Last updated: September 17, 2026 — KWALEAD SAS, France
KWALEAD SAS, a simplified joint-stock company with a capital of €6,000, registered with the RCS of Créteil under number B 813 823 192, with its registered office at 8 rue d'Estiennes d'Orves, 94000 Créteil (France), publisher of the InfluenceOS service, acts as the data controller. For any questions regarding your personal data, please contact our DPO at: privacy@influenceos.fr.
We collect data strictly necessary for the service: email address, full name, public Instagram profile data (bio, follower count, engagement stats), public post content, aggregated audience data. This data is collected via Apify (MVP phase) or the Meta Graph API (production phase after approval). No sensitive data as defined by GDPR is collected. When you are logged in, we also record the days you use your space and the sections you open within it (e.g., "Audience" or "Rates"): not your clicks, nor the time, nor the duration spent, nor the details of content viewed, nor your IP address.
Your data is processed for: (1) Providing analytics and monetization services (legal basis: contract execution / T&Cs); (2) Calculating the AI Score and generating media kits (legal basis: contract execution); (3) Product improvement and anonymized statistical analyses (legal basis: legitimate interest); (4) Sending transactional and summary emails (legal basis: contract execution); (5) Sending marketing communications (legal basis: consent); (6) Understanding your space usage (days visited and sections opened) to improve the service and better assist you (legal basis: legitimate interest). You can disable this tracking at any time in Settings → Account & Data: the history already recorded will then be erased. (7) Measuring the effectiveness of our ads displayed in ChatGPT: reporting trial start and first payment to OpenAI (legal basis: legitimate interest), along with advertising identifiers and your hashed email address only if you have accepted cookies (legal basis: consent).
Your data is kept for the entire duration of your active subscription, then for 3 years after termination to meet our legal obligations (accounting, disputes). Technical log data is deleted after 12 months. The log of your visit days and sections opened is kept for 12 months then automatically erased; it is erased immediately if you disable tracking or delete your account. You can request early deletion of your data from your account space.
All data is hosted in Europe: PostgreSQL database on Supabase (EU Frankfurt region), files on Supabase Storage, application on Vercel (CDG1 Paris region). Instagram access tokens are encrypted with AES-256 in the database and never transmitted in clear text. Communications are encrypted with TLS 1.3.
We use the following sub-processors, all with adequate GDPR guarantees: Supabase Inc. (data storage, Frankfurt); Vercel Inc. (hosting, Paris CDG1); Stripe Inc. (payments, Privacy Shield/SCCs); Brevo (transactional emails); Apify Technologies (public Instagram data scraping); Upstash Inc. (Redis cache); OpenAI (measuring the effectiveness of our ads displayed in ChatGPT: trial start and first payment, with your hashed email address only if you have accepted cookies).
In accordance with GDPR (EU Regulation 2016/679), you have the following rights: access to your data, rectification, erasure ('right to be forgotten'), portability (JSON/CSV export), objection to processing, restriction of processing, withdrawal of consent at any time. To exercise these rights, contact privacy@influenceos.fr. You also have the right to lodge a complaint with the CNIL (www.cnil.fr).
InfluenceOS uses essential cookies for operation (login, language), InfluenceOS-specific cookies that record the origin of your visit, cookie-less audience measurement (Vercel), and, only with your agreement, Google Analytics. Also, only with your agreement, OpenAI's pixel measures the effectiveness of our ads displayed in ChatGPT. The details and duration of each cookie are listed in our cookie policy.
When you connect your professional Instagram account (Creator or Business) to InfluenceOS, authorization is done directly on Instagram: no Facebook Page is required and no password is transmitted to us. We collect: Instagram ID (ig_user_id), username, full name, profile picture, bio, follower/following/post count, list of recent posts (media, captions, dates), engagement metrics per post (likes, comments), aggregated insights (reach, impressions, engagement — aggregated and anonymized), statistics of your stories collected during their 24-hour lifespan (views, reach, replies, clicks, navigation — aggregated figures). If you use automatic promo codes or comment management, we read comments left on your posts (text, author's ID and username) and, only at your request or according to the rules you have created, we post replies, hide or delete comments, and send a private message to their author on your behalf (one per comment, as required by Instagram). We keep the list of sent messages (username, date, status) as long as the rule exists. We DO NOT COLLECT: your follower/following list, the content of your private message inbox (DMs), your Meta advertising data, nor any Facebook Page data. The Meta access token is AES-256-GCM encrypted in the database and stored on Vercel servers in Europe (cdg1 Paris). You can revoke access at any time from Instagram (Settings › Apps and Websites) (the InfluenceOS app is then removed and all your Instagram data with us is automatically deleted within 24 hours via the compliant Meta Data Deletion callback), or via the “Disconnect” button in Settings > Instagram. Deletion status can be checked at /legal/data-deletion-status.