Last updated: April 12, 2026
Your data is yours. When you connect Instagram, we store your data in a private database that only you can access. We never sell, rent, or share your personal information with third parties for their own purposes.
Instagram access is secure. We connect through Instagram's official API using OAuth. We never ask for or store your Instagram password.
AI processes, not trains. We use AI to analyze your content and answer your questions. Your data is not used to train any AI models.
You can delete anytime. You can disconnect Instagram, delete your data, or close your account at any time from your account settings.
When you create an account, we collect your email address and name. Authentication is handled through Supabase Auth using secure, server-side sessions.
During onboarding, you may provide your content niche, Instagram handle, creator inspirations, and topic keywords. This helps us personalize your analytics experience.
We automatically collect standard usage data such as your IP address, browser type, device information, pages visited, and access times. This is used to maintain and improve the service.
When you use our AI assistant, your questions, uploaded documents, and AI responses are stored to provide the service. Conversations are isolated to your account — no other user can access them.
Payment processing is handled entirely by Stripe. We do not store your credit card number, CVV, or full billing details. We receive only a confirmation of your subscription status and a truncated card identifier from Stripe.
Marshmallow connects to Instagram through Meta's official Instagram API using the OAuth 2.0 protocol. When you authorize the connection, Instagram grants us a secure access token. We never see or store your Instagram password.
During the OAuth consent flow, we request the following Instagram Graph API permissions from you:
These permissions only grant access to your own connected Instagram professional account. We do not request, and cannot access, insights or private data for any other Instagram account.
Under the instagram_business_basic permission, we read the following fields from your own account via the Instagram Graph API:
For each of your own posts, we read the following media metadata:
Under the instagram_business_manage_insights permission, we read the following performance metrics for your own posts:
Your Instagram data is stored in a secure, encrypted database. It is associated exclusively with your account and is not accessible to any other user. We use this data solely to power your analytics dashboard and AI insights.
To generate the analytics, insights, and AI chat responses that Marshmallow provides, we transmit portions of your Instagram data — including post captions, hashtags, engagement metrics (views, likes, comments, saves, reach, shares), media metadata, and video transcripts — to our third-party AI service providers for real-time processing:
This transmission happens only when you use a feature that requires it (for example, opening an analytics breakdown, asking the AI chat a question, or triggering post analysis). Data is sent in real time, processed, and a response is returned — it is not used to train any AI model by Anthropic, OpenAI, or Marshmallow, per our data processing agreements with these providers. We do not send your Instagram data to any other third party for any other purpose.
You can disconnect your Instagram account at any time from your account settings. You can also revoke access directly from Instagram's settings under Apps and Websites. When you disconnect, we stop fetching new data. You may also request deletion of all stored Instagram data.
Marshmallow uses AI to analyze your Instagram content, generate performance insights, and answer your questions through our chat interface. This includes analyzing post captions, engagement metrics, video transcripts, and content patterns to produce hook breakdowns, script analysis, carousel reviews, and strategy recommendations.
Marshmallow transmits your Instagram post data and chat messages to the following third-party AI providers for real-time processing:
See the Instagram Data section above for the full list of Instagram fields we transmit to these providers.
Your Instagram data, chat conversations, and uploaded documents are not used to train any AI models — neither ours, nor Anthropic's, nor OpenAI's. Data is sent to AI providers only in real-time to generate responses, and is subject to data processing agreements that prohibit training use.
AI-generated insights and recommendations may contain inaccuracies. They are provided for informational purposes only and should not be treated as professional marketing, legal, or business advice.
We do not sell, rent, or share your personal information with third parties for their own marketing or commercial purposes.
We may share information only in these limited circumstances:
We use the following services to operate Marshmallow. Each processes data only as necessary to provide its specific function:
| Service | Purpose |
|---|---|
| Supabase | Authentication, database hosting, file storage |
| Stripe | Payment processing, subscription management |
| Anthropic | AI chat assistant, content analysis |
| OpenAI | Text embeddings for knowledge retrieval |
| Vercel | Application hosting, blob storage |
| Upstash | Redis caching |
| Inngest | Background job processing |
| Postmark | Transactional email delivery |
We implement industry-standard security measures to protect your information:
While we take reasonable measures to protect your data, no system is 100% secure. If we discover a data breach that affects your personal information, we will notify you and relevant authorities as required by law.
We retain your information only as long as necessary to provide the service:
| Data Type | Retention Period |
|---|---|
| Account data | While your account is active, plus 30 days after deletion |
| Instagram data | While connected, deleted upon disconnect or request |
| AI conversations | 90 days, or until you delete them |
| Uploaded documents | Until you delete them |
| Payment records | As required by tax law (up to 7 years) |
| Server logs | 90 days |
Depending on your location, you may have the following rights regarding your personal information:
To exercise any of these rights, contact us here. We will respond within 30 days.
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:
Categories of personal information we collect (per CCPA definitions): identifiers (name, email), commercial information (subscription data), internet activity (usage data), and professional information (content niche).
Marshmallow is not directed at children under 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on the service. We encourage you to review this policy periodically. The “Last updated” date at the top indicates when this policy was last revised.
If you have questions about this Privacy Policy or our data practices, contact us at:
Related policies