This policy is for the instatoweb application at https://www.instatoweb.com, which turns a public Instagram account into a website. It explains, specifically, what data the application collects, why, where it is stored, who else sees it, how long it is kept, and how to have it deleted. It is written for this application alone and describes how the software actually works.
Who we are
instatoweb is operated by Jean Michael Mayer Ltda. (CNPJ 37.542.038/0001-04), Estrada do Oeste, 487 – Fundos, Rio Bonito (Pirabeiraba), Joinville – SC, 89239-600, Brazil (“we”, “us”). We are the data controller for the processing described here. For any question, request or complaint about your data, write to contact.instatoweb@gmail.com. instatoweb is an independent product and is not affiliated with, endorsed by or connected to Instagram or Meta.
1. What data we collect
1.1 Public Instagram data
When someone types an Instagram handle, we fetch what that account already shows to anyone on the internet: the profile name, biography, profile picture, follower count, the most recent posts, their captions, and the photos or video poster frames. We obtain this through a third-party data provider (ScrapeCreators). We never sign in to Instagram, and we do not access private accounts, direct messages, or anything behind a login.
1.2 Your account, including Google account data
Sign-in is handled by Clerk, our authentication provider. You can sign in with an email address or with a Google account. When you sign in with Google, we request only the basic sign-in scopes (openid, email and profile) and receive your Google account identifier, your name, your email address and your profile picture. Section 2 describes exactly how that data is used.
1.3 Content you create
Every message you send in the editor, every version of your site, the look you choose, and every photo you upload is stored so that the editor can undo, restore and continue where you left off. Uploaded photos have their embedded metadata removed, including any GPS location, before they are stored.
1.4 Technical data
Our servers log each request with the requesting IP address, browser type and time, to keep the service running and to detect abuse. We use no advertising trackers and no third-party analytics.
2. Google account data: access, use, storage, sharing
What we access. Through Google sign-in we access your Google account identifier, name, email address and profile picture. We request no other Google data: not your contacts, calendar, Drive, Gmail, YouTube or Photos.
How we use it. Solely to create your instatoweb account, to recognise you when you return, to link the sites you claim to you, and to send you messages about your own account (for example, a change to these terms). We do not use Google account data for advertising, profiling, or any other purpose.
Where it is stored. Your name, email address and profile picture are held by Clerk in your Clerk account record. Our own database stores only the opaque account identifier Clerk assigns you, attached to the sites you have claimed; it holds neither your email address nor your name.
Who we share it with. Nobody, other than Clerk acting as our sign-in processor. We do not sell Google account data, do not share it with advertisers or data brokers, do not transfer it to other applications, and do not use it to train artificial-intelligence models.
How you revoke it. You can withdraw instatoweb’s access to your Google account at any time at myaccount.google.com/permissions, and you can ask us to delete your account as described in section 9.
instatoweb’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. Previews of accounts you do not own
Anyone may generate a preview of a public professional account. We hold that preview to a stricter standard than anything else in the service:
- It lives at an unguessable link, is marked
noindexso search engines do not list it, and is not linked from anywhere public. - Its photos are not copied. They are streamed from Instagram’s own servers each time the preview is viewed.
- It is deleted automatically 7 days after it was generated unless the account’s owner signs in and claims it.
If someone generated a preview of your account and you want it gone sooner, write to contact.instatoweb@gmail.com with the handle and we will remove it.
4. Publishing
A site becomes public only after you sign in and claim it, which is your confirmation that the Instagram account is yours or that you are authorised to represent it. At that moment we copy the photos into our own storage, so your published site no longer depends on Instagram, and the site is served at a public address under instatoweb.com. Everything on a published site is public by design.
5. How the AI is involved
The text of the profile and captions, the colours we measure from the photos, and your chat messages are sent to a language model to write and edit the site. Model access is provided by OpenRouter and its underlying model providers under their own terms. We send this data only to generate or edit your site, and we do not use your content, your account data or your Google account data to train models.
6. Who else sees your data
We share data only with the providers needed to run the service, each bound by its own privacy terms:
- Clerk: sign-in and account management; holds your account record, including Google account data if you sign in with Google.
- Railway: hosting and the database in which sites, versions, chat history and copied photos are stored, in the United States (Railway, region us-west2).
- ScrapeCreators: retrieves public Instagram profile data when a handle is typed.
- OpenRouter: routes text to the language models that write and edit sites.
- Google Fonts: typefaces on our own pages, requested directly by your browser.
We do not sell personal data, we do not share it with advertisers or data brokers, and we disclose it to authorities only when the law requires.
7. How we protect your data
All traffic between your browser, our servers and our providers is encrypted with HTTPS. Data is stored in a managed database on Railway, in the United States (Railway, region us-west2), reachable only from inside our hosting environment; the credentials that unlock it are kept as deployment secrets and never in our code. Access to production systems is limited to the operator. Sign-in credentials are handled entirely by Clerk; we never see or store passwords. Photo links served before publishing are signed so that our image proxy cannot be used to fetch arbitrary content. No system is perfectly secure; if a breach affects your data we will tell you and the relevant authority as the law requires.
8. How long we keep things
- Unclaimed previews: deleted 7 days after generation.
- Claimed sites, their versions, chat history, uploads and copied photos: for as long as your account exists, or until you delete the site.
- Account data (in Clerk, and our identifier for you): until you delete your account.
- Server logs: up to 90 days.
- Backups: routine database backups expire on their own schedule, within 30 days.
9. Deleting your account and your data
Write to contact.instatoweb@gmail.com from the email address on your account and ask us to delete it. Within 30 days we delete your sites, every version of them, your chat history, your uploaded photos and the Instagram photos we copied when you published, and we delete your account record at Clerk, including any Google account data it holds. Published sites go offline as part of this. If you signed in with Google, you can additionally revoke instatoweb’s access at myaccount.google.com/permissions; revoking access alone does not delete your data with us, so please also send the deletion request.
10. Your rights
Wherever you are, you can ask us what we hold about you, correct it, receive a copy, or have it deleted. If you are in Brazil these rights are guaranteed by the LGPD; if you are in the European Union or United Kingdom, by the GDPR, including the right to object to processing based on legitimate interest and to complain to your supervisory authority (in Brazil, the ANPD). Write to contact.instatoweb@gmail.com; we answer within the period the applicable law requires.
Our lawful basis for handling public profile data in a temporary, private preview is legitimate interest in offering the service; for everything after you sign in and claim a site it is the agreement between us and, where required, your consent.
11. Cookies and local storage
We use only the cookies strictly necessary to keep you signed in, set by Clerk. The editor may keep small preferences, such as the position of the chat panel and the link to a draft you started, in your browser’s local storage. Nothing tracks you across other websites.
12. Age
The service is for people aged 18 or over. We do not knowingly collect data from anyone younger.
13. Changes to this policy
If this policy changes in a way that matters, we will note it here and, for account holders, by email. The date at the top is the date of the current version.
14. Contact
Jean Michael Mayer Ltda. (CNPJ 37.542.038/0001-04), Estrada do Oeste, 487 – Fundos, Rio Bonito (Pirabeiraba), Joinville – SC, 89239-600, Brazil. Email: contact.instatoweb@gmail.com. This is also the address for data requests under the LGPD and GDPR and for questions about Google account data.