Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, use our services, or contact us for support. This may include your name, email address, and any other information you choose to provide.

1.1 Information Collected Automatically

When you use our services, we automatically collect certain information about your device and usage, including:

• Browser information (type, version, language settings)
• Server information (IP address, device identifiers)
• Usage information (pages visited, features used, time spent)
• Cookies and similar tracking technologies

1.2 Information from Third-Party Services

When you connect your Instagram account or Facebook Page through our service, we collect information from Meta (Facebook) and Instagram via their APIs with your explicit consent. This includes:

• Instagram Business Account Information: Account ID, username, account type, and basic profile information (collected via instagram_business_basic permission)
• Instagram Messages: Inbound and outbound direct messages, including message content, sender information, timestamps, and message IDs (collected via instagram_business_manage_messages permission)
• Instagram Content Publishing: The media (images and videos), captions, and scheduling details you create in Inexra to publish posts to your connected Instagram Business Account on your behalf (collected via instagram_business_content_publish permission)
• Facebook Page Information: Page ID, page name, and page access tokens (collected via pages_show_list permission)
• Facebook Page Messages: Inbound and outbound Messenger conversations for your connected Page, including message content, sender information, timestamps, and message IDs (collected via pages_messaging permission)
• Facebook Page Content and Engagement: Posts, photos, videos, and related metadata and insights published by your Page (collected via pages_read_engagement and pages_manage_metadata permissions, the latter of which also lets us receive webhook notifications about Page activity)
• Facebook Page Publishing: The content, images, and scheduling details you create in Inexra to publish posts to your connected Page on your behalf (collected via pages_manage_posts permission)
• Conversation Data: Conversation participants, message threads, and related metadata
• Sender Information: Instagram and Facebook user IDs, usernames, and display names of users who send messages to your connected accounts
• Story Mentions: When someone mentions your connected Instagram account in their story, Instagram sends you a message containing that story. We save a copy of the story's image or video so you can ask the person for permission and share it before the story expires. Saved copies are deleted 30 days after they are saved, or when you disconnect the Instagram account, unless you have used the copy in a post you created in Inexra.

We only collect this information after you explicitly grant permission through the Meta OAuth authorization flow. You can revoke these permissions at any time by disconnecting your Instagram account or Facebook Page in your account settings.

Information from Canva

When you connect your Canva account, we read information from Canva via their Connect API with your explicit consent. Our access is read-only: we never create, modify, or delete anything in your Canva account. This includes:

• Design Metadata: Design titles, thumbnails, and page counts, so you can browse and search your own designs and choose which to import (collected via design:meta:read permission)
• Exported Designs: Image or video files exported from the specific designs you select for import, which become the media attached to your social posts (collected via design:content:read permission)
• Folder Contents: The list of designs inside a folder, so you can import a whole campaign folder at once (collected via folder:read permission)
• Account Display Name: The display name, user ID, and team ID of the connected Canva account, read once at connection time and used only to label which account is linked in your settings (collected via profile:read permission)

Canva access and refresh tokens are encrypted at rest before storage. Exported files are stored in a private cloud storage bucket that blocks public access, and are served only through short-lived signed URLs. We do not read designs you have not selected, and we do not access designs on any schedule: exports happen only when you choose designs and start an import.

We only collect this information after you explicitly grant permission through the Canva OAuth authorization flow. You can disconnect at any time in your account settings. When you disconnect, we revoke the tokens with Canva and delete the stored connection immediately.

Information from YouTube

Inexra uses YouTube API Services to connect a YouTube channel. When you connect one, you sign in with Google and choose the channel, and we read the following through the YouTube Data API and the YouTube Analytics API with your explicit consent:

• Channel Details: The channel's ID, name, handle, picture and subscriber count, used to label the connection and to show audience growth
• Your Videos: The titles, descriptions, thumbnails, publish dates and view, like and comment counts of the videos and Shorts on the channel, so they appear in your analytics and reports
• Comments: Comments and replies on your videos, with each commenter's display name, channel ID and picture, so you can read and answer them in your inbox
• Channel Statistics: If you leave the statistics permission ticked, the shares and new subscribers each video brought, daily channel views, and the age, gender and country mix of your viewers. YouTube provides the audience figures only as totals and percentages, never about an identifiable viewer

Google access and refresh tokens are encrypted at rest before storage. We only collect this information after you grant permission on Google's consent screen. Google's own privacy policy, at policies.google.com/privacy, describes how Google handles your data.

You can disconnect a channel at any time in Settings → Integrations → YouTube, which deletes the stored tokens and stops all collection. You can also remove Inexra's access from your Google account at myaccount.google.com/permissions.

Information from LinkedIn

Inexra uses LinkedIn's Community Management API to connect a LinkedIn Company Page. When you connect one, you sign in with your own LinkedIn account and choose a Page you administer, and we read the following with your explicit consent:

• Your Pages: Which Company Pages you can post to and your role on each, and the name and web address of the Page you choose, used to label the connection
• The Page's Posts: The text, images and publish dates of the Page's posts, and how many views, reactions, comments, reposts and clicks each one had, so they appear in your analytics and reports
• Page Statistics: The Page's follower count and its daily views, as totals only
• Comments: The text of comments on the Page's posts, so you can read and answer them in your inbox. We do not collect or store the names, photos or profiles of the people who wrote them

We do not read your personal LinkedIn profile, your connections or your messages, and we do not use anything from LinkedIn to build contact records, lead lists or advertising audiences.

We keep LinkedIn data only as long as LinkedIn's terms allow:

• A comment written by a LinkedIn member is deleted from Inexra after 48 hours
• The text and images of a Page's posts, as read from LinkedIn, after six months
• Page and post statistics after one year

Posts you write in Inexra are your own content and stay until you delete them. LinkedIn access and refresh tokens are encrypted at rest before storage.

You can disconnect a Page at any time in Settings → Integrations → LinkedIn, which deletes the stored tokens and stops all collection. You can also remove Inexra's access in your LinkedIn settings under Data privacy, then Permitted services.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Provision: To provide, maintain, and improve our services, including message management, conversation organization, and AI-powered features
• Messaging: To receive, process, store, and send Instagram direct messages and Facebook Messenger messages on your behalf when you connect your Instagram Business Account or Facebook Page
• Content Publishing: To create, schedule, and publish posts to your connected Instagram Business Account and Facebook Page on your behalf
• Message Processing: To analyze message content using AI for sentiment analysis, priority scoring, tag suggestions, and reply generation
• Conversation Management: To group messages into conversations, identify message senders, and organize your inbox
• Account Management: To recognize you when you return to our service, maintain your account preferences, and provide personalized features
• Communication: To send you technical notices, support messages, and respond to your inquiries
• Marketing: To communicate with you about products, services, and promotional offers (only if you opt-in)
• Analytics: To understand how our services are used, identify trends, and improve user experience
• Security: To detect, prevent, and address technical issues, fraud, or security threats

2.1 Processing of Instagram and Facebook Data

When you connect your Instagram account or Facebook Page, we process data from Meta's platforms for the following specific purposes:

• Message Reception: We receive webhook notifications from Meta when new messages arrive at your connected Instagram Business Account or Facebook Page
• Message Storage: We store message content, metadata, and sender information in our secure database to provide you with a unified inbox
• Message Sending: We send replies to Instagram and Facebook Messenger messages on your behalf using Meta's Messaging APIs
• Content Publishing: When you create a post in Inexra, we send the media, captions, and scheduling details to Meta to publish the post to your connected Instagram Business Account or Facebook Page on your behalf
• Sender Identification: We use Instagram and Facebook user IDs and usernames to identify and display message senders in your inbox
• AI Enhancement: We analyze message content using AI to provide sentiment analysis, priority scoring, and suggested replies

All processing of Instagram and Facebook data is done in accordance with Meta's Platform Terms and our agreement with you. We do not share your Instagram or Facebook messages or account information with third parties except as described in Section 3 below.

2.2 Processing of YouTube Data

When you connect a YouTube channel, we use the data described above, and act on the channel, only for these purposes:

• Publishing: When you schedule a video or Short in Inexra, we upload the file with the title, description, tags, thumbnail and visibility you chose, and post a first comment if you wrote one
• Managing Published Videos: When you ask us to, we change a published video's description or delete the video
• Comments: We show comments in your inbox and, when you choose to, post your reply, hold a comment for review, or remove it
• Analytics and Reports: We show how your videos and channel perform, inside Inexra and in the reports you create
• AI Assistance: If AI is turned on for the workspace, comment text and your captions may be sent to our AI provider to suggest replies and summaries, as described in Section 9

Inexra's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not sell YouTube data, we do not use it for advertising, we do not use it to train general-purpose AI models, and nobody at Inexra reads it except to provide support you asked for, for security, or to comply with the law.

3. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except as described in this policy. We may share your information in certain limited circumstances, such as with service providers who assist us in operating our platform.

3.1 Requests from Public Authorities

We may be required to disclose personal information in response to valid legal requests from public authorities, including law enforcement agencies, courts, or government entities. Our policies regarding such requests include:

• Legal Review: We review all requests from public authorities to ensure they are legally valid and comply with applicable laws and regulations.
• Challenging Unlawful Requests: We reserve the right to challenge any request that we believe is unlawful, overly broad, or not properly authorized. We will seek to narrow the scope of requests when appropriate.
• Data Minimization: When responding to valid legal requests, we disclose only the minimum amount of information necessary to comply with the request and applicable law.
• Documentation: We maintain records of requests from public authorities, including the nature of the request, the legal basis, the information disclosed (if any), and our response. We document our legal reasoning and the actors involved in processing such requests.

We will notify users of requests for their personal information when legally permitted and not prohibited by law or court order. We are committed to protecting user privacy while complying with valid legal obligations.

4. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and use personal information about you. You can control cookies through your browser settings, but disabling cookies may affect the functionality of our service.

Non-essential cookies load only after you accept them in the cookie banner. On our public website (not inside the app) accepting also loads the Meta Pixel, which lets us show Inexra ads on Facebook and Instagram to people who visited, and Apollo's website visitor tracker, which tells us which companies visited so we can follow up. If you reject, neither loads.

6. Marketing Communications

If you opt-in to receive marketing communications, we may send you emails about our products, services, and promotional offers. You can unsubscribe from these communications at any time by clicking the unsubscribe link in our emails or contacting us directly.

7. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

Copies of stories that mention your Instagram account are kept for 30 days and then deleted, and are deleted sooner if you disconnect that account. A copy you have used in a post is kept with that post.

YouTube data is kept while the channel stays connected and is refreshed from YouTube regularly. When you disconnect a channel, what we stored from it (your videos, their statistics and comments, and the channel's details) is deleted automatically within 7 days. Reconnecting the same channel before then keeps it.

8. Your Rights

Depending on your location, you may have certain rights regarding your personal information, including the right to access, update, or delete your information. You may also have the right to object to or restrict certain processing of your information.

9. Third-Party Services

Our service integrates with third-party services, including:

• Meta (Facebook/Instagram): When you connect your Instagram account or Facebook Page, we use Meta's APIs to access your Instagram Business Account and Facebook Page information, messages, and content, and to publish posts on your behalf. Your use of Meta's services is subject to Meta's Privacy Policy and Platform Terms. We only access data you explicitly authorize through the OAuth consent flow.
• AI processing (Anthropic): Inexra's AI features (automatic message tagging, sentiment and priority, reply drafts, conversation summaries, captions and hashtags, insights and reports, pipeline and storefront pre-fill, and the Inexra AI assistant) use Claude, a model made by Anthropic, PBC. To provide them we send Anthropic what each feature needs: the text of the relevant messages, comments and post captions and the names or usernames of the people who wrote them; examples of your workspace's past replies, so drafts match your brand voice; the deal or storefront details being filled in; what you type to the AI assistant; and, for captions and hashtags, the images you choose. Under Anthropic's commercial terms, Anthropic uses this to return a result to us, may keep it for a limited time for safety and abuse monitoring, and does not use it to train its models. A workspace created on or after October 1, 2026 sends nothing until an owner or admin allows AI for it. Workspaces that already existed then keep AI on, and their owners and admins are told once in the app. In every workspace AI can be turned off any time in Settings › AI, after which nothing from that workspace is sent.
• AI apps you connect: You can connect Inexra to an AI app of your choice, such as Claude or ChatGPT, in Settings › Connected AI apps. Nothing is shared until you sign in to Inexra from that app and approve it. A connected app can then read what you can see in Inexra (messages, comments, contacts, the pipeline, posts and their results, the content plan, reports and brand voice), only for workspaces you can open that are on a paid plan and have AI turned on. If you allow it, it can also prepare actions such as a reply or a deal change, which wait in Inexra until someone confirms them. What that app does with the data is governed by its own terms and privacy policy, not ours. You can disconnect an app at any time in Settings, which stops its access immediately.
• Service providers: We use these companies to run Inexra, each only for the purpose listed: Anthropic (AI processing, above); Amazon Web Services (storing uploaded media); Vercel (hosting, and website analytics only if you accept analytics cookies); Neon (database hosting); Upstash (caching and rate limits); Inngest (background jobs); SendGrid (email); Stripe (payments, on our website); Sentry (error reports); Meta and Apollo (advertising and visitor insights on our public website, only if you accept cookies); Google and Apple (when you choose to sign in with them; Apple also delivers notifications to the iPhone app); YouTube, through YouTube API Services (only when you connect a channel); Canva and Briklyst (only when you connect them).
• Other Third-Party Services: Our service may contain links to other third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any personal information.

10. Children's Privacy

Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure that such transfers comply with applicable data protection laws and implement appropriate safeguards to protect your information.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

13. Data Deletion Requests

You have the right to request deletion of your personal information, including data collected from Instagram, Facebook and YouTube. To request deletion of your data:

• Email: Send a request to hello@inexra.com with the subject line "Data Deletion Request"
• Account Settings: You can disconnect your Instagram account, Facebook Page or YouTube channel in Settings → Integrations, which will stop new data collection for that connection
• Account Deletion: You can delete your entire account in Settings → Account, which will permanently delete all associated data

For step-by-step instructions, see our Data Deletion Instructions. When you request data deletion, we will:

• Delete all messages and conversation data stored in our systems
• Remove your Instagram, Facebook and YouTube connections and associated tokens
• Delete your account information and preferences
• Remove your data from our analytics and reporting systems

Please note that some information may be retained for legal or regulatory purposes (e.g., transaction records) as required by law. We will respond to your deletion request within 30 days.

14. Contact Us

If you have any questions about this privacy policy or our data practices, please contact us:

• Email: hello@inexra.com
• Data Deletion Requests: hello@inexra.com (subject: "Data Deletion Request")
• Support Channels: Available through our in-app support system