Skip to main content

Privacy Policy

Last updated: September 11, 2026

1. Introduction

Trenzitt ("we", "our", "us") operates a creator marketplace that connects brands with creators and influencers. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have over your data.

By using the Trenzitt platform (the "Platform") you agree to the practices described here. If you do not agree, please do not use the Platform.

2. Data We Collect

We collect only the data we need to operate the Platform:

  • Account data: name, role (Creator or Brand), profile picture, account creation timestamp.
  • Contact data (optional): personal email, phone number, website, location, company name, bio.
  • Authentication data: a unique identifier from your OAuth provider (Instagram or Google) and an access token used to call the provider on your behalf. We do not see or store your provider password.
  • Campaign data: campaigns you create or apply to, pitches, messages, and status updates.
  • Technical data: IP address, user-agent, request logs, and authentication events for security and abuse prevention.

3. Instagram Data — Specific Disclosures

When you sign in as a Creator using Instagram, we use the Instagram API with Instagram Login (provided by Meta Platforms, Inc.). We request the following permissions and use the data strictly as described below. Data is not sold, traded, or shared with third parties for advertising.

  • instagram_business_basic — We read your Instagram user ID, username, name, profile picture, account type and follower count. We use these to create your Trenzitt profile, display your handle on your dashboard, and verify your audience size for brands.
  • instagram_business_manage_insights — We read aggregate account insights (reach, profile views, accounts engaged, total interactions, follower count, website clicks) to compute and display your engagement metrics inside Trenzitt and to help brands evaluate your campaign suitability.
  • instagram_business_manage_comments — When you enable Auto-DM, we process comment notifications from Meta for your Instagram posts, including comment text, comment ID, account IDs and event metadata, to match your configured rules and send one private reply to a comment through Meta's Private Replies API. A comment does not authorize an ongoing marketing conversation.
  • instagram_business_manage_messages — We process incoming message text, button responses, sender IDs and message timestamps to honor opt-outs and, when a recipient responds to a pending Auto-DM request, deliver your configured follow-up. We do not use message data for advertising audiences or unrelated profiling. Follow-ups require a recipient response within the previous 24 hours. For your optional follow requirement, we query whether the responding person follows your account after their response permits the profile lookup; we do not store their follow status. If Meta cannot determine follow status, the requested reply may still be delivered.

We store a long-lived Instagram access token so we can refresh your stats without requiring you to log in again. The token is encrypted at rest using AES-256-GCM. We do not publish posts on your behalf. Auto-DM sends only the reply configured by the account owner, with an automated-service disclosure and opt-out notice. Meta may continue delivering subscribed events while a connection exists; disabled automation does not send replies, and we still process opt-out requests. Comment and message content is not written to our Auto-DM webhook application logs.

Message recipients can reply STOP or UNSUBSCRIBE to stop automated replies from that connected account. Replying HUMAN or HELP also stops automation so the account owner can handle the conversation in Instagram; this does not guarantee an immediate human response. We retain a minimal account-scoped suppression record so later comments do not restart automation. You may also contact contactus@trenzitt.com about an opt-out or deletion, even if you do not have a Trenzitt account. Creators are responsible for obtaining any consent legally required for their messages and for responding to support requests.

You can revoke Trenzitt's access at any time from your Instagram settings (Settings → Apps and Websites) or from your Trenzitt dashboard.

4. Google Data (Brands)

When you sign in as a Brand using Google, we use Google OAuth 2.0 with the openid, email and profile scopes. We read your Google account email, name and profile picture to create and identify your Trenzitt account. We do not access Gmail, Drive, Calendar or any other Google service.

5. How We Use Your Data

  • To create and operate your Trenzitt account.
  • To display your profile (creators) or your campaigns (brands) inside the Platform.
  • To compute audience and engagement metrics shown to you and to brands evaluating you.
  • To enable communication between brands and creators on the Platform.
  • To detect, prevent and investigate fraud, abuse and security incidents.
  • To comply with our legal obligations.

6. How We Share Your Data

We share your data only with: (a) other Trenzitt users where you choose to make your profile or campaign visible; (b) service providers who host and operate the Platform on our behalf (cloud hosting, database, monitoring); and (c) authorities when required by law.

We do not sell your personal data. We do not share your Instagram or Google data with advertising networks or data brokers.

7. Data Retention

We retain your account data for as long as your account is active. If you disconnect your Instagram account, we delete the stored Instagram access token and stop fetching new insights, while retaining historical campaign records as long as those campaigns are referenced. If you delete your Trenzitt account, we delete your profile, OAuth tokens and personal data within 30 days, except where we are required to retain certain records (e.g. financial records) under applicable law.

Auto-DM stores the creator's rules and reply text, delivery identifiers and timestamps used to prevent duplicate replies, and temporary pending replies with recipient identifiers. Pending replies expire after seven days and are removed by an hourly cleanup. Delivery records remain while the Instagram connection exists to support the creator's once-per-person setting. Disconnecting Instagram or receiving a verified deauthorization callback deletes automation rules, delivery records and pending replies. Minimal opt-out records remain while the Trenzitt account exists to prevent unwanted messages after reconnection; deleting the Trenzitt account removes them. Recipients can request deletion of their own Auto-DM records through our contact address.

8. Security

We protect your data using industry-standard measures: HTTPS in transit, AES-256-GCM encryption for stored OAuth tokens, JWT-based stateless authentication, restricted CORS origins, and least-privilege access for staff. No system is perfectly secure, and we cannot guarantee absolute security.

Report suspected security vulnerabilities or unauthorized data access to contactus@trenzitt.com. Do not include passwords, access tokens or app secrets in your report.

9. Your Rights

You have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data (via your dashboard or by contacting us).
  • Delete your account and associated personal data (see Data Deletion).
  • Disconnect your Instagram or Google account from Trenzitt at any time.
  • Withdraw consent where processing is based on consent.
  • Lodge a complaint with your local data protection authority.

10. Children

Trenzitt is not directed to children under 18. We do not knowingly collect personal data from children under 18. If you believe a child has provided us data, please contact us and we will delete it.

11. International Transfers

Trenzitt is operated from India. If you access the Platform from outside India, your data will be transferred to and processed in India and the regions where our cloud providers operate. We rely on appropriate safeguards for any such transfer.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. Material changes will be highlighted on the Platform.

13. Contact

For privacy questions, data access or deletion requests, contact us at contactus@trenzitt.com. See our Data Deletion page for the deletion workflow, and our Terms & Conditions for general platform terms.