This policy is for the instatoweb application at https://www.instatoweb.com, which turns a public Instagram account into a website. It explains, specifically, what data the application collects, why, where it is stored, who else sees it, how long it is kept, and how to have it deleted. It is written for this application alone and describes how the software actually works.
Who we are
instatoweb is operated by Jean Michael Mayer Ltda. (CNPJ 37.542.038/0001-04), Estrada do Oeste, 487 – Fundos, Rio Bonito (Pirabeiraba), Joinville – SC, 89239-600, Brazil (“we”, “us”). We are the data controller for the processing described here. For any question, request or complaint about your data, write to contact.instatoweb@gmail.com. instatoweb is an independent product and is not affiliated with, endorsed by or connected to Instagram or Meta.
1. What data we collect
1.1 Public Instagram data
When someone types an Instagram handle, we fetch what that account already shows to anyone on the internet: the profile name, biography, profile picture, follower count, the most recent posts, their captions, and the photos or video poster frames. We obtain this through a third-party data provider (ScrapeCreators). We never sign in to Instagram, and we do not access private accounts, direct messages, or anything behind a login.
1.2 Your account, including Google account data
Sign-in is handled by Clerk, our authentication provider. You can sign in with an email address or with a Google account. When you sign in with Google, we request only the basic sign-in scopes (openid, email and profile) and receive your Google account identifier, your name, your email address and your profile picture. Section 2 describes exactly how that data is used.
1.3 Content you create
Every message you send in the editor, every version of your site, the look you choose, and every photo you upload is stored so that the editor can undo, restore and continue where you left off. Uploaded photos have their embedded metadata removed, including any GPS location, before they are stored.
1.4 Technical data
Our servers log each request with the requesting IP address, browser type and time, to keep the service running and to detect abuse. We also measure how the service and the sites we host are used with PostHog, our product-analytics provider (section 1.7), and run advertising tags on our own marketing pages (section 6).
1.5 Visits to published sites
When someone opens a site published on a paid plan, our server counts the view: which page, the day, and the website the visitor came from, when their browser says. To count each visitor once a day, it combines their IP address and browser type with a random value made each day, and keeps only the resulting code. That value is deleted when the first visit of a later day is counted, and from then on the code cannot be traced back to anyone; routine database backups may hold it until they expire (section 8). The IP address is not stored for this. This count sets no cookie, and crawlers and link previews are not counted. The site’s owner sees totals only: visits, page views, pages and where visitors came from. Separately from this count, PostHog measures visits to every site we host (section 1.7).
1.6 Appointment bookings
When you book with a business, we store your name, email, optional phone number, selected service, appointment times and status so that the business owner can manage the booking. These records are separate from generated website content and are not sent to the website AI. We also retain a hashed, date-scoped network identifier with the booking to limit automated submissions. When email is configured, Resend processes the recipient email and appointment details to send confirmations, changes and cancellations. Email delivery can fail: booking takes you to the private management page of your appointment, so keep its link. Anyone with that link can view the appointment details shown there and cancel a future appointment. Booking pages do not load our advertising tags. They do load PostHog (section 1.7), which records the visit but none of the booking details you enter, and the private management page does not load it.
Cancelled appointments remain in the business calendar. Deleting the website deletes its calendar and appointment records from active storage; routine backups may retain copies until they expire. Contact the business or contact.instatoweb@gmail.com to request correction or erasure. Do not submit medical details or other sensitive information in booking fields. This feature does not access your Google Calendar.
1.7 Product analytics
Every page we serve loads PostHog, our product-analytics provider: our own pages (the home page, pricing, the trade pages, sign-in, the editor and your account), the booking pages, and every site we host, whether it is published, a draft preview or one of our examples. For each visit it records the address of the page (with a draft’s private link token removed), the page you came from and any campaign tags in the link, your browser, device and screen size, your IP address and the approximate location PostHog derives from it, how long you stayed, what you clicked, how fast the page loaded, and errors the page ran into. In our own product it also records what you did: building a site, editing it in the chat, changing its look, publishing, connecting or buying a domain, starting a checkout, subscribing or cancelling, and reaching a limit of your plan. We use this to see which pages bring people, where they stop before finishing, how the product is used, and what breaks.
When you are signed in, these events are linked to your account and to your name, email address and plan, so that we can see how each account uses the service and help when something goes wrong. A visitor to a site we host is never linked to a name or email address: they are counted under a random identifier kept in their browser (section 11). PostHog may also record replays of a visit (what changed on the page, clicks and scrolling), with everything typed into fields masked. PostHog stores this data in the United States and keeps it for at most seven years, and replays for at most one year.
1.8 Building a site without an account
Anyone may have a site written without signing in, a few times a day. To hold that limit, our server counts each day’s builds by people who are not signed in, in total and per network: it takes the IP address our hosting provider reports for the request (of an IPv6 address only the first half, which names the connection rather than the device), combines it with a random value made for that day, and keeps only the resulting code, how many builds it started, and how many found no public account to build from (up to three of those a day are given back, so a mistyped handle costs nothing). The IP address is not stored for this. The day’s value, codes and counts are deleted when the first such build of a later day is counted, and from then on no code can be traced back to anyone; routine database backups may hold them until they expire (section 8). Signed-in builds are not counted this way.
2. Google account data: access, use, storage, sharing
What we access. Through Google sign-in we access your Google account identifier, name, email address and profile picture. We request no other Google data: not your contacts, calendar, Drive, Gmail, YouTube or Photos.
How we use it. Solely to create your instatoweb account, to recognise you when you return, to link the sites you claim to you, to send you messages about your own account (for example, a change to these terms), and to link your use of the service to your account in our product analytics (section 1.7). We do not use Google account data for advertising or any other purpose, and our advertising tags never receive it.
Where it is stored. Your name, email address and profile picture are held by Clerk in your Clerk account record. Our own database stores the opaque account identifier Clerk assigns you, attached to the sites you have claimed, and none of your Google account data. PostHog keeps your name and email address on the analytics profile of your account (section 1.7). If you buy a domain through us, we ask you for no registrant details: a .com is registered in our company’s name and a .com.br through our registrar’s local trustee, and the order keeps only your account identifier, the domain, its price and payment state, and the site it points at.
Who we share it with. Clerk, acting as our sign-in processor, and PostHog, acting as our analytics processor, which receives your name and email address (section 1.7). Nobody else. We do not sell Google account data, do not share it with advertisers or data brokers, do not transfer it to other applications, and do not use it to train artificial-intelligence models.
How you revoke it. You can withdraw instatoweb’s access to your Google account at any time at myaccount.google.com/permissions, and you can ask us to delete your account as described in section 9.
instatoweb’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. Drafts built without an account
Anyone may have a site written from a public account without signing in (section 1.8). Until somebody signed in claims it, it is a private draft, held to a stricter standard than anything else in the service:
- It lives at an unguessable link, is marked
noindexso search engines do not list it, and is not linked from anywhere public. Typing the same handle again opens it only on a browser that keeps its link, the one that started it or one it was opened on (section 11); anyone else who types the handle is asked to sign in, and a signed-in person who types it claims it, if their plan has room (section 4). - Its photos are not copied. They are streamed from Instagram’s own servers each time the draft is viewed. When we show one smaller, the smaller version is kept briefly in our server’s memory and never saved.
- It expires 7 days after it was generated: from then on it can no longer be opened or claimed.
- The browser that started or opened it remembers its link (section 11), so that signing in on that browser moves the draft into the account (section 4).
Expired drafts are not deleted automatically. If someone generated a draft of your account and you want it gone, write to contact.instatoweb@gmail.com with the handle and we will remove it.
4. Claiming and publishing
A site becomes yours when you claim it, which is your confirmation that the Instagram account is yours or that you are authorised to represent it. A site you build while signed in is claimed as it is built, and so is an unclaimed draft whose handle you type while signed in, as far as your plan has room. Drafts your browser started or opened before you signed in are claimed the first time you load one of our pages signed in on that browser, the one on screen first and then the oldest, as far as your plan has room for them (one it has no room for stays a draft, and your account shows it); publishing a draft claims it too. At the moment of the claim we copy the photos into our own storage, so your site no longer depends on Instagram. A site becomes public only when you publish it, at a public address under instatoweb.com. Everything on a published site is public by design.
5. How the AI is involved
The text of the profile and captions, the colours we measure from the photos, and your chat messages are sent to a language model to write and edit the site. Model access is provided by OpenRouter and its underlying model providers under their own terms. We send this data only to generate or edit your site, and we do not use your content, your account data or your Google account data to train models.
6. Who else sees your data
We share data only with the providers needed to run the service, each bound by its own privacy terms:
- Clerk: sign-in and account management; holds your account record, including Google account data if you sign in with Google.
- Railway: hosting and the database in which sites, versions, chat history and copied photos are stored, in the United States (Railway, region us-west2).
- ScrapeCreators: retrieves public Instagram profile data when a handle is typed.
- OpenRouter: routes text to the language models that write and edit sites.
- Stripe: payments and subscriptions; holds your payment details, and we never see your full card number.
- Cloudflare: carries the traffic and the security certificate of a domain of your own that you connect to your site.
- DNSimple: registers a domain you buy through us, a .com in our company’s name and a .com.br through its local trustee; it receives none of your details.
- Google Fonts: typefaces on our own pages, requested directly by your browser.
- PostHog: product analytics on every page we serve, including the sites we host (section 1.7); receives the name and email address of signed-in people; stores data in the United States.
- Meta and Google advertising tags: on our own marketing pages only, and on the page Stripe returns you to after you buy a plan, which shows nothing of your account. They record that a visit happened and whether it led to a site being started or a subscription bought (there, the plan and what it cost), so we can tell which of our advertisements work. They never run on a site you publish, and they receive none of your photographs, your site’s content or your chat.
We do not sell personal data, we do not share your content with data brokers, and we disclose it to authorities only when the law requires. What our advertising tags share with Meta and Google is described above and is limited to our own marketing pages and that one confirmation page.
7. How we protect your data
All traffic between your browser, our servers and our providers is encrypted with HTTPS. Data is stored in a managed database on Railway, in the United States (Railway, region us-west2), reachable only from inside our hosting environment; the credentials that unlock it are kept as deployment secrets and never in our code. Access to production systems is limited to the operator. Sign-in credentials are handled entirely by Clerk; we never see or store passwords. Our image routes only fetch photos from Instagram’s own servers, so they cannot be used to fetch arbitrary content. No system is perfectly secure; if a breach affects your data we will tell you and the relevant authority as the law requires.
8. How long we keep things
- Unclaimed drafts: they expire 7 days after generation and can no longer be opened; we keep them until you ask us to remove one (section 3).
- Counts of builds without an account: the day’s random value, codes and counts, until the first such build of a later day (section 1.8).
- Claimed sites, their versions and chat history: for as long as your account exists, or until you delete the site. The photo files a site used, uploads and copied photos, stay in our storage after the site is deleted, until you ask us to delete them (section 9).
- Visit counts of a published site: for as long as the site exists; they are deleted with it.
- Product analytics in PostHog: at most seven years; replays of visits at most one year.
- Account data (in Clerk, and our identifier for you): until you delete your account.
- Server logs: up to 90 days.
- Backups: routine database backups expire on their own schedule, within 30 days.
9. Deleting your account and your data
Write to contact.instatoweb@gmail.com from the email address on your account and ask us to delete it. Within 30 days we delete your sites, every version of them, your chat history, your uploaded photos and the Instagram photos we copied when you claimed a site, and we delete your account record at Clerk, including any Google account data it holds. Published sites go offline as part of this. If you signed in with Google, you can additionally revoke instatoweb’s access at myaccount.google.com/permissions; revoking access alone does not delete your data with us, so please also send the deletion request.
10. Your rights
Wherever you are, you can ask us what we hold about you, correct it, receive a copy, or have it deleted. If you are in Brazil these rights are guaranteed by the LGPD; if you are in the European Union or United Kingdom, by the GDPR, including the right to object to processing based on legitimate interest and to complain to your supervisory authority (in Brazil, the ANPD). Write to contact.instatoweb@gmail.com; we answer within the period the applicable law requires.
Our lawful basis for handling public profile data in a temporary, private draft is legitimate interest in offering the service; for everything after you sign in and claim a site it is the agreement between us and, where required, your consent. For limiting builds without an account (section 1.8) it is our legitimate interest in keeping the service available and its costs bounded, which is why only a daily code is kept. For counting visits to published sites (section 1.5) it is our and the site owner’s legitimate interest in knowing how many people a site reaches, which is why only a daily code is kept and no cookie is set. For product analytics (section 1.7) it is our legitimate interest in understanding and improving the service; you can object by writing to us, and blocking cookies or scripts in your browser stops it.
11. Cookies and local storage
We use the cookies strictly necessary to keep you signed in, set by Clerk, and two of our own: one remembers whether you folded the sidebar, the other the language you chose. PostHog sets a cookie whose name begins with ph_ and keeps matching entries in your browser’s local and session storage, on our pages and on every site we host, so that a returning browser is recognised and a visit is kept together; that identifier is used for our pages and the sites we host only. The Meta and Google tags on our marketing pages set those companies’ own cookies (section 6). While a site is being built, the browser tab keeps the Instagram handle, the private link token its draft will open with, and what the build has shown so far (the account’s name, bio, follower count and photo links) in its session storage, so that reloading the page picks the build up again; only the handle and the token are sent, to us, to find the site; it is deleted when the build ends and gone when the tab is closed.
When you start building a site or open a draft without being signed in, your browser keeps, in its local storage under itw_drafts, the handle, the draft’s private link token and the time it first kept them, for the last five drafts at most, and nothing else about you. It sends a token back to us when you type that handle again, so you get the same draft, and when a page of ours loads while you are signed in, so the drafts move into your account (section 4). An entry is removed once its draft is claimed, belongs to someone else, has expired or no longer exists, or its build failed, and none is kept longer than 7 days after your browser first kept it; one your plan has no room for stays until there is room or it expires. Clearing your browser’s site data removes it.
12. Age
The service is for people aged 18 or over. We do not knowingly collect data from anyone younger.
13. Changes to this policy
If this policy changes in a way that matters, we will note it here and, for account holders, by email. The date at the top is the date of the current version.
14. Contact
Jean Michael Mayer Ltda. (CNPJ 37.542.038/0001-04), Estrada do Oeste, 487 – Fundos, Rio Bonito (Pirabeiraba), Joinville – SC, 89239-600, Brazil. Email: contact.instatoweb@gmail.com. This is also the address for data requests under the LGPD and GDPR and for questions about Google account data.