Privacy policy

Effective 10 November 2026. Instantlify, [Registered business address].

Instantlify is a platform businesses use to manage customer conversations on Instagram, Facebook Messenger, WhatsApp, Telegram and their own website, to automate replies (including with AI), and to keep a contact list, forms, link-in-bio pages and related tools. This policy explains what personal information we handle, why, who we share it with and the choices you have.

1. Our role

• For account holders (people who sign up and use Instantlify for a business), we decide how account data is used: we are the controller of that data.
• For a business’s customers (people who message a business, fill in its form, sign up on its link-in-bio page or use its website chat), the business decides what it collects and why. The business is the controller and Instantlify processes that data on its behalf and on its instructions. If you are one of those customers, please contact the business directly about your data; we will help it respond.

2. Information we collect

Account and team information

• Name, email address and password (stored only as a secure hash).
• If you sign in with Google: your name and verified email address from Google. We do not receive your Google password.
• Optional profile photo, your workspaces, team roles and access settings.
• A log of significant actions in a workspace (for example who changed settings, connected an account or deleted data), used for security and accountability.

Connected accounts and integrations

• When you connect Instagram, Facebook Messenger, WhatsApp or Telegram: the account or page ID, display name and profile details the platform provides, and the access token it grants. Tokens are encrypted.
• When you connect other tools (for example Google Calendar or Sheets, Gmail, Outlook, Slack, Stripe, Mailchimp, Klaviyo, CRMs such as GoHighLevel, Attio, Airtable or Notion, voice or video providers): the credentials or tokens you provide, encrypted, and the settings you choose.

Content a business keeps in Instantlify

• Contacts: names, social handles, profile photos, email addresses, phone numbers, tags, pipeline stage, custom fields, notes and AI-written contact summaries.
• Conversations: messages, comments, story replies, attachments, voice notes and their transcripts, and delivery status.
• Automations, AI agent settings and the knowledge you add (documents, text and imported web pages).
• Forms and their responses (including uploaded files and signatures), link-in-bio pages and signups, website chat settings, scheduled posts, tracking links and click counts.

Information from a business’s customers

• Messages they send and the profile name, handle and photo the platform shares with the business.
• Details they choose to give, such as an email address in a form or a signup, and their consent where a form asks for it.
• For website chat: a random visitor ID stored in their browser so the conversation continues on their next visit.

Payments

• Subscriptions and AI credits are paid through Stripe. Stripe collects and stores card details; we receive the plan, subscription status, invoices and a record of AI credit purchases and usage.
• Payments a business takes from its own customers in chat go through that business’s own Stripe account.

Technical and usage information

• IP address and browser information, used to keep accounts secure, prevent abuse and limit request rates.
• On our public website: the pages visited, the referring page and campaign source, linked by a first-party session identifier (see Cookies). We do not use advertising trackers.
• Error reports when something breaks, so we can fix it.

Support, community and referrals

• Support conversations and tickets, and posts you make in the community forum.
• If you join the affiliate program: your referral links and referral statistics, managed with our affiliate provider.

3. How we use information

• To provide the service: deliver and receive messages, show conversations, run the automations and AI replies a business sets up, sync contacts to the tools it connects, host its forms and pages, and process payments.
• To secure the service, prevent fraud and abuse, and enforce our terms.
• To provide support and tell you about changes to the service or your account.
• To understand how the service is used and improve it.
• To meet legal, tax and accounting obligations.

We do not sell personal information and we do not use a business’s customer messages for advertising.

4. AI features

AI features run only when a business turns them on. When they do, the text needed for the task (for example the recent conversation, the relevant knowledge and the business’s instructions) is sent to the AI provider the business selects, such as OpenAI, Anthropic, Google or xAI, to generate a reply, classify a message, summarize a contact or check a comment. Voice notes may be transcribed and voice replies generated with providers such as OpenAI, ElevenLabs, Inworld or MiniMax; avatar videos and phone calls use providers such as HeyGen, Vapi or Retell when a business configures them. Knowledge documents are converted into embeddings to find relevant passages. We do not use a business’s content to train our own models. AI providers process data under their own terms.

5. Meta platform data

Through Instagram and Facebook we access only what a business authorizes: its connected professional account or page, the messages and comments people send to it, and the profile details Meta provides about those people. We use this solely to show conversations to the business, reply on its behalf and run the automations it sets up. We do not sell this data or use it for advertising. When someone removes Instantlify from their Instagram or Facebook settings, we disconnect the account and delete its access tokens; see data deletion.

6. Who we share information with

We share personal information only as needed to run the service:

• Hosting, database and email delivery providers that run the service for us.
• Stripe, for payments.
• Messaging platforms (Meta for Instagram, Messenger and WhatsApp, and Telegram), to send and receive messages.
• The AI and media providers described above, when a business enables them.
• An error-reporting provider, with personal data removed where possible.
• Our affiliate program provider, for affiliates only.
• Tools a business connects (for example its CRM, email marketing, spreadsheet, calendar or webhook endpoints), at that business’s direction.
• Authorities or others when the law requires it, or to protect the rights, safety and security of people and the service.
• A buyer or successor if the business is reorganized or sold, under this policy.

7. How long we keep information

• Message text, attachments and similar delivery records are removed after 90 days by default.
• Generated voice files used to send a voice note are deleted within hours.
• Workspace exports are deleted one day after they are created.
• Account, contact and workspace data is kept while the account is active, until the owner deletes it or the workspace is deleted.
• Billing and tax records are kept for as long as the law requires. Backups are overwritten on a rolling basis.

8. Security

Data travels over encrypted connections. Access tokens, integration credentials, message content and attachments are encrypted at rest. Passwords and API tokens are stored only as hashes. Each workspace’s data is isolated from every other workspace, including at the database level. Team access is controlled by roles and optional per-account and per-section limits, and staff access requires multi-factor authentication and is logged. No system is perfectly secure, but we work to protect your information and will notify you of a breach as the law requires.

9. Your choices and rights

• Access and export: workspace owners can download all workspace data in Settings → Data & privacy.
• Deletion: owners can permanently delete a workspace in the same place. You can ask us to delete your account.
• Correction: you can update your profile and workspace information in the app.
• Connected accounts: disconnect a channel or integration at any time, or remove Instantlify from your Instagram or Facebook settings.
• Depending on where you live, you may also have the right to object to or restrict processing, to data portability, to withdraw consent, and to complain to your data protection authority.

To make a request, email support@instantlify.com. If you are a customer of a business that uses Instantlify, contact that business first; we will help it respond.

10. Cookies and browser storage

• Essential cookies keep you signed in and protect forms against cross-site attacks.
• On our public website, a first-party nm_sid cookie links page views in a visit so we can measure which pages lead to signups. It is not shared with advertisers.
• Browser storage remembers preferences such as your language, and the website chat visitor ID described above.

11. Children

Instantlify is a business tool and is not directed at children. Account holders must be at least 16 years old (or the age of digital consent where they live).

12. International transfers

We and our providers may process information in countries other than yours. Where required, we use appropriate safeguards such as standard contractual clauses.

13. Changes

We will update this policy as the service changes and post the new version here with its effective date. For significant changes we will also notify account holders.

14. Contact

Instantlify, [Registered business address]. Privacy: support@instantlify.com. Support: support@instantlify.com. See also our terms of service.