Privacy Policy

For your own account, subscription, support and billing information, we decide why and how that information is used.

For the Instagram conversations and contact information your automations collect, you decide the purpose and we process it to provide the service to you. The Data Processing Addendum governs that relationship.

Account data: your name, email, workspace, role, and the legal versions you accepted.

Instagram connection data: your Instagram account id, username, profile picture, granted permissions and an encrypted access token. We never receive or store your Instagram password.

Automation data: the automations you build, and the executions they produce including the decisions the engine made.

Contact data: the Instagram users who message or comment on your account, the messages exchanged in those conversations, and the answers they give to questions your automations ask.

Creator network data: only what you type into your creator profile, travel plans and project posts. This is separate from your Instagram data and is never populated from it.

Location data: if you use creator discovery, the city you enter is converted to approximate coordinates so we can match nearby creators. Exact coordinates stay on our servers and are never shown to other users, who see only your city and a distance band you choose.

Billing data: your billing country, subscription state and payment records. Card details are handled by Razorpay and never reach our servers.

Technical data: logs needed to run and secure the service. We store a derived country code rather than retaining a full history of IP addresses where we can.

If you enable AI features, relevant portions of Instagram conversations are sent to the AI provider you chose, using the API key you supplied. That provider processes it under its own terms and your account with them.

We send the minimum context needed for the step to work, not entire conversation histories, and we tell you exactly what happens before you enable a provider.

We encrypt your API key and never display it again after it is saved.

Our subprocessors are listed on the Subprocessors page. They are the infrastructure providers we need to run the service — hosting, payments, email — and any AI provider you choose to connect.

We do not sell personal data, and we do not use your customers' data to train models.

Account and billing records are kept while your account is active and for as long as we are legally required to keep them afterwards.

Conversation and contact data is kept while your workspace is active. You can delete individual contacts or your whole workspace at any time.

Travel plans and availability posts expire automatically. Idempotency and diagnostic records expire on a short schedule.

You can access, correct, export and delete your data, withdraw consent, and object to certain processing. The Privacy Centre inside Settings does most of this immediately; for anything else, contact support@colormetriclabs.com.

Withdrawing consent is as easy as giving it. Deleting data propagates through search indexes, saved lists and caches, not just the primary record.

If you are in India, you may raise a grievance with our Grievance Officer, named on the Grievance page. If you are in the EU or UK, you may also complain to your local supervisory authority.

Instagram tokens and AI provider keys are encrypted with a key managed in Google Cloud KMS and are never returned to a browser. Access to production data is limited and audited. The Security page describes our approach in more detail.

If a personal data breach occurs, we assess and notify as required by applicable law, including the 72-hour supervisory authority notification where GDPR applies.

transfer mechanism to be confirmed by counsel