03How we use it
Only to provide the service you asked for:
- measure your posts against your own account's baseline and find patterns in what performs;
- produce your Growth Audit, daily recommendation, post analyses, profile advice and experiments;
- generate content drafts when you request them;
- run your subscription and enforce plan limits;
- keep the service secure and working (rate limiting, abuse prevention, error diagnosis).
We never post, comment, like, follow or send messages on your behalf.
04Who processes data for us
We use these service providers, each only for the purpose stated:
- Meta (Instagram) — the source of your Instagram data, via the official API.
- Vercel — hosting and running the application.
- Neon — database hosting.
- Replicate — AI model inference. We send post captions, transcripts and computed statistics needed for a request; not your email or tokens.
- Dodo Payments — payment processing and subscriptions, as merchant of record.
05Security
Instagram access tokens are encrypted at rest (AES-256-GCM), used only on our servers and never sent to your browser. Passwords are hashed with scrypt. Sessions use secure, HTTP-only cookies. All traffic is encrypted in transit.
06Retention
We keep your data while your account is active. Disconnecting an Instagram account deletes all data we stored for it immediately. Deleting your Instabids account deletes everything associated with it. Backups held by our database provider expire within their standard retention window.
07Your choices and rights
- Disconnect an Instagram account in Settings — its data is deleted.
- Delete your account in Settings — all your data is deleted.
- Remove Instabids in Instagram (Settings → Apps and websites) — we are notified and delete the access token.
- Request access, correction, deletion or a copy of your data by emailing hello@instabids.lol.
- Lodge a complaint with a supervisory authority, such as the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
See Data deletion for details.
09Children
Instabids is not intended for anyone under 18, and we do not knowingly collect data from them.
10Changes and contact
If this policy changes materially we will update the date above and notify signed-in users. Questions: hello@instabids.lol.