Last updated: 6 August 2026
Data we process
- Account data: name, username, e-mail address and a hashed password.
- Business data: business name, website, sector, tone of voice, target audience.
- Instagram data obtained through the official Instagram API after you authorize our app: account ID, username, profile picture, account type, follower and media counts, captions and engagement metrics of your existing posts, insights of posts published through Krates, and the access token required for publishing. We never see or store your Instagram password.
- Content you upload: images and videos you add to your media pool.
- Technical records: a session cookie and system event logs. We do not use tracking cookies.
Why we process it
To publish to the correct Instagram account, to show you which account is connected, to generate captions that match your brand voice, to calculate the best publishing times from your own reach data, and to alert you when a scheduled post fails.
AI processing
Captions and brand profiles are generated using Anthropic (Claude). We send only your business name, sector, tone of voice, target audience and your publicly visible post captions. We never send personal contact details, passwords or access tokens. Anthropic does not use API data to train models.
Sharing
We share data only with Meta/Instagram (to publish your content), Anthropic (as described above) and our hosting provider. We do not sell your data, do not use it for advertising and do not build advertising audiences.
Retention and deletion
Data is retained while your account is active. Access tokens are deleted immediately when you disconnect your Instagram account. When you close your account, all your data is permanently deleted within 30 days. System logs are cleared after 12 months.
Deletion instructions: Data deletion instructions
Security
All traffic is encrypted with HTTPS, passwords are stored as irreversible hashes, every business can access only its own data, and credentials are kept outside the web-accessible directory.
Your rights
Under GDPR and Turkish data protection law (KVKK) you may access, correct, delete or object to the processing of your data. Contact hello@krates.ai and we will respond within 30 days.
