Last updated: August 9, 2026
This Privacy Policy explains how Ekamra Labs ("we", "us") collects, uses, stores, and deletes personal data in connection with GetInstaLead (the "Service").
Ekamra Labs UDYAM-KR-03-0740108 Contact: privacy@getinstalead.com
The Service involves two distinct groups, and we handle their data differently.
Customers are our customers. They create an account, connect their Instagram Business account, and configure the Service.
Leads are people who send a direct message to, or comment on a post by, a Customer's Instagram account. Leads are not our customers and do not have accounts with us. We process their data on the Customer's behalf so the Customer can respond to them.
For Lead data, the Customer determines the purpose of processing and we act on their instructions. For Customer account data, we determine the purpose ourselves.
When a Customer connects their Instagram Business account, we receive through Meta's APIs:
Where a Lead opts in to WhatsApp reminders, we receive and store their phone number and the delivery status of messages we send.
Leads may volunteer information during a conversation — their goals, timeline, availability, name, and contact details. We ask only what the Customer has configured as necessary to determine fit and schedule a call.
We do not ask Leads for sensitive personal data. This includes health or medical information, physical characteristics, financial details beyond general affordability, government identifiers, or any special category of data under applicable law. Our AI is configured neither to request nor to discuss these.
If a Lead volunteers such information unprompted, the conversation is flagged and handed to the Customer. We do not use that information for any purpose other than delivering the conversation to the Customer, and we redact it from stored transcripts where technically feasible, retaining only a flag.
IP address, browser and device type, and timestamps, for security and abuse prevention.
| Purpose | Data used | Basis |
|---|---|---|
| Provide the Service — receive and respond to messages, qualify leads, schedule calls | Meta platform data, Lead conversation data | Performance of contract with the Customer |
| Maintain Customer accounts and process payment | Customer account and billing data | Performance of contract |
| Safety monitoring — detect conversations requiring human escalation | Conversation content | Legitimate interest in preventing harm |
| Improve the Service | Aggregated usage data | Legitimate interest |
| Security, fraud prevention, abuse detection | Technical and usage data | Legitimate interest, legal obligation |
| Legal compliance | As required | Legal obligation |
We do not sell personal data. We do not share it with advertisers. We do not use Lead conversation content to train machine learning models.
We share data only with service providers necessary to operate the Service:
Each Customer can access the conversations that occurred on their own Instagram account. Customers cannot access other Customers' data.
We may disclose data where required by law or to protect the rights and safety of any person.
Our service providers may process data outside India. Where this occurs we rely on the provider's contractual safeguards.
Fly.io and Neon (application hosting and database) process data in Singapore. OpenAI processes data in the United States.
| Data | Retention |
|---|---|
| Customer account data | For the life of the account, then 30 days after closure |
| Conversation transcripts | 90 days by default; Customers may configure a shorter period |
| Booking records | 12 months |
| Billing records | As required by Indian tax law |
| Security and audit logs | 12 months |
Flagged conversations may be retained for the full 90 days for safety review.
Data is encrypted in transit and at rest. Access is restricted to personnel who require it and is logged. Access tokens for Meta platforms are stored encrypted.
No system is perfectly secure. We will notify affected users and relevant authorities of a breach as required by law.
You may request access to your data, correction of inaccurate data, deletion, a copy in portable form, restriction of processing, or object to processing based on legitimate interest. You may also withdraw consent where processing is based on it.
These rights are available to all users regardless of location, at any time, and free of charge.
To exercise any of them, see our Data Deletion page or email privacy@getinstalead.com. We respond within 30 days.
If you are a Lead who messaged a Customer using our Service: you may request deletion of your conversation data directly from us using the process on our Data Deletion page. You do not need to contact the Customer.
Grievance Officer (India): [CONFIRM: name], grievance@getinstalead.com
The Service uses artificial intelligence to generate replies. Every conversation discloses at the outset that the Lead is speaking with an AI assistant acting for the Customer.
Conversation content is processed by our AI provider to generate replies and to run safety checks. This content is not used to train AI models.
The AI does not make decisions producing legal effects. A Customer may take over any conversation at any time, and conversations meeting defined safety criteria are automatically escalated to the Customer.
The Service is not directed at anyone under 18. Our AI is configured to end a conversation and notify the Customer if a Lead indicates they are under 18. We do not knowingly collect data from children. If you believe we have, email privacy@getinstalead.com and we will delete it.
Any Lead may stop receiving messages by replying "STOP", or any equivalent request, in the conversation. This is honoured immediately and permanently. You may also email privacy@getinstalead.com.
Material changes will be notified to Customers by email at least 14 days in advance. The "Last updated" date above always reflects the current version.
Ekamra Labs UDYAM-KR-03-0740108