Privacy Policy

Creators who join the list or connect an Instagram account. Brands who enquire or buy a campaign. Visitors to a creator's public page.

Name, Instagram handle, phone number, district and area

Given by you when you join. Used to match you to campaigns in your area and to message you about work.

The niches you pick

So a brand looking for food creators in Kakkanad finds you and not someone else.

Instagram post insights — views, reach, likes, comments, shares — and your follower count

Read from Instagram only after you connect your account, and only with your permission. This is what lets us guarantee a brand a real number instead of a promise.

Your posts' captions, permalinks and timestamps

To identify which post belongs to which campaign, and to work out what you usually post about.

Campaign history and payments — what you delivered, what you were paid, when

To pay you correctly and to keep the financial records Indian law requires us to keep.

Business name and contact details (brands)

To respond to an enquiry, run a campaign and raise a GST invoice.

• We never post anything to your account.
• We never ask for your Instagram password. We use Instagram's own login.
• We never read or send your direct messages.
• We never sell your phone number or your data to anybody.
• We never show a brand your handle before a booking is agreed — during a live campaign they see your area, niche and tier, and nothing that identifies you.
• We take nothing from your own product sales. If you sell something of your own through Inflok, 100% of it is yours.

We process your personal data on the basis of the consent you gave when you joined, under India's Digital Personal Data Protection Act, 2023. That consent is stored as a record — the exact wording you agreed to, the version of it, and when.

You can withdraw it at any time at inflok.com/privacy. Withdrawal is immediate: we stop matching you to campaigns straight away. It is as easy to withdraw as it was to give — no phone call, no reason required, no retention offer.

Any campaign already running is finished and paid. We do not drop work you have already done.

When you connect Instagram, we ask for one permission: instagram_business_basic. It is read-only. It lets us see your profile and the insights on your posts.

We store what Instagram reports at the moment we read it, because Instagram's own insights window is short and a figure that is not captured is gone. Those stored readings are what a payment is calculated from, so they are kept for as long as the payment record is.

Your access token is encrypted before it is stored, is never written to a log, and is never included in a data export. Disconnecting your account, or revoking Inflok from Instagram's own settings, stops all further reading immediately.

Contact details and profile

Until you withdraw consent.

Post insights and campaign records

Kept while a campaign is running and for as long as the related payment record must be kept.

Payment records and invoices

Eight years, because Indian tax law requires it. This is the one category we cannot delete on request.

Consent records

Kept as evidence of what you agreed to, including after withdrawal.

Meta (Instagram) — because that is where the insights come from. Our hosting and payment providers — to run the service and to pay you. Brands — only your area, niche and tier during a live campaign, and your handle only once a booking is agreed. Our accountants and the tax authorities — the financial records, where the law requires it.

We do not sell data. We do not share it for anyone else's advertising.

On servers in India. Your data does not leave the country except where a service we depend on — Instagram, for example — operates globally.

Under the DPDP Act you can:

• Get a copy of everything we hold about you — one file, immediately, at inflok.com/privacy.
• Correct anything wrong. Message us and we will fix it.
• Withdraw consent and have us stop, on the same page.
• Have it erased, other than the financial records we are legally required to keep.
• Complain to us first, and to the Data Protection Board of India if we do not sort it out.

If something about your data is wrong or worrying you, write to privacy@inflok.com and we will respond within thirty days, which is what the DPDP Act requires of us. In practice we aim for the same week.

Postal address: Veedo — The Studio, Kochi, Kerala, India.

Inflok is not for anyone under 18. We do not knowingly hold data about children. If you believe we have, write to us and we will delete it.

Instagram access tokens are encrypted at rest. Measurement records are append-only — they cannot be edited after the fact, by us or by anyone else. Administrative access is restricted and every administrative action is logged to a record that cannot be altered.

If we change what we collect or why, we update this page, raise the notice version, and ask for consent again where the law requires it. The version you agreed to is recorded against your account, so an old agreement is never silently replaced by a new one.