Privacy

Privacy Policy

Personal only works with what you hand it: your professional Instagram account, your positioning, and the moments of your life you write down. This page states exactly what we collect, why, who it is shared with, how long it is kept, and how to erase all of it.

Last updated: 20 August 2026

The short version, in five points

We sell nothing: Your data is never sold, rented or handed to data brokers, and it powers no targeted advertising.
Personal never posts for you: Nothing is published, scheduled or sent to your Instagram account unless you press the button yourself.
Your content trains no model: Text sent to our AI providers goes through their business APIs, whose terms exclude training their models on our requests.
Your data stays yours: Your Moments, your creator profile and your drafts are never shown to another creator, in any form.
Everything can be erased: Disconnecting Instagram immediately deletes the access token and every imported media item. Deleting your account erases the rest.

Who is the data controller

The controller under the General Data Protection Regulation (GDPR) is the publisher of the Personal service, available at usepersonal.app: [LEGAL ENTITY — legal form, registered address, company number].

For any question about this policy, or to exercise your rights, write to privacy@usepersonal.app. We answer within one month at the latest.

Given the size of the service and the nature of the processing, no data protection officer has been appointed: requests are handled directly by the publisher.

The data we process

Personal collects only what the product needs in order to work. These are all the categories, as they actually exist in our database.

Account: Your name, your email address, your password (stored only as a bcrypt hash, never in clear text), the date your address was verified, and your browser session tokens.
Instagram connection: The public information of your professional account and your recent posts, detailed in the next section.
Creator profile: Your niche, your audience description, your positioning, your tone, your topics, your current projects, your goals and your strengths — whether you write them yourself or they are inferred from your posts and then submitted to you for approval.
Life Moments: The free-form notes you save to ground your content, their category and their dates. This is the most personal data in the service: write only what you would be willing to tell your audience, and avoid recording sensitive data (health, political or religious views, sexual orientation) or information about identifiable third parties.
Content you produce: The Reel, carousel and caption drafts generated for you, the versions you edit, and the posts you save or dismiss in the feed.
Assistant conversations: The messages you exchange with the creative assistant, sent to our AI provider along with your profile context for as long as it takes to produce an answer. They are not stored on our servers.
Technical data: IP address, browser type, request timestamps and error messages, written to the server logs for security and diagnostics.

We collect no payment data (the service is free during early access), no precise location data and no advertising identifiers.

What we receive from Instagram (Meta)

The connection runs on Instagram Login, Meta's official mechanism for professional accounts. You authenticate with Instagram, never with us: we never see your Instagram password. Meta returns an access token, which we encrypt before writing it to the database and never expose to the browser.

The permissions requested are instagram_business_basic (profile and posts), instagram_business_manage_insights (statistics for your posts) and instagram_business_content_publish (publishing content, reserved for an action you trigger yourself).

Profile: Instagram ID, username, display name, account type, biography, website, profile picture, follower count, following count and media count.
Recent posts: Up to your 25 most recent posts: caption, media type (image, video, Reel, carousel), permalink, media and thumbnail URL, publication date, like count and comment count.
Post insights: Where Meta provides them: views, reach, likes, comments, shares, saves and total interactions, post by post.
What we never receive: Your direct messages, the list or identity of your followers, the comments your followers leave, your Meta payment information, and data about the accounts you follow.

The publishing permission exists for one thing only: publishing content you have approved, at the moment you ask for it. Personal never publishes, schedules or deletes anything on its own initiative.

You can withdraw this access at any time, from Personal's Settings or from Instagram itself. The “Erasing your data” section describes both routes.

Our use of information received from Meta complies with the Meta Platform Terms and the Meta Developer Policies. We pass that information to no third party beyond the processors listed below, and we use it for no advertising purpose.

Purposes and legal bases

Every processing operation serves a defined purpose and rests on a legal basis set out in the GDPR.

Providing the service — performance of the contract: Creating and securing your account, importing your posts, building your For You feed, generating drafts, and keeping your Moments and saved content.
Personalising recommendations — performance of the contract: Matching the formats that genuinely work in your niche against your positioning and your life moments, so that only what sounds like you is suggested.
Connecting Instagram — consent: Access to your account rests on the permission you grant at Meta. You can withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.
Sending service email — performance of the contract: Address verification, password resets and messages essential to the life of your account. No marketing without your prior agreement.
Securing the service — legitimate interest: Rate limiting, abuse detection, technical logs and backups. Our interest is protecting accounts, and it never overrides your fundamental rights and freedoms.
Improving the product — legitimate interest: Understanding errors and usage in order to fix and evolve the service. We work on aggregated or anonymised data wherever that is possible.

The role of artificial intelligence

Drafts and assistant replies are written by language models operated by OpenAI and, depending on the service configuration, Anthropic. We send them only what the request needs: the post being analysed, the selected life moment, your creator profile and your message.

These calls go through their business APIs. Under those terms the data sent is not used to train their models; the provider may retain it briefly for abuse detection, after which it is deleted.

No decision producing legal effects or similarly significantly affecting you is made automatically. A model proposes text; you decide everything else.

A model can be wrong. Always read a draft before publishing it: you remain the author of, and responsible for, what you post.

Other creators' posts

The For You feed is built from public posts by other Instagram accounts in your niche. We collect them through our provider Apify, from hashtag pages and public profiles.

We keep what makes a post comparable: public username, display name, profile picture, biography, follower count and the account's average engagement, and for each post its hook, caption, thumbnail, date and public counters.

The legal basis is our legitimate interest in producing trend analysis from information their authors have made public. We access no private account, no message and no data that is not already visible to everyone. This information serves performance analysis only: it is never used to contact those creators, nor to republish their content.

If you are a creator and do not want your posts analysed by Personal, write to privacy@usepersonal.app: we remove your account and your posts from our database and prevent them from reappearing.

Transfers outside the European Union

Some of our processors are established in the United States. Those transfers are governed by the European Commission's Standard Contractual Clauses and, where the provider is certified under it, by the EU–US Data Privacy Framework. You can request a copy of the applicable safeguards at privacy@usepersonal.app.

How long we keep data

Account and creator profile: For as long as your account exists, then erased within 30 days of your deletion request.
Access token and imported Instagram media: Deleted immediately when you disconnect Instagram or delete your account. The token also stops being valid on its own if it is not refreshed.
Moments and content you produce: For as long as you keep them. Deleting from the app erases the record from the database.
Assistant conversations: Not stored on our servers: the exchange lives in your browser and disappears when you clear it or reload the page.
Public posts analysed: Refreshed regularly; a post leaves the feed once it falls outside the analysis window (30 days by default) and stale measurements are overwritten.
Technical logs: 12 months at most, in line with recommended practice on traceability.
Backups: Deleted data may survive in an encrypted backup for at most 30 days before disappearing for good.

How we protect your data

Encryption in transit: All traffic between your browser, our API and our providers runs over HTTPS/TLS.
Encrypted Instagram tokens: The Meta access token is encrypted at rest with the application key and is never sent to the browser.
Passwords: Stored as bcrypt hashes at 12 rounds. Nobody, ourselves included, can read them.
API access: Every authenticated call requires a revocable personal token; signing out revokes it immediately.
Abuse limiting: Sensitive endpoints — sign-in, registration, content generation — are capped by request rate.
Data breach: In an incident posing a risk to your rights, we notify the supervisory authority within 72 hours and inform you directly where the risk is high.

Your rights

The GDPR grants you the following rights. Exercise them at any time by writing to privacy@usepersonal.app from your account's email address.

Access: Confirm whether we process data about you and receive a copy of it.
Rectification: Correct inaccurate or incomplete data. Most fields can be edited directly in Settings and Personal.
Erasure: Request deletion of your data, under the conditions described in the next section.
Portability: Receive your data in a structured, machine-readable format, or have it transmitted to another controller.
Objection: Object, on grounds relating to your particular situation, to processing based on our legitimate interest.
Restriction: Ask for processing to be frozen while a dispute is examined.
Withdrawing consent: Revoke Instagram access at any time, without justification and without consequence for the rest of your account.
Post-mortem instructions: Set out what should happen to your data after your death, as provided by French data protection law.
Complaint: Lodge a complaint with a supervisory authority — in France, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr — if you believe your rights are not respected.

We answer within one month, extendable by two months for complex requests, in which case we tell you. We may ask you to verify your identity where there is reasonable doubt about who is making the request.

Erasing your data

There are four routes, from the most targeted to the most complete. None of them requires a justification.

1. Disconnect Instagram: In Personal: Settings → Instagram → Disconnect. The access token and every imported media item are deleted from our database immediately.
2. Revoke access from Instagram: In the Instagram app: Settings → Websites and apps → Personal → Remove. Access stops at once on Meta's side and the token becomes unusable.
3. Delete a specific item: Every Moment, draft and saved post can be deleted from the screen it appears on, without going through us.
4. Delete the whole account: Write to privacy@usepersonal.app from your account's email address, with the subject “Account deletion”. We erase the account, the creator profile, the Moments, the drafts, the imported media and the Instagram token, and confirm it by email within 30 days.

The only things that remain are data the law requires us to keep, if any, and other creators' public posts, which are not about you.

Cookies and local storage

Personal uses no advertising cookie, no third-party analytics tool and no social network tracker. No consent banner is therefore needed: the only cookies set are strictly necessary for the service to work.

personal_token: Keeps your authenticated session. Deleted when you sign out.
personal_lang: Remembers the display language you chose.
personal-onboarding-skipped: Remembers that you chose to skip the Instagram connection step. Lifetime: one year.

Minors

Personal is aimed at creators with a professional Instagram account and is not intended for people under 16. If you become aware that someone under 16 has created an account, write to us: we will delete the data concerned without delay.

Changes to this policy

This policy evolves with the product. The last updated date sits at the top of this page. Any substantial change — a new purpose, a new processor receiving your personal data, a change in retention — is notified to you by email or in the app before it takes effect.

Contact us

Write to privacy@usepersonal.app for any question, rights request or report related to this policy.

By post: [PUBLISHER'S POSTAL ADDRESS].

Back to home