1. Who operates Grafeat
Grafeat is operated by Brener Digital LLC, a Delaware, USA limited liability company (“Grafeat,” “we,” “us,” or “our”). If you have questions about this policy or how your information is handled, contact us at a@brener.digital.
2. Who this policy covers
Grafeat involves two kinds of people, and this policy covers information about both:
- Organizers — people who create an account, connect an Instagram professional account, and use Grafeat to curate and publish a recurring challenge.
- Participants / creators — people who post publicly on Instagram and whose posts an organizer’s challenge may discover through a mention, hashtag, or other Meta-approved discovery mechanism. Participants do not register with Grafeat or create a Grafeat account.
3. Information we collect
From organizers
- Account and contact information you provide to us (such as your email address).
- Instagram/Facebook account identifiers returned by Meta’s OAuth login flow when you connect a professional Instagram account (such as your Instagram user ID and username).
- OAuth access tokens issued by Meta that authorize Grafeat to act on your connected account within the permissions you grant.
- Configuration you enter into Grafeat, such as challenge rules, hashtag templates, caption templates, and your selections of which submissions to feature.
From public Instagram submissions
When an organizer’s challenge discovers a public post — through a caption mention, hashtag, native Instagram tag, or another mechanism Meta’s APIs make available — Grafeat may receive data about that post directly from Meta’s APIs, including:
- The poster’s public Instagram username and account identifier
- Media identifiers, media type, and media URLs
- Captions and hashtags
- Post timestamps and permalinks
- Public engagement metadata made available by the API (such as like or comment counts)
This data comes from Instagram’s public API surface for content that participants have already made public on Instagram — Grafeat does not access private accounts, private messages, or content outside what Meta’s APIs expose for a given permission level.
4. How Instagram/Meta APIs are used
Grafeat is built to use Instagram’s and Meta’s official APIs to help an organizer discover eligible submissions to their challenge, retrieve the information needed to evaluate and credit them, and — once an organizer reviews and selects specific posts — prepare and publish a credited carousel back to the organizer’s own connected Instagram account.
Some discovery mechanisms (for example, searching by hashtag) require a level of Meta API access that is subject to Meta’s App Review process. Where a capability has not yet completed that review, it is not available in the live product, regardless of anything described elsewhere on this site. We will update this policy as additional capabilities become available.
5. OAuth access tokens and connected accounts
When you connect an Instagram or Facebook account to Grafeat, Meta issues an OAuth access token scoped to the specific permissions you approve during that authorization. Grafeat stores and uses that token only to make the API calls necessary to provide the service to you — it is not used to access anything outside the scopes you granted.
You can revoke Grafeat’s access at any time from Instagram’s or Facebook’s own account settings (Settings → Apps and Websites, or equivalent). Revoking access immediately prevents Grafeat from making further API calls on your behalf.
6. Purposes of processing
We process the information described above to:
- Operate the organizer-facing curation, composition, and publishing workflow
- Discover and retrieve public submissions relevant to an organizer’s challenge
- Evaluate submissions against an organizer’s configured rules
- Prepare and publish credited carousels through an organizer’s authorized account
- Maintain the security, integrity, and reliability of the service
- Respond to support requests and data-deletion requests
We do not sell personal information, and we do not use it for advertising.
7. Third-party service providers and infrastructure
Grafeat relies on a small number of third parties to operate:
- Meta Platforms, Inc. — the source of all Instagram/Facebook data described in this policy, under Meta’s own platform terms and policies.
- Vercel — our hosting and infrastructure provider, which processes standard request/connection data as part of serving this application.
We do not currently integrate any other third-party analytics, advertising, or data processing services. If that changes, we will update this policy.
8. Data retention
We retain organizer and submission data only for as long as reasonably necessary to provide the service to the relevant organizer, plus any additional time needed for security, troubleshooting, or legal compliance. When data is no longer needed for these purposes, we delete or de-identify it. See Section 9 for how to request deletion directly.
9. Your privacy rights and requests
Whether you are an organizer or a participant whose public post was discovered by a challenge, you may request access to, correction of, or deletion of information Grafeat holds about you or your Instagram account. See our Data Deletion instructions for how to submit a request, or email us directly at a@brener.digital.
Depending on where you live, you may have additional rights under local law. We will honor applicable legal requirements for any request we receive.
10. Security
We use reasonable technical and organizational measures designed to protect the information we handle, including restricting access to connected-account tokens and data to what the service needs to operate. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. International data processing
Grafeat and the third parties described in Section 7 may process and store information in countries other than the one where you live, including the United States. By using Grafeat or by posting content that a Grafeat-connected challenge discovers, you understand that your information may be processed internationally.
12. Children’s privacy
Grafeat is not directed at children and is not intended for use by anyone under the minimum age required to maintain an Instagram account under Instagram’s own terms. We do not knowingly collect personal information directly from children.
13. Changes to this policy
We may update this policy as Grafeat’s capabilities change, including as additional Instagram/Meta API capabilities become available following App Review. We will update the “Last updated” date above when we do. Material changes will be reflected on this page before they take effect.
14. Contact
Questions about this policy or how Grafeat handles your information: a@brener.digital.