Privacy Policy

Last updated: June 29, 2026

KollabKey LLC ("KollabKey", "we", "us") provides the KollabKey creator-content performance tracking service to brand marketing teams. This policy explains what we collect, why, how long we keep it, and how to delete it. This page is maintained by KollabKey LLC and should be reviewed by qualified legal counsel before public launch.

Controller

KollabKey LLC is the data controller for personal data processed through the Service. You can contact us at the address in the Contact section below for any privacy questions or requests.

Legal basis for processing

• Contract — to create your account, provide the Service, and deliver features you request (Article 6(1)(b) GDPR).
• Consent — for connecting your Instagram Professional account and syncing media/insights (Article 6(1)(a) GDPR). You can withdraw consent at any time by disconnecting Instagram.
• Legitimate interests — to secure the Service, prevent fraud and abuse, debug, and improve product quality (Article 6(1)(f) GDPR).
• Legal obligation — to keep billing, tax, and accounting records for the periods required by law (Article 6(1)(c) GDPR).

Who we collect data about

• Brand users — the people who create a KollabKey account to run campaigns.
• Creators — invited by a brand, who connect their Instagram Professional (Business or Creator) account.

What we collect from brands

• Account email, name, and authentication metadata.
• Brand name, website, and campaign details you enter.
• Tracking-link destinations and aggregated click counts.
• Billing information required to process paid subscriptions (billing name, billing address, VAT/tax ID, plan, order history). Payment card details are collected and processed directly by our payment provider Paddle (see Subprocessors below) — KollabKey never sees or stores full card numbers.

What we collect from creators

• Account email and authentication metadata.
• Display name, handle, and profile image.
• With your explicit consent at OAuth time, data from your Instagram Professional account via the Instagram Graph API:
  • Instagram account ID, username, account type, profile image.
  • Posts, reels, carousels, and stories: caption, permalink, media URL, thumbnail, published timestamp, and media type.
  • Per-media insights: views, reach, likes, comments, shares, saves, replies, and other metrics returned by Instagram.
• A long-lived Instagram access token (rotated every ~60 days) and its expiry, used solely to perform the syncs you authorized.

Permissions we request from Instagram

Meta's App Review groups several permissions together, so KollabKey must request the following scopes during the Instagram OAuth flow. We list each one below, along with what we currently use it for:

• instagram_business_basic — identify your Instagram Professional account and fetch your media.
• instagram_business_manage_insights — fetch per-post, reel, and story performance metrics.
• instagram_business_manage_comments — requested because Meta requires this permission as part of the same review group. KollabKey does not read, create, or manage comments on your behalf.
• instagram_business_content_publish — requested because Meta requires this permission as part of the same review group. KollabKey does not publish, schedule, or edit Instagram content from your account.

Today, KollabKey only uses the read-only media and insights permissions listed above to build creator scorecards and campaign reports. We do not use messaging, comment-management, or publishing features in the current app.

Why we collect it

• To show brands which creators and content performed best.
• To build Creator Scorecards used to decide who to rehire.
• To attribute clicks from tracking links you generate.

How we store it

Data is stored in a managed Postgres database hosted on Supabase (AWS infrastructure). Access from our application is constrained by Row Level Security policies so brands can only see data for campaigns they own, and creators can only see their own data.

Subprocessors

• Supabase — database, authentication, storage.
• Cloudflare — application hosting and edge runtime.
• Meta / Instagram — source of Instagram media and insights.
• Paddle.com Market Limited ("Paddle") — our payment processor and Merchant of Record for all paid subscriptions. Paddle receives billing name, email, billing address, tax/VAT information, IP address, and payment card details in order to process transactions, calculate and remit sales tax/VAT, issue invoices, handle refunds, and detect payment fraud. See Paddle's privacy policy for details.

Payments and Merchant of Record

When you purchase a paid subscription, your order is processed by Paddle.com Market Limited, which acts as the Merchant of Record and reseller of the Service. Paddle is an independent data controller for the billing data it collects to complete your purchase, comply with tax law, and prevent fraud. KollabKey receives a limited record of the transaction (plan, amount, status, subscription and customer identifiers) to activate and manage your subscription.

Retention and deletion

• Disconnect Instagram: clears your access token and account identifiers from your KollabKey creator profile. Historical synced content remains so brands keep their campaign reports intact.
• Delete account or request data deletion: removes your synced Instagram media, metrics, and tokens. Submit at the data-deletion URL below or by removing the KollabKey app from your Instagram account; Meta will send us a deletion request and we will process it.
• Backup snapshots and database write-ahead logs may retain deleted rows for up to 30 days before they age out.

How to request deletion

• From inside KollabKey: Creator dashboard → Disconnect Instagram, then contact us to delete the historical sync data.
• From Instagram: Settings → Apps and Websites → Remove KollabKey. Meta will notify our data-deletion endpoint and we will purge your Instagram-derived data.
• Status page: /data-deletion-status.

Your rights

You can request access, correction, or deletion of your personal data at any time by contacting us at the email below.

Contact

Questions or requests: privacy@kollabkey.com
KollabKey LLC.