Privacy Policy

With your explicit authorization through the Instagram connection, and only for the account you connect, we read:

The Instagram access token is stored encrypted. Each comment author's handle is pseudonymized by hashing as a stable, non-reversible identity key. The real handle is also stored encrypted for a limited 180-day retention period, decrypted server-side only for operator display so loyal followers can be recognized, and automatically purged at expiry in accordance with GDPR data minimization.

When you create an account, or accept an invitation to join a team, we keep:

• your email address and the name you give us;
• your password, stored only as a one-way hash: nobody, us included, can read it back;
• if you sign in with Google or Facebook, the identity that provider shares with us: your account ID there, your name and your email;
• sign-in security data: the counters that slow down repeated sign-in attempts, and a record of your sessions;
• the date you accepted the Terms and this policy, and which version you accepted.

We use it to run your account: signing you in, sending the emails your account needs (confirmations, password resets, invitations) and letting you work in the teams you belong to. It is necessary to provide the service you signed up for. We keep it until you delete your account; it is then erased as described on our Data deletion page.

When you ask for an invitation, we keep your email address, your name, your Instagram handle and the note you write, if you give them. We use them only to review your request. We keep a request for 180 days at most, and delete it as soon as an invitation to that address is accepted.

This data is used only to propose reply drafts for the creator to review. Processing is based on your consent, which you may withdraw at any time.

Instagram data is kept only as long as strictly necessary to provide the service and within the defined retention period, then minimized or deleted. Account and waitlist data follow the periods given in their sections above.

We do not sell your data, and we do not use it to train third-party models. A few service providers process it on our behalf, only to do their part:

• Resend, our transactional email provider, sends the emails your account needs (confirmations, password resets, invitations);
• Google or Facebook, only if you choose to sign in with them, confirm your identity to us.

You may request access, correction or deletion and may withdraw your consent.

Your Asterismus account is yours to manage: in Account settings you can correct your name and email, download a copy of your account data (a JSON file), and delete your account yourself. A workspace you own must be handed to another owner first; if you are the only person in it, write to support@asterismus.app and we will close it with you. For data from your Instagram account, see our Data deletion page.

For any question about your data: support@asterismus.app.