Privacy Policy

Who we are

Mutuall, operating as itsmutuall.com, is a managed growth service for your own Instagram account: you connect your Instagram, get a free Growth Score, and — if you subscribe — we promote your account with paid advertising run through Meta's own advertising system, from advertising accounts we own. Instagram is the only platform we connect to. For the data described below, Mutuall acts as the data controller. We use Instagram's official API only — we never scrape, never automate actions inside your account, and never ask for your Instagram password.

What we collect

Account data. Your email address, a one-way hash of your password (never the password itself), your subscription status, and your payment records.

Connected Instagram data. With your explicit consent through Instagram's official login, we read your professional account's profile fields (such as your username, name, profile picture, bio, follower and post counts), your posts and their captions and media, and account-level insights (such as daily reach and profile visits) from Instagram's official API. We use this to compute your Growth Score, to pick the posts worth promoting, and to show you your own account's trend on your results page. We collect only account-level metrics — never per-post non-follower breakdowns, which Instagram does not provide.

How the connection is made. Instagram connections are made through bundle.social, an authorized Meta Tech Provider that acts as our data processor for these connections, under a data-processing agreement. That is why you see their name on Instagram's consent screen when you connect. What flows through them: the connection token (which they hold and we never see in plain form), and your profile and post data on its way to us, retrieved from Instagram's official API. They process this data only to provide the service to us. When you disconnect or delete your account, we also instruct bundle.social to delete the imported posts and analytics they hold for that connection and to disconnect it on their side.

Copies of the posts we promote. If you subscribe, we keep copies of the posts we prepare and run as promotions — the media, the caption, and our edited versions. These copies exist only while you are subscribed: when you cancel or disconnect, we delete them.

Promotion delivery data. The numbers your promotions deliver — people reached, profile visits sent, and what was spent — come from our own advertising accounts at Meta, where the promotions run. They are our business records of work we performed; we report them to you exactly as recorded.

Your agreement record. When you subscribe, we keep a durable record of your acceptance of the client agreement — the agreement version, your account, the time, and the IP address it was accepted from. This is the legal record of the permission you gave us, and it is retained even if other activity data is purged.

Emails we send you. We send service emails — your weekly results report, and notices about your subscription (such as your first promotion going live, a payment problem, or a cancellation). We record whether these were delivered and opened, so we know our reports are reaching you. We do not run third-party advertising trackers.

Payments. Payments are processed by Stripe. We never see or store your card number — we keep only the transaction records Stripe gives us (amount, status, plan).

Usage and logs. We record product events (such as viewing your score or starting checkout) and operational logs (errors, security events) including IP addresses, to run, secure, and improve the service. We use a session cookie and a one-time first-visit cookie that remembers how you found us.

Why we process it

To compute your Growth Score, to verify your account is real and eligible, to pick and prepare the posts we promote, to run your promotions and pace their budget, to report honestly on what they delivered, to take payment, to send the service emails described above, to prevent abuse and fraud, and to meet our legal obligations.

What appears in promotions

If you subscribe, your handle, name, likeness, and the licensed content of your posts appear in the promotions we run for you — that is the service, and it happens under the license you grant at checkout (section 7 of our Terms). Running those promotions means providing that content to Meta as the advertising platform. Promotions run from our own brand identity and are labeled “Sponsored” by Meta. We never use your content to promote anyone or anything other than your own account.

How long we keep it (retention)

Copies of promoted posts are deleted when you cancel or disconnect. Connected-account data and insights history are kept while your account is connected, so your trend can be shown over time. Your agreement record and payment records are retained as long as legal, tax, and accounting obligations require. Operational logs are kept for a bounded period and then purged or aggregated. When your account is deleted, the section below applies.

Deleting your data

Self-serve. You can delete your account from your account page at any time. Deletion anonymizes your account in place: your email is scrubbed, your Instagram connection and its encrypted access token are removed, stored copies of your posts are deleted, and your history is detached from your identity. It cannot be undone. Records we are legally required to keep (payments, your agreement acceptance) are retained in that detached form.

Via Instagram. If you remove Mutuall from your Instagram account settings, access is revoked immediately and we purge the stored access token. If you request data deletion through Meta, their data-deletion callback triggers a purge of your Instagram-derived data and returns a confirmation code with a status page you can check.

Disconnecting Instagram in Mutuall (or deleting your account) additionally triggers deletion of the imported posts and analytics held at bundle.social for that connection and disconnection on their side. Full step-by-step instructions are on our Data Deletion page.

Sharing

We do not sell personal data. We share data only with the parties needed to run the service: our hosting provider; bundle.social as the integration provider for Instagram connections; Stripe for payments; our email delivery provider; and Meta, which receives the licensed content and handle of subscribed clients as the platform the promotions run on. Each processor is bound by their own data-processing terms. We may also disclose data where the law requires it.

Your rights

Depending on where you live, you may have rights to access, correct, export, or erase your personal data, and to object to or restrict processing. Email [email protected] and we will respond within 30 days.

Changes

If this policy changes materially, we will note it here and, for significant changes, email account holders before the change takes effect.