Privacy Policy

This Privacy Policy describes how Edgar SAS (“Edgar”, “we”, “us”, or “our”) collects, uses, processes, and protects personal data in connection with the Inrō platform (the “Service”).

1. Identity of the Data Controller

Edgar SAS
RCS Compiègne 920 349 073
20 rue des Maraîchers, 60700 Pontpoint, France

Contact: privacy@inroapp.com

2. Scope and Roles

Depending on the context:

• Edgar SAS acts as a data controller for personal data relating to its own users
• Edgar SAS acts as a data processor when processing personal data on behalf of its customers

Customers are solely responsible for determining the purposes and legal basis of processing concerning their end users.

Where we process personal data in order to detect, investigate or act on a suspected breach of our Terms of Service — including reviewing automation configurations, Shared Content and message content, retaining evidence, reporting to platform providers or authorities, and preventing re-registration — we act as data controller for that processing, and not as a processor on behalf of a customer.

3. Categories of Personal Data

3.1 Data processed on behalf of customers

• Instagram messages, comments, and related content
• Media and attachments
• Profile data and metadata
• Interaction and behavioral data
• Contact information collected by customers

3.2 Data relating to users of the Service

• Identification and contact data
• Account and organization data
• Billing data
• Support communications

3.3 Technical and usage data

• Device and connection data
• Usage data
• Error and performance data
• Approximate location (country), derived from the IP address used to sign up
• Consent choices for analytics and advertising measurement, with when and how they were given

3.4 Abuse and enforcement records

• The content giving rise to a suspected or established breach of our Terms of Service
• Automation and Shared Content configurations associated with that breach
• Account records, including identification, organisation and billing data
• Connected Instagram business account identifiers
• Signals used to prevent re-registration, including hashed email address, IP address and device identifiers

4. Purposes and Legal Bases

Data is processed for:

• Provision and operation of the Service
• Contract performance
• Customer support and relationship management
• Automation and analytics
• Security and fraud prevention
• Detection, investigation and enforcement of breaches of our Terms of Service
• Measurement of our advertising campaigns

Legal bases:

• Contract performance
• Legitimate interests
• Consent (where required)
• Legal obligations

For the detection, investigation and enforcement of breaches of our Terms of Service, we rely on our legitimate interests in preventing fraudulent and deceptive use of the Service, protecting the recipients of messages sent through it, maintaining our access to the platforms on which the Service depends, and establishing, exercising or defending legal claims.

For product analytics and advertising measurement, the legal basis depends on where you sign up from. In the EU/EEA, the United Kingdom and Switzerland, we rely on your consent. Elsewhere, we rely on our legitimate interest in understanding how the Service is used and measuring our marketing, and you can opt out at any time (see section 10). Keeping a record of your choices is necessary to comply with our legal obligations.

5. Artificial Intelligence

The Service uses artificial intelligence:

• Processing may include message content and contextual data
• Processing is performed via OpenAI
• Data is not used to train AI models
• Data is processed on a transient basis

6. Recipients and Subprocessors

Data is shared with service providers acting as processors.

A current list is available at:
www.inro.social/legal/subprocessors

We do not sell personal data for money. Outside the EU/EEA, the United Kingdom and Switzerland, sending conversion events to our advertising partners (see section 10) may count as “sharing” personal data or targeted advertising under some US state privacy laws. You can opt out at any time in Profile → Privacy, and we honour the Global Privacy Control signal.

Where we reasonably believe that use of the Service breaches our Terms of Service or applicable law, we may also disclose relevant account records and content to the following recipients, who act as independent controllers or in an official capacity:

• Meta and other platform providers on which the Service depends
• Payment providers
• Competent regulatory, consumer protection and law enforcement authorities

7. International Transfers

Where data is transferred outside the EEA, appropriate safeguards are implemented, including:

• Standard Contractual Clauses (SCCs)
• EU–US Data Privacy Framework (DPF), where applicable

8. Data Retention

• Messages and interactions: up to 24 months
• Contacts: deleted after 24 months of inactivity
• Logs: limited retention
• Backups: up to 4 days
• Abuse and enforcement records (section 3.4): 5 years from termination of the account
• Re-registration prevention signals: 5 years from termination of the account
• Signup events held while we wait for an EU/EEA, UK or Swiss user's consent: 7 days at most, deleted immediately on refusal
• Consent records: for the life of the account and up to 5 years after its closure, as proof of consent

9. Data Deletion

Upon account deletion:

• Data is permanently deleted, subject to the exception below
• Residual data may persist temporarily in backups

By exception, where an account has been suspended or terminated for breach of our Terms of Service, we retain the abuse and enforcement records described in section 3.4 for the period set out in section 8. This exception is limited to the records and content connected to the breach; all other data is deleted as described above.

10. Cookies, Analytics and Advertising Measurement

We group cookies and similar technologies into three categories: strictly necessary (sign-in, security and the support chat, always on); analytics (Mixpanel, Google Analytics, Hotjar and Sentry session replay); and advertising measurement (Meta, Reddit and OpenAI).

If you are in the EU/EEA, the United Kingdom or Switzerland (determined from your IP address), no analytics or advertising technology is used before you choose. We ask for your choice right after you create your account. Until you answer, the events describing your signup are held on our servers and are sent to our analytics and advertising partners only if you accept. They are deleted if you refuse, or if you have not answered within 7 days.

Elsewhere, analytics and advertising measurement are on by default and you can opt out at any time. We honour the Global Privacy Control signal sent by your browser, which turns advertising measurement off.

For advertising measurement, we tell our advertising partners about key events (such as signing up, connecting Instagram, starting a trial or subscribing), together with your email address, IP address, browser user agent and advertising identifiers such as Meta’s _fbp and _fbc cookies or ad click IDs. For account owners who have agreed to advertising measurement, we may also upload hashed email addresses to Meta to build lookalike audiences.

You can change your choice at any time in Profile → Privacy in the app.

We determine your country on our own servers with the DB-IP Lite database; your IP address is not sent to DB-IP. IP Geolocation by DB-IP, licensed under CC BY 4.0.

11. Security

We implement appropriate measures including:

• Encryption in transit
• Encryption of sensitive data at rest
• Access control
• Monitoring

12. Data Subject Rights

Individuals may exercise rights including access, deletion, and objection.

You can withdraw your consent, or opt out of analytics and advertising measurement, at any time in Profile → Privacy. If you live in a US state with a consumer privacy law, you can opt out there of the sale or sharing of your personal data and of targeted advertising; we also treat the Global Privacy Control signal as an opt-out.

Requests should be directed to the relevant data controller.

Rights of erasure and objection may be restricted where we retain data as necessary for the establishment, exercise or defence of legal claims, or for compliance with a legal obligation — in particular in relation to the abuse and enforcement records described in section 3.4.

Contact: privacy@inroapp.com

13. Children

The Service is not intended for individuals under 13.

14. Updates

This policy may be updated periodically.

15. Contact

privacy@inroapp.com

‍