Privacy Policy

Account Information

When you create an account, we collect your name, email address, and password. If you sign up using a third-party service (e.g., Google), we receive your name, email address, and profile picture from that provider.

Usage Data

We automatically collect information about how you interact with our platform, including pages visited, features used, timestamps, device type, browser type, IP address, and referring URLs.

Organization Data

If you create or join an organization, we store organization names, member roles, and any content you create within that organization (boards, posts, analytics data, integrations configuration).

Third-Party Integrations

When you connect third-party services (e.g., social media accounts, advertising platforms), we collect and store the data necessary to provide our services, including access tokens, analytics metrics, and campaign data. We only access the data you explicitly authorize.

InstaFlow — Instagram DM Automation Data

When you use InstaFlow, our Instagram DM automation feature, we collect and process data about Instagram users ("leads") who interact with your Instagram account. This includes:

This data is collected on behalf of the organization operating the Instagram account. The organization acts as the data controller for lead data, and Aspen.ai acts as the data processor.

• **Instagram identifiers:** Instagram user ID, username, and profile picture URL as provided by the Instagram Messaging API.
• **Contact information:** Email address or phone number, only when voluntarily provided by the lead during an automated conversation flow.
• **Conversation data:** Messages exchanged between your Instagram account and the lead, including automated responses, collected form data, and conversation status.
• **Behavioral data:** Link clicks, opt-in status for recurring messages, tags, and segment memberships assigned by the organization.
• **Custom fields:** Any additional data collected through conversation flows configured by the organization (e.g., preferences, interests).

Legal Basis (GDPR Art. 6)

Lead data collected through InstaFlow is processed on the following legal bases:

• **Legitimate interest (Art. 6(1)(f)):** The lead initiates a conversation with the Instagram account, expressing interest in the organization's services. Processing is necessary to respond to and manage this interaction.
• **Consent (Art. 6(1)(a)):** When leads opt in to recurring messages or provide personal data through consent-gated form fields, explicit consent is obtained and recorded.

Purpose of Processing

• Responding to Instagram Direct Messages on behalf of the organization
• Executing automated conversation flows configured by the organization
• Collecting data provided voluntarily by the lead (email, phone, preferences)
• Segmenting leads for targeted follow-up communications
• Providing analytics and reporting to the organization
• Sending recurring messages only when the lead has opted in

Data Retention

Lead data is retained according to the organization's configured retention policy. By default, leads inactive for more than 3 years (1,095 days) are automatically purged, in accordance with CNIL recommendations for commercial prospection data. Organizations can customize this duration in their settings. Leads who have opted in to recurring messages are excluded from automatic purge.

Lead Rights

Instagram users whose data is processed through InstaFlow have the following rights under GDPR:

To exercise these rights, leads or their representatives may contact the organization operating the Instagram account, or reach out to us at privacy@aspen.ai.

• **Right of access (Art. 15):** Request a copy of all personal data held. Organization admins can export individual lead data at any time.
• **Right to data portability (Art. 20):** Lead data can be exported in structured JSON format.
• **Right to erasure (Art. 17):** Leads can be permanently deleted, which cascades to all conversations, messages, and segment memberships.
• **Right to withdraw consent (Art. 7(3)):** Leads who opted in to recurring messages can be opted out at any time by the organization.

Audit Trail

All lead data deletions, exports, and automated purges are logged in an immutable audit trail, recording who performed the action, when, and what data was affected. This ensures traceability and accountability in compliance with GDPR Art. 5(2).