Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, use our services, or contact us for support. This may include your name, email address, and any other information you choose to provide.

1.1 Information Collected Automatically

When you use our services, we automatically collect certain information about your device and usage, including:

• Browser information (type, version, language settings)
• Server information (IP address, device identifiers)
• Usage information (pages visited, features used, time spent)
• Cookies and similar tracking technologies

1.2 Information from Third-Party Services

When you connect your Instagram account or Facebook Page through our service, we collect information from Meta (Facebook) and Instagram via their APIs with your explicit consent. This includes:

• Instagram Business Account Information: Account ID, username, account type, and basic profile information (collected via instagram_business_basic permission)
• Instagram Messages: Inbound and outbound direct messages, including message content, sender information, timestamps, and message IDs (collected via instagram_business_manage_messages permission)
• Instagram Content Publishing: The media (images and videos), captions, and scheduling details you create in Inexra to publish posts to your connected Instagram Business Account on your behalf (collected via instagram_business_content_publish permission)
• Facebook Page Information: Page ID, page name, and page access tokens (collected via pages_show_list permission)
• Facebook Page Messages: Inbound and outbound Messenger conversations for your connected Page, including message content, sender information, timestamps, and message IDs (collected via pages_messaging permission)
• Facebook Page Content and Engagement: Posts, photos, videos, and related metadata and insights published by your Page (collected via pages_read_engagement and pages_manage_metadata permissions, the latter of which also lets us receive webhook notifications about Page activity)
• Facebook Page Publishing: The content, images, and scheduling details you create in Inexra to publish posts to your connected Page on your behalf (collected via pages_manage_posts permission)
• Conversation Data: Conversation participants, message threads, and related metadata
• Sender Information: Instagram and Facebook user IDs, usernames, and display names of users who send messages to your connected accounts
• Story Mentions: When someone mentions your connected Instagram account in their story, Instagram sends you a message containing that story. We save a copy of the story's image or video so you can ask the person for permission and share it before the story expires. Saved copies are deleted 30 days after they are saved, or when you disconnect the Instagram account, unless you have used the copy in a post you created in Inexra.

We only collect this information after you explicitly grant permission through the Meta OAuth authorization flow. You can revoke these permissions at any time by disconnecting your Instagram account or Facebook Page in your account settings.

Information from Canva

When you connect your Canva account, we read information from Canva via their Connect API with your explicit consent. Our access is read-only: we never create, modify, or delete anything in your Canva account. This includes:

• Design Metadata: Design titles, thumbnails, and page counts, so you can browse and search your own designs and choose which to import (collected via design:meta:read permission)
• Exported Design Images: Image files exported from the specific designs you select for import, which become the media attached to your social posts (collected via design:content:read permission)
• Folder Contents: The list of designs inside a folder, so you can import a whole campaign folder at once (collected via folder:read permission)
• Account Display Name: The display name, user ID, and team ID of the connected Canva account, read once at connection time and used only to label which account is linked in your settings (collected via profile:read permission)

Canva access and refresh tokens are encrypted at rest before storage. Exported images are stored in a private cloud storage bucket that blocks public access, and are served only through short-lived signed URLs. We do not read designs you have not selected, and we do not access designs on any schedule: exports happen only when you choose designs and start an import.

We only collect this information after you explicitly grant permission through the Canva OAuth authorization flow. You can disconnect at any time in your account settings. When you disconnect, we revoke the tokens with Canva and delete the stored connection immediately.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Provision: To provide, maintain, and improve our services, including message management, conversation organization, and AI-powered features
• Messaging: To receive, process, store, and send Instagram direct messages and Facebook Messenger messages on your behalf when you connect your Instagram Business Account or Facebook Page
• Content Publishing: To create, schedule, and publish posts to your connected Instagram Business Account and Facebook Page on your behalf
• Message Processing: To analyze message content using AI for sentiment analysis, priority scoring, tag suggestions, and reply generation
• Conversation Management: To group messages into conversations, identify message senders, and organize your inbox
• Account Management: To recognize you when you return to our service, maintain your account preferences, and provide personalized features
• Communication: To send you technical notices, support messages, and respond to your inquiries
• Marketing: To communicate with you about products, services, and promotional offers (only if you opt-in)
• Analytics: To understand how our services are used, identify trends, and improve user experience
• Security: To detect, prevent, and address technical issues, fraud, or security threats

2.1 Processing of Instagram and Facebook Data

When you connect your Instagram account or Facebook Page, we process data from Meta's platforms for the following specific purposes:

• Message Reception: We receive webhook notifications from Meta when new messages arrive at your connected Instagram Business Account or Facebook Page
• Message Storage: We store message content, metadata, and sender information in our secure database to provide you with a unified inbox
• Message Sending: We send replies to Instagram and Facebook Messenger messages on your behalf using Meta's Messaging APIs
• Content Publishing: When you create a post in Inexra, we send the media, captions, and scheduling details to Meta to publish the post to your connected Instagram Business Account or Facebook Page on your behalf
• Sender Identification: We use Instagram and Facebook user IDs and usernames to identify and display message senders in your inbox
• AI Enhancement: We analyze message content using AI to provide sentiment analysis, priority scoring, and suggested replies

All processing of Instagram and Facebook data is done in accordance with Meta's Platform Terms and our agreement with you. We do not share your Instagram or Facebook messages or account information with third parties except as described in Section 3 below.

3. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except as described in this policy. We may share your information in certain limited circumstances, such as with service providers who assist us in operating our platform.

3.1 Requests from Public Authorities

We may be required to disclose personal information in response to valid legal requests from public authorities, including law enforcement agencies, courts, or government entities. Our policies regarding such requests include:

• Legal Review: We review all requests from public authorities to ensure they are legally valid and comply with applicable laws and regulations.
• Challenging Unlawful Requests: We reserve the right to challenge any request that we believe is unlawful, overly broad, or not properly authorized. We will seek to narrow the scope of requests when appropriate.
• Data Minimization: When responding to valid legal requests, we disclose only the minimum amount of information necessary to comply with the request and applicable law.
• Documentation: We maintain records of requests from public authorities, including the nature of the request, the legal basis, the information disclosed (if any), and our response. We document our legal reasoning and the actors involved in processing such requests.

We will notify users of requests for their personal information when legally permitted and not prohibited by law or court order. We are committed to protecting user privacy while complying with valid legal obligations.

4. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and use personal information about you. You can control cookies through your browser settings, but disabling cookies may affect the functionality of our service.

6. Marketing Communications

If you opt-in to receive marketing communications, we may send you emails about our products, services, and promotional offers. You can unsubscribe from these communications at any time by clicking the unsubscribe link in our emails or contacting us directly.

7. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

Copies of stories that mention your Instagram account are kept for 30 days and then deleted, and are deleted sooner if you disconnect that account. A copy you have used in a post is kept with that post.

8. Your Rights

Depending on your location, you may have certain rights regarding your personal information, including the right to access, update, or delete your information. You may also have the right to object to or restrict certain processing of your information.

9. Third-Party Services

Our service integrates with third-party services, including:

• Meta (Facebook/Instagram): When you connect your Instagram account or Facebook Page, we use Meta's APIs to access your Instagram Business Account and Facebook Page information, messages, and content, and to publish posts on your behalf. Your use of Meta's services is subject to Meta's Privacy Policy and Platform Terms. We only access data you explicitly authorize through the OAuth consent flow.
• Other Third-Party Services: Our service may contain links to other third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any personal information.

10. Children's Privacy

Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure that such transfers comply with applicable data protection laws and implement appropriate safeguards to protect your information.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

13. Data Deletion Requests

You have the right to request deletion of your personal information, including data collected from Instagram and Facebook. To request deletion of your data:

• Email: Send a request to hello@inexra.com with the subject line "Data Deletion Request"
• Account Settings: You can disconnect your Instagram account or Facebook Page in Settings → Integrations, which will stop new data collection for that connection
• Account Deletion: You can delete your entire account in Settings → Account, which will permanently delete all associated data

For step-by-step instructions, see our Data Deletion Instructions. When you request data deletion, we will:

• Delete all messages and conversation data stored in our systems
• Remove your Instagram and Facebook account connections and associated tokens
• Delete your account information and preferences
• Remove your data from our analytics and reporting systems

Please note that some information may be retained for legal or regulatory purposes (e.g., transaction records) as required by law. We will respond to your deletion request within 30 days.

14. Contact Us

If you have any questions about this privacy policy or our data practices, please contact us:

• Email: hello@inexra.com
• Data Deletion Requests: hello@inexra.com (subject: "Data Deletion Request")
• Support Channels: Available through our in-app support system