Data Handling & Security

Comprehensive documentation of how GoTyps collects, stores, secures, and manages user data.

1. What Data We Collect

Data TypeSourcePurposeRetention
Instagram User IDGraph APIAccount identification and linking to GoTyps user profileDuration of account connection
UsernameGraph APIDisplay in creator dashboard and campaign submissionsDuration of account connection
Post Engagement MetricsGraph APICampaign tier verification and reward calculation90 days after campaign ends
OAuth Access TokenMeta OAuth FlowSecure API access for reading engagement metricsRefreshed every 60 days, deleted immediately on disconnect
Post Media IDGraph API / Creator SubmissionUnique identification of Instagram posts for campaign matchingDuration of campaign + 90 days
Account TypeGraph APIVerify account eligibility (personal vs. business)Duration of account connection

2. What We Never Collect

  • ✗Follower or following lists
  • ✗Direct messages or private conversations
  • ✗Location data or GPS coordinates
  • ✗Contact information (email, phone number) from Instagram
  • ✗Browsing behavior outside the GoTyps platform
  • ✗Device information or IP addresses for tracking purposes
  • ✗Photos or media content beyond what is needed for post verification

3. Where Data Is Stored

🗄️ Database

  • • Platform: Supabase (PostgreSQL)
  • • Region: EU (France)
  • • Encryption: Encrypted at rest and in transit (TLS 1.3)
  • • Access: Restricted to authenticated application layer only
  • • Backups: Automated daily backups with 7-day retention

🔒 Security Measures

  • • Row-Level Security (RLS) policies enforced
  • • No third-party data sharing or selling
  • • Regular security audits and penetration testing
  • • SOC 2 compliant infrastructure (via Supabase)
  • • GDPR compliant data processing

4. Token Security

OAuth Token Handling

GoTyps implements industry best practices for OAuth token security:

  • ✓Tokens stored encrypted in Supabase using AES-256 encryption
  • ✓Tokens never exposed to client-side JavaScript
  • ✓All Graph API calls made server-side only (Next.js API routes)
  • ✓Automatic token refresh before 60-day expiry
  • ✓Immediate token invalidation on user disconnect

5. User Control & Revocation

👤 User Rights

  • ✓Disconnect anytime: Creators can disconnect their Instagram account from their dashboard at any time
  • ✓Immediate token deletion: On disconnection, OAuth token is immediately invalidated and deleted from our database
  • ✓Data deletion: All engagement data linked to disconnected account deleted within 30 days
  • ✓Full account deletion: Triggers complete data purge within 30 days (profile, posts, campaigns, messages)
  • ✓Data export: Users can request a complete data export at any time via email

📧 Data Deletion Request Process

Users can request data deletion through multiple channels:

  • • Email: contact@gotyps.com
  • • In-App: Settings → Privacy → Delete My Data
  • • Web Form: Available on Privacy Policy page

All deletion requests are processed within 30 days as required by GDPR. Users receive confirmation email upon completion.

6. Compliance & Certifications

🇪🇺

GDPR Compliant

Full compliance with EU General Data Protection Regulation

📋

Meta Platform Terms

Adherence to all Meta Platform Policies and Developer Agreement

🔐

SOC 2 Infrastructure

Hosted on SOC 2 certified infrastructure (Supabase/AWS)

← Back: PermissionsNext: Demo Walkthrough →