Privacy policy

Prufi (prufi.io) is operated by Semghouli Global LLC, a limited liability company in the United States (“Prufi”, “we”, “us”). Prufi lets creators deliver digital resources (“Drops”) to fans who comment a keyword on their Instagram posts, and shows creators what happened after every comment.

This policy covers two groups of people: creators who sign up for Prufi, and fans who comment on a creator’s post or visit a Drop page. For fan data, we act on behalf of the creator whose post or page it is.

Creators. When you create an account: your email address, and if you sign in with Google, your name and profile photo. You choose a public handle and display name. When you connect Instagram: your Instagram professional account ID, username, and an access token that lets Prufi read comments and send messages on your behalf. We also store the Drops you create (title, keyword, link, description) and the settings you choose.

Fans who comment. When someone comments on a creator’s connected post, Instagram sends us: the comment ID and text, the post ID, and the commenter’s Instagram-scoped user ID and username. We use this to match the keyword, send the Drop by private reply, and record whether the delivery succeeded.

Drop page visitors. When someone opens a Drop page, we record the event (page view, resource click, or click on the “Powered by Prufi” link), a random visitor ID stored in a first-party cookie, and the website that referred the visit. We do not store IP addresses in our database, and we don’t record page activity from known bots and link-preview crawlers.

Technical data. Our hosting providers process standard request logs (such as IP address, browser type, and time of request) to operate and secure the service.

• To deliver Drops: match comments to keywords and send the resource the fan asked for.
• To show creators their analytics: comments, deliveries, page views and clicks.
• To run your account: sign-in, security, support, and service messages.
• To credit referrals: if you sign up after clicking “Powered by Prufi” on a Drop page, we record which creator and Drop referred you.
• To keep Prufi safe: detect abuse, spam and violations of our Terms.

Prufi uses the official Instagram API from Meta. We access only the permissions a creator grants, and we use Instagram data only to deliver requested resources and show that creator their own analytics.

• We never sell Instagram data or use it for advertising.
• We message a fan only in reply to a comment they left, and only once per comment.
• We never show one creator’s fan data to another creator.
• We comply with the Meta Platform Terms and Developer Policies.

Creators can disconnect Prufi at any time from Instagram’s settings (Settings and activity → Website permissions → Apps and websites), which stops all access immediately.

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising. We share data only with service providers that help us run Prufi, under contracts that limit their use of it:

• Supabase: database and authentication, hosted in the United States (US East).
• Vercel: application hosting.
• Cloudflare: domain name and email routing.
• Google: sign-in, if you choose “Continue with Google”.
• Meta: the Instagram API that receives comments and delivers messages.

We may also disclose data if required by law, or to protect the rights and safety of our users and the public. If Prufi is involved in a merger or acquisition, data may transfer under this policy.

We use a small set of first-party cookies and browser storage. No advertising cookies.

• Sign-in cookies keep you logged in to your dashboard.
• Visitor ID (random, 1 year) lets us count unique Drop page visitors without identifying them.
• Referral cookie (30 days) remembers which Drop page sent you, so the creator gets credit if you sign up.
• Theme preference (browser storage) remembers light or dark mode.

We keep creator account data and Drops while the account is open. Delivery and page activity logs are kept while the creator’s account is open so they can see their history. When a creator deletes their account, we delete their profile, Drops, Instagram connection, and associated fan and activity records within 30 days, except where the law requires us to keep something longer.

You can ask us to access, correct, export or delete your personal information. Creators can edit their profile and Drops in the dashboard at any time. Fans can ask us to delete data tied to their Instagram username. See Data deletion for the exact steps.

California residents have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its sale or sharing. We don’t sell or share personal information as those terms are defined under the CCPA, and we won’t treat you differently for exercising your rights. Email support@prufi.io to make a request; we’ll verify it using your account email or Instagram username.

Data is encrypted in transit (HTTPS) and at rest. Access is restricted by row-level security so each creator can reach only their own data, Instagram access tokens can’t be read through our public API, and webhooks from Meta are verified by signature before we trust them. No system is perfectly secure; if we learn of a breach affecting you, we’ll notify you as required by law.

Creator accounts are for people 18 and older. Prufi is not directed to children under 13, and we don’t knowingly collect their personal information. If you believe a child has provided us data, email support@prufi.io and we’ll delete it.

If we make material changes, we’ll update the effective date above and notify creators by email or in the dashboard before the changes take effect.