InstaBot
Privacy Policy
This policy explains how SmartyAI Ltd (“we”, “us”) collects and uses personal data when you use InstaBot (www.instabot.gr, app.instabot.gr, the app, the Copilot, Autopilot and SEO Blog — the “Service”), and the rights you have. We comply with the UK General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”) and, for people in the European Union, the EU General Data Protection Regulation (“EU GDPR”).
1. Who we are
SmartyAI Ltd, company number 15254574, registered office 20 Wenlock Road, London, N1 7GU, United Kingdom. Contact for all privacy matters: support@instabot.gr.
We are the controller of the personal data described in this policy (your account, billing, usage and support data). When you put other people’s personal data into the Service (for example customers or staff in your photos or posts), you are the controller and we are your processor, under the data-protection terms in section 16 of our Terms.
2. What we collect
- Account: name, email address, sign-in identifiers, and the basic profile you share if you sign in with Google. Passwords are handled by our sign-in provider; we never see them.
- Business and brand: business name, website, sector, location, audience, offers, story, voice, colours, fonts, logo, photos and other material you give us or ask us to read.
- Content: the posts, captions, images, videos, articles, edits and earlier versions created in your account, your instructions, and your conversations with the Copilot.
- Public information you ask us to read: pages of your website and your public Instagram profile and posts.
- Connected accounts: when you connect Instagram/Facebook, the account and page names and identifiers, profile picture, publishing status, and post and account statistics (such as reach, impressions, likes, comments, shares, follower counts). We never receive your social-media password.
- WordPress (SEO Blog): your blog address, the WordPress username and application password you give us, and data about the articles we create.
- Billing: your plan, payment status, invoices, Stripe customer and subscription identifiers, and credit balance and history. Card details are collected and stored by Stripe, not by us.
- Usage and technical: log data such as IP address, browser and device type, pages and features used, time stamps, errors, and records of AI actions performed for your account (used for security, billing and cost control).
- Support and communications: messages you send us and our replies.
We do not intentionally collect special categories of personal data. Please do not put them into the Service.
3. How we use it and our legal bases
| Purpose | Legal basis |
|---|---|
| Create and run your account; create, edit, schedule and publish content; read your website and Instagram when you ask; run Autopilot, the Copilot and SEO Blog; report results | Performance of our contract with you |
| Take payments, manage plans and credits, prevent payment fraud | Contract; legal obligation (tax and accounting records) |
| Keep the Service secure, prevent abuse, debug, monitor costs and quality, improve the Service using usage information | Our legitimate interests in running a secure, reliable and sustainable service |
| Learn from your own results to improve your future posts (Autopilot learning) | Contract |
| Send service messages (security, billing, changes to terms) | Contract; legitimate interests |
| Send marketing emails; use advertising cookies to measure sign-ups from our ads | Consent, which you can withdraw at any time |
| Comply with law, respond to lawful requests, establish or defend legal claims | Legal obligation; legitimate interests |
We do not sell personal data and do not share it with third parties for their own marketing.
4. Artificial intelligence
To create content we send the relevant parts of your data (for example brand details, instructions, website text and images) to AI model providers listed in section 5. Under their business (API) terms, these providers do not use our API data to train their models and may keep it only for a limited time for safety and abuse monitoring. We do not use your content to train our own or anyone else’s AI models.
The Service does not make decisions about you that produce legal or similarly significant effects based solely on automated processing. AI output is a proposal you review, edit or reject; if you switch on automatic publishing you choose to publish without review.
5. Who we share it with
We share personal data only with the service providers we need to run the Service (our sub-processors), under contracts that require them to protect it and use it only for us:
| Provider | What for | Location |
|---|---|---|
| Google Cloud (Google LLC) | Hosting, database, file storage, video rendering | USA |
| Anthropic, PBC | AI text, design and the Copilot (Claude) | USA |
| OpenAI, L.L.C. | AI images, voice-overs and transcription | USA |
| Google LLC (Gemini) | AI images | USA |
| BytePlus (ByteDance group) | AI video | Singapore / international |
| Clerk, Inc. | Sign-in and account security | USA |
| Stripe | Payments, invoices, fraud prevention | Ireland / USA |
| Social media planning & CRM platform | Social-media planner: connecting accounts, publishing, statistics; customer relationship records | USA |
| Meta Platforms (Instagram, Facebook) | Publishing and statistics through the official APIs, when you connect | Ireland / USA |
| Apify | Reading your public Instagram profile when you ask | EU / USA |
| Firecrawl (Mendable, Inc.) | Reading your website when you ask | USA |
| Inngest, Inc. | Running scheduled jobs (publishing times, Autopilot) | USA |
| LangChain, Inc. (LangSmith), where enabled | Monitoring the quality and errors of AI requests | USA |
| Google Ads | Measuring sign-ups from our ads (only with consent) | USA |
| Your WordPress host | Delivering articles to your website, when you connect it | As chosen by you |
Stock images are searched with keywords only (for example on Pixabay); no personal data is sent. We may also disclose data to professional advisers, to a buyer or successor of our business, or where required by law, court order or a competent authority.
6. International transfers
Our main hosting and several providers are in the United States and other countries outside the UK and the EEA. Where personal data is transferred, we rely on adequacy regulations or decisions (including the UK Extension to the EU-US Data Privacy Framework for certified providers) or on appropriate safeguards: the EU Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum. You can ask us for details at support@instabot.gr.
7. How long we keep it
- Account, brand and content data: while your account is open. After you close your account or ask us to delete it, we delete or anonymise it within 90 days.
- Earlier versions of edited posts: up to the latest 10 per post, while the post exists.
- Billing and tax records: 6 years after the end of the financial year they relate to, as required by UK law.
- Usage, security and AI-action logs: up to 24 months.
- Backups: deleted data may remain in encrypted backups for up to 35 days before being overwritten.
- We may keep data longer where needed to resolve disputes, enforce our terms or comply with law.
8. Security
We use appropriate technical and organisational measures, including encryption of data in transit (TLS), encryption of stored data by our cloud provider, access limited to people who need it, secret keys kept out of our code, and the official sign-in methods of the platforms you connect. No system is completely secure; if a breach affects your personal data in a way that creates a risk to you, we will inform you and the regulator as the law requires.
9. Your rights
You have the right to: access your personal data; correct it; delete it; restrict or object to its processing (including any processing based on legitimate interests, and at any time to direct marketing); receive it in a portable format; and withdraw consent at any time (without affecting earlier processing). To use any right, email support@instabot.gr from your account email. We reply within one month and may ask you to confirm your identity.
You can complain to the UK Information Commissioner’s Office (ico.org.uk). If you are in the EU you can also complain to your local authority — in Greece the Hellenic Data Protection Authority (www.dpa.gr). We would appreciate the chance to resolve your concern first.
10. Disconnecting and deleting your data
- Instagram/Facebook: disconnect in the app (Settings → Instagram), and you can also remove the app’s access in your Facebook settings (Settings & privacy → Business integrations). We stop publishing and reading statistics immediately.
- WordPress: switch SEO Blog off and revoke the application password in WordPress (Users → Profile).
- Delete your account and data: email support@instabot.gr with the subject “Delete my data” from your account email. We confirm by email and delete as described in section 7. This includes any data we received from Meta platforms.
11. Cookies and similar technologies
| Type | Examples | Why |
|---|---|---|
| Strictly necessary | Sign-in session cookies (__session, __client_uat), Copilot session, security and load-balancing cookies, Stripe fraud-prevention cookies on payment pages | Keep you signed in, secure the Service, take payments. Always on. |
| Preferences | Language, theme (light/dark), last view, Copilot conversation id (stored in your browser) | Remember your choices. |
| Advertising measurement | Google Ads conversion tag | Measure sign-ups from our ads. Only with your consent. |
You can block or delete cookies in your browser; strictly necessary ones are needed for the Service to work.
12. Children
The Service is for businesses and people aged 18 or over. We do not knowingly collect data about children.
13. Changes to this policy
We may update this policy. We will notify you by email or in the app of material changes before they take effect. The date at the top shows the latest version.
14. Contact
SmartyAI Ltd · Company no. 15254574 · 20 Wenlock Road, London, N1 7GU, United Kingdom
Email: support@instabot.gr