Data Processing Agreement

1. Scope and roles

This Data Processing Agreement (“DPA”) forms part of the agreement between Instagram API (https://profilequery.com, “we”, the “Processor”) and the customer using the Service (“you”, the “Controller”). It applies to personal data we process on your behalf when you use the API, dashboard, or MCP server, and is intended to meet the requirements of Article 28 of the EU and UK GDPR and comparable data-protection laws.

You determine which public Instagram accounts and content are requested and for what purpose, and you are responsible for having a lawful basis for that processing. We process personal data only to provide the Service and only on your documented instructions, which include your API requests and this DPA.

2. Details of processing

• ▹Subject matter: retrieving publicly accessible Instagram data you request through the Service.
• ▹Duration: for as long as you use the Service, plus the deletion period in section 8.
• ▹Categories of data subjects: owners of the public Instagram accounts you query, and your own users and staff who hold accounts with us.
• ▹Categories of personal data: public profile data (handles, names, bios, IDs), public posts, Stories, and media URLs; your account email address; request logs (endpoint, parameters, response, timestamp, IP address).
• ▹Special categories: we do not intentionally process special-category data. Public content may incidentally reveal it, and you are responsible for handling that appropriately.

3. Confidentiality

We make sure that anyone authorized to process personal data under this DPA is bound by a duty of confidentiality, and that access to production data is limited to what is needed to operate and support the Service.

4. Security

We maintain technical and organizational measures appropriate to the risk, including:

• ▹Encryption in transit (HTTPS/TLS) for all API and dashboard traffic.
• ▹API keys stored as one-way hashes, never in reversible form.
• ▹Access to production systems restricted to authorized personnel.
• ▹Hosting on established cloud providers that maintain their own security certifications.
• ▹Usage monitoring and abuse detection.

5. Subprocessors

You authorize us to use subprocessors to deliver the Service. We use third-party providers in these categories: cloud hosting and compute, database hosting, authentication, payment processing, transactional email, AI model inference (used only for AI-powered endpoints), and public-data collection infrastructure. A current list of named subprocessors is available to customers on request at support@mail.profilequery.com.

We impose data-protection obligations on each subprocessor that are no less protective than this DPA, and we remain responsible for their performance. We will notify you by email before adding or replacing a subprocessor, and you may object on reasonable data-protection grounds within 14 days. If we cannot address your objection, you may stop using the Service and request deletion under section 8.

6. International transfers

Personal data is processed primarily in the United States. Where data is transferred out of the EEA, UK, or Switzerland, we rely on an appropriate transfer mechanism, such as the European Commission’s Standard Contractual Clauses and the UK Addendum, which are incorporated by reference into this DPA where required.

7. Personal data breaches

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting your data. The notice will describe the nature of the breach, the data likely affected, the likely consequences, and the measures taken or proposed. We will reasonably cooperate with you so you can meet your own notification obligations.

8. Deletion and return

Request logs and account data are kept while your account is active. When you close your account or ask us to, we will delete personal data processed on your behalf within 30 days, except where the law requires us to keep it (for example, billing records). Data you have already received through the API is under your control, and we place no restriction on how long you keep it.

9. Assistance and data-subject requests

Taking into account the nature of the processing, we will reasonably help you respond to requests from data subjects exercising their rights, and with data-protection impact assessments and consultations with supervisory authorities. If we receive a request directly that relates to your processing, we will pass it on to you and not respond ourselves unless you authorize it.