Privacy Policy

Introduction

Armful OPC, a One Person Corporation registered in the Republic of the Philippines, trading as Armful Media, owns and operates the Instroom influencer relationship management platform accessible at instroom.io ("we," "us," or "our"). This Privacy Policy describes how we collect, use, store, share, and protect personal information in connection with your use of our platform, Chrome Extension, Post Tracker, and related services (the "Service").

This Policy applies to all registered users, free-plan users, and visitors to our website. It does not apply to third-party services linked from our platform — please review their individual privacy policies.

Data We Collect

We collect information in the following categories:

Account & Identity Information

• Name, email address, and password (hashed) upon registration
• Billing information (processed by our payment provider; we do not store full card details)
• Company name and role (optional, for team accounts)

Usage & Platform Data

• Log data: IP address, browser type, pages visited, actions taken within the platform
• Workspace structure, campaign data, and influencer records you create
• Chrome Extension activity (profile captures, searches) associated with your account
• Post Tracker data — post links, content downloads, and Google Drive export activity — where you use Post Tracker (available upon its release)

Integration Data

• Email integration — when you connect Gmail or Outlook, we access the email messages and metadata needed to power your inbox and match conversations to the relevant campaign and creator
• Shopify — order, sales, revenue, and shipment-status data when you connect your store, used for campaign attribution and reporting
• GoAffPro — discount codes, affiliate links, and sales data when you use affiliate tracking
• OAuth tokens for Google (Gmail, Outlook, Google Drive), Shopify, and other connected services
• Data returned from Instagram and TikTok (via the Chrome Extension, and via Discovery upon its release)

How We Use Your Data

We use the personal information we collect for the following purposes:

• To provide and operate the Service — including managing workspaces, campaigns, influencer lists, the embedded inbox, and connected integrations.
• To process payments — billing, subscription management, and invoicing.
• To communicate with you — transactional emails, product updates, security alerts, and support responses.
• To improve the Service — analyzing usage patterns to enhance features and fix issues.
• To enforce our Terms — detecting fraud, abuse, and violations of our acceptable use policy.
• To comply with legal obligations — including requirements under Philippine law.

We do not sell your personal information to third parties for their own marketing purposes.

Legal Basis for Processing

Under the Data Privacy Act of 2012 (RA 10173), we process personal information on the following legal bases:

• Contractual necessity — Processing required to deliver the Service you have subscribed to.
• Consent — For optional communications and certain cookies. You may withdraw consent at any time.
• Legitimate interests — For security monitoring, fraud prevention, and improving the Service, provided our interests are not overridden by your rights.
• Legal obligation — Where processing is required to comply with applicable Philippine law.

Data Sharing & Disclosure

We share personal information only in the following circumstances:

Service Providers

We engage trusted third-party service providers who assist us in operating the platform, including payment processors, cloud infrastructure providers, and analytics services. These parties are contractually bound to process data only on our instructions and to maintain appropriate security.

Third-Party Integrations

When you connect third-party services (Gmail, Outlook, Google Drive, Shopify, GoAffPro), data may be exchanged with those platforms as necessary to fulfill the integration. Your use of those services is governed by their respective privacy policies.

Legal Requirements

We may disclose information if required to do so by law, court order, or government authority in the Philippines or another jurisdiction, or when necessary to protect our rights, users, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, user data may be transferred as part of that transaction. We will notify you before any such transfer and your data becomes subject to a different privacy policy.

We do not sell, rent, or trade your personal information to third parties for advertising or marketing purposes.

Influencer Data

Instroom is a B2B tool. When you use the platform to manage influencer campaigns, you may input personal information about third-party individuals (influencers), such as their name, social media handles, contact details, engagement metrics, and performance data.

As the user creating and managing this data, you act as the data controller for that information. You are responsible for ensuring you have a lawful basis for collecting and processing influencer personal data, and for complying with applicable data protection laws when using Instroom's features to contact or manage those individuals.

Instroom acts as a data processor with respect to influencer data stored in your workspace. We process it only to deliver the Service to you.

Cookies & Tracking Technologies

We use cookies and similar technologies to operate and improve the Service. These include:

• Essential cookies — Required for authentication, session management, and platform security. Cannot be disabled.
• Analytics cookies — Help us understand how users interact with the platform so we can improve it. You may opt out via your browser settings or our cookie preference center.
• Preference cookies — Remember your settings and workspace preferences.

The Chrome Extension does not inject tracking scripts into third-party websites. It reads publicly visible profile data from Instagram and TikTok pages you browse while signed in and logged into the extension.

Data Retention

We retain your personal information for as long as your account is active or as necessary to provide the Service. Specific retention periods:

• Account data — Retained for the duration of your subscription, plus 30 days after cancellation to allow for data export requests.
• Billing records — Retained for a minimum of 5 years to comply with Philippine tax and accounting regulations.
• Usage logs — Retained for up to 12 months for security and troubleshooting purposes.
• Workspace and campaign data — Deleted within 60 days of account termination unless a longer retention period is required by law.

You may request deletion of your account and associated personal data at any time by contacting us at privacy@instroom.io.

Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These include encrypted data transmission (TLS/HTTPS), hashed passwords, access controls based on the principle of least privilege, and regular security reviews.

While we take reasonable steps to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We encourage you to use a strong, unique password and to enable any additional security features available in your account settings.

In the event of a personal data breach that affects your rights and freedoms, we will notify the National Privacy Commission (NPC) and affected users in accordance with the requirements of RA 10173 and its Implementing Rules and Regulations.

Your Privacy Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal information:

To exercise any of these rights, contact us at privacy@instroom.io. We will respond within 15 business days. You also have the right to file a complaint with the National Privacy Commission (NPC) at www.privacy.gov.ph if you believe we have not handled your data lawfully.

Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us with personal information without parental consent, we will take steps to delete it promptly. If you believe a minor has submitted information to us, please contact privacy@instroom.io.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or via a prominent notice within the platform, with at least 15 days' notice before the new policy takes effect.

We encourage you to review this Policy periodically. Continued use of the Service after the effective date of changes constitutes your acceptance of the updated Policy.

Contact & Data Protection Officer

For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact our Data Protection Officer (DPO):