Privacy Policy

What we collect

• Account information: your email address, your password (stored only as a salted cryptographic hash, never in clear text), your first and last name, whether you are a business or brand or a marketing agency and, for agencies, an optional range for the number of client accounts you manage.
• Verification codes: the one-time code we email you when you sign up. It is stored as a hash, expires after 10 minutes and is deleted once used.
• Instagram data you connect: when you connect an Instagram professional account through Facebook Login, we receive, for the account(s) you select, its ID, username, name, profile picture, followers and following counts and number of posts; your most recent posts (caption, type, link, publication date, media and thumbnail URLs) with their metrics (likes, comments, reach, saves, shares, views, interactions); and account-level insights such as profile views. We also receive the ID and name of the linked Facebook Page and an access token, which we store encrypted.
• Content you give SAM: images and Reel audio you upload to SAM Studio, the messages you write to SAM Coach and in a SAM Studio conversation, the entries of your content calendar, and the brand information SAM Coach remembers about you. Uploaded images and audio are analysed and the original files are not kept; what is saved is the written result of the analysis, a small low-resolution thumbnail of the image (so you can recognise which post an analysis is about, on any device you sign in from), and the messages of a Studio conversation, so you can find them in your Library.
• Feedback when you deactivate your subscription: the reason you choose and any optional comment you write.
• Operational data: the number of AI tokens used and audit PDFs downloaded per account (used to run and size the service), and standard server logs (IP address, browser type, time of request) kept by our hosting provider for security and debugging.

What we do not do

• We do not read your private messages. SAM does not publish, edit or delete anything on your Instagram or Facebook accounts: it only reads the data listed above.
• We do not sell your data, we do not use it for advertising and we do not share it with data brokers.
• We do not use your Instagram data to train AI models.

How we use your data

• To provide the service: compute your audit and score, answer your questions as SAM Coach, analyse your content in SAM Studio, and manage your content calendar and brand memory.
• To secure your account: verify your email address, keep you signed in and prevent abuse.
• To run and improve the service: fix errors and measure capacity.

Data obtained from Meta is used only to provide these features to the person who connected the account.

Artificial intelligence

SAM uses AI models operated by OpenAI to generate analyses and coaching answers. To do this, SAM sends OpenAI the relevant parts of your account data (metrics and posts), your messages, and the images or audio you upload. We configure our requests so that OpenAI does not keep them for later use in its products; as with any API provider, OpenAI may retain requests for a limited period for abuse monitoring, as described in its own policy, and according to OpenAI's API data-usage policy, data sent through the API is not used to train its models by default.

AI-generated content can contain mistakes. See our Terms of Service.

Who we share data with

We share data only with service providers that help us run SAM, under their own data-protection terms:

• Vercel — hosting of the application.
• Turso — database hosting.
• OpenAI — AI processing (see above).
• Resend — sending the verification email.
• Meta — the source of your Instagram data when you connect your account.

We may also disclose data if the law requires it.

International transfers

Our providers may process data in countries other than your own, including outside the European Economic Area. Where this applies, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.

Cookies and local storage

SAM uses only strictly necessary cookies: one that keeps you signed in (up to 30 days) and one that remembers which of your pages is currently open. Your browser's local storage keeps a copy of recent SAM Studio results so they display faster. We use no advertising, tracking or analytics cookies.

How long we keep data

• Your account and connected-page data are kept for as long as your account exists.
• Removing a page from “My pages” immediately deletes that page's data and its stored access token from our database.
• Deactivating your subscription does not delete your data: it is kept so that you can come back. You can ask us at any time to delete your account and all its data; we do it within 30 days at the latest, usually much faster.
• Sessions expire after 30 days and verification codes after 10 minutes.
• Operational counters that no longer identify you may be kept.

Data Deletion — exact steps →

Security

Traffic is encrypted with HTTPS. Instagram access tokens are encrypted at rest (AES-256-GCM), passwords are hashed, and each account can only access the pages attached to it. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you as the law requires.

Your rights

Depending on where you live (for example under the GDPR), you can ask to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw your consent at any time — including by disconnecting your Instagram account in SAM or in your Meta settings. You can do most of this yourself in SAM; for anything else, contact us. You may also lodge a complaint with your data-protection authority (in France, the CNIL).

Children

SAM is not intended for people under 16, and we do not knowingly collect their data.

Changes to this policy

We may update this policy. The date at the top shows the latest version, and material changes will be announced in the app.