Instagram privacy information

INTELLIEFFECT · Castera

Connect your own professional Instagram account separately from Castera signup. Available only to approved development testers.

Optional Instagram connection: we store the account ID, username, app ID, connection and expiration times, encrypted access token, and selected post IDs and official links. During connection we use a session-bound, single-use state hash valid for up to ten minutes. Unselected posts are fetched transiently for selection and are not stored. We associate these records with Castera member, persona and internal connection IDs. For connection security, we also store a browser-binding hash, locale, and state expiration and consumption times. Post types are used transiently in the selection screen and are not stored.

We use this data to verify Instagram account access, select posts belonging to the account and publish explicitly approved official links. Tokens are encrypted in server-only storage and are never provided to visitors or brands. The operator is INTELLIEFFECT. This connection is not real-name, know-your-customer (KYC), or content-rights verification, and does not guarantee recommendations or increased algorithmic exposure. Publication uses official links only; original images and videos are not downloaded or rehosted.

Only official post links explicitly selected and approved for publication in the Instagram connection screen are made public. These links can reveal the Instagram account. This explicit publication is an exception to restrictions on exchanging contact details before a contract; protection of unselected handles, accounts and existing private information is unchanged.

Connection data is retained while connected. Connection data and selected links are deleted on disconnect, processing of deletion requests, account/persona deletion or confirmed authorization loss. Expired connections are hidden and deleted on next access. Single-use OAuth states become unusable after ten minutes and are removed when the same persona next starts a connection, disconnects or is deleted; there is no scheduled cleanup job. When revalidation detects that source posts are deleted, private or inaccessible, links are hidden; stored selections are not necessarily deleted immediately.

This confirms account access, not identity, copyright, authorship or a Meta verification badge.

dev@intellieffect.com