Privacy Policy

Last updated: February 17, 2026

Creator Lane ("we", "our", "us") operates a creator engagement automation platform that helps Instagram creators automatically respond to followers who comment specific keywords on their content. This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

When you connect your Instagram account to Creator Lane, we collect:

Instagram Account Information: Your Instagram user ID, username, and business-account metadata (via instagram_business_basic). This scope also grants read access to your recent media list, which we cache to power the campaign builder's post picker and aggregate performance metrics.
Comment Data: We receive real-time notifications when users comment on your Instagram posts (via instagram_business_manage_comments). We process comment text, comment ID, and the commenter's Instagram-scoped ID to determine if an automated response should be sent.
Messaging Data: We use instagram_business_manage_messages solely to send automated direct messages on your behalf to users who commented a matching keyword and to process opt-out messages.

2. How We Use Your Information

To detect keyword matches in comments on your Instagram posts
To send automated direct messages to commenters on your behalf
To prevent duplicate messages to the same user
To log message delivery status for troubleshooting

Automated messages are sent on the creator's behalf in response to comments or DMs the recipient initiated. No external links or advertising are appended unless the creator explicitly adds them to their message.

We do not use your data for advertising, sell it to third parties, or use it for any purpose other than providing the service you configured.

3. Data Storage and Retention

We store the following data in a PostgreSQL database on our server:

Access tokens are encrypted at rest using industry-standard symmetric encryption (Fernet) and stored in our database. They are used only to interact with the Instagram API on your behalf.
Duplicate prevention records: We store the commenter's Instagram-scoped ID paired with the media ID to prevent sending duplicate messages. These records persist until the creator's account is disconnected or data deletion is requested.
Message delivery logs: We log each DM send attempt (recipient Instagram-scoped ID, media ID, delivery status, timestamp). These logs are automatically purged after 90 days.
Tracking link records: For campaigns with links, we store the generated short code, destination URL, recipient Instagram-scoped ID, and click timestamps for campaign analytics.
Data deletion requests: We record deletion requests (confirmation code, status, timestamps) for audit compliance.

We do not store comment text in our database, and we do not store link-click IP addresses, user-agent strings, or HTTP referer values.

4. Data Sharing

We do not share your personal data with third parties except:

With Meta/Instagram as required to operate the API integration
With infrastructure providers (cloud hosting) who process data on our behalf under strict confidentiality agreements
When required by law or legal process

4a. Stored Media for AI Analysis

When you enable Post Intelligence (an opt-in analytics feature), Creator Lane downloads copies of your own public Instagram posts (images and reels) and stores them in encrypted cloud storage (Cloudflare R2, with at-rest encryption) scoped to your account. These media are sent to Anthropic's Claude API for content analysis (hook patterns, transcripts, topic tags) so we can surface growth insights inside Creator Lane.

Important points:

Your posts only. We only store media from accounts you've connected to Creator Lane. We never collect posts from other creators or third-party accounts.
Already public. Only posts that are already public on Instagram are downloaded.
Per-account isolation. Each creator's stored media lives under a dedicated key prefix in our object storage; nothing crosses account boundaries.
Anthropic does not train on it. Anthropic processes media under their data-processing terms and explicitly does not train on customer API content.
Deletion. When you disable Post Intelligence or delete your account, the stored media and any derived analyses are removed within 7 days.

5. Data Security

We implement the following security measures:

HTTPS encryption for all data in transit
Webhook signature verification to ensure incoming data is genuinely from Meta
Access tokens encrypted at rest using industry-standard symmetric encryption
Rate limiting to prevent abuse (150 DMs/hour cap per account)

6. Your Rights

You have the right to:

Access the data we hold about you
Delete your data at any time (see our Data Deletion page)
Disconnect your Instagram account, which revokes our access immediately
Opt out of automated messaging by replying "STOP" to any automated DM, or by removing the app from your Instagram settings

7. Data Deletion

You can request deletion of all your data by:

Visiting our Data Deletion Instructions page
Emailing us at contact@creatorlanehq.com
Removing the app from your Instagram account settings (this triggers our automated data deletion callback)

All data is deleted within 7 business days of a deletion request.

8. Meta Platform Data

Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies, including limitations on data use, sharing, and retention.

9. Children's Privacy

Our service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page with an updated date.

11. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:
contact@creatorlanehq.com