Privacy Policy

1.1 Information from your Instagram account (with your permission)

Boom for Creators does not use passwords or email registration. The only way to create a creator account is to connect your Instagram professional (business or creator) account through Instagram's official login flow, operated by Meta. During that flow, Instagram asks you to grant Boom the following permissions: basic access to your professional account, the ability to publish content on your behalf, access to your account insights, and access to messaging and comment management features. You can decline this authorization at any point, in which case Boom cannot be used.

Once you connect your account, we retrieve and store the following from the Instagram API: your Instagram account ID, username, display name, biography, website link, profile picture URL, and your follower, following, and post counts; your posts, Reels, and Stories, including their captions, hashtags, mentions, media URLs, permalinks, and publication timestamps; per-post engagement metrics such as likes, comments, shares, saves, reach, and views; and account-level insights such as reach, profile views, website clicks, follower counts over time, and the actions visitors take on your profile (for example taps on your email, phone, or directions buttons). Where Instagram makes them available, we also store aggregated, anonymous audience demographics — the age ranges, genders, countries, and cities of your followers as statistical buckets. These demographics never identify any individual follower.

To keep this data current, we synchronize with the Instagram API on a recurring schedule (incremental updates roughly every hour and a full refresh daily) for as long as your account remains connected.

We also store the access token that Instagram issues to Boom when you authorize us. This token is stored in encrypted form and is used solely to call the Instagram API on your behalf. We never see, ask for, or store your Instagram password.

Although the Instagram authorization includes permissions related to messages and comments, Boom does not currently read, process, or store the content of your direct messages or the text of comments on your posts. We only receive numeric comment counts as part of post metrics.

1.2 Information you provide directly

We collect the information you actively give us while using Boom: the growth goals and objectives you set (including target metrics, deadlines, and milestones); your chosen content category and posting cadence; free-text instructions you write to personalize your AI coach; your conversations with the AI coach (both your messages and the coach's replies); your feedback on suggested tasks and content ideas, including ideas you reject and the reasons you give; captions, hashtags, and scheduling details for posts you draft in Boom; and any photos or videos you upload to Boom for publishing to Instagram, along with thumbnails and processed versions we generate from them.

If you opt in to being discoverable by brands, we additionally collect the collaboration profile you create for that purpose, such as your brand-facing bio, niche tags, and indicative pricing, and any replies you send to brand collaboration requests.

If you register for Boom for Brands, we collect your email address, a password (stored only in a protected form that we cannot read), your company name, industry, website, and logo, and the content you create in the portal: shortlists, campaign details and budgets, notes, and messages you send to creators.

1.3 Information we generate about you

To power coaching, Boom derives new data from the information above: daily plans and tasks tailored to your account; weekly strategies and recommendations; a "creator profile" summarizing your content style, themes, and typical settings; summaries of your coach conversations and durable "memory" facts the coach learns about you (for example, your niche or stated preferences); statistics about how you use Boom, such as task completion patterns and streaks; and gamification data such as experience points and achievements. Where our video analysis feature is enabled, we also generate short AI descriptions of your Reels (topics, spoken content summary, visual summary). This derived data is part of your account and is treated as your personal data under this Policy.

1.4 Information collected automatically

When you sign in, we detect and store your browser's timezone so schedules and plans match your local time. Our servers process your IP address for security purposes: we use it in short-lived rate-limiting counters (which expire automatically within seconds to hours) and it appears in standard web server logs together with your browser's user-agent string, requested URLs, and timestamps. We do not build behavioral or advertising profiles from this technical data.

The Boom application contains no third-party advertising, analytics, or session-recording trackers. We do not use Google Analytics, Meta Pixel, or any similar tracking technology inside the app.

We believe the clearest privacy promise is what we never touch. Boom does not collect or store: your Instagram password (authentication happens entirely on Instagram's own pages); the content of your Instagram direct messages; the text of comments on your posts; the identities of your individual followers (only aggregate statistics); your precise geolocation, contacts, calendar, or phone data; advertising identifiers or cross-site tracking data; and payment card numbers (payments are handled by our payment processor — see Section 7). Creator accounts require no email address, and we do not send marketing emails to creators. We do not sell personal data to anyone, and we do not share your data with third parties for their marketing purposes.

We use the data described above to provide the Services: to authenticate you and keep your session secure; to display your analytics and audience insights; to generate personalized daily plans, weekly strategies, recommendations, and learning content; to operate the AI coach and remember relevant context between conversations; to publish and schedule posts to Instagram when you ask us to; to detect whether suggested tasks were completed based on your Instagram activity; to run the opt-in brand collaboration marketplace; to enforce rate limits and protect the Services from abuse; to debug, monitor, and improve the reliability of the platform; and to comply with legal obligations.

Where the UK GDPR / EU GDPR applies, our legal bases are: performance of a contract (providing the coaching, analytics, publishing, and marketplace features you signed up for); legitimate interests (securing the Services, preventing abuse, and improving reliability); and consent (connecting your Instagram account through Meta's authorization flow, opting in to brand discoverability, and optional features such as video analysis). You can withdraw consent at any time as described in Section 9.

Boom's coaching features are powered by large language models operated by third-party AI providers. When you use these features, relevant data from your account is sent to the provider to generate the response. Specifically:

OpenAI (OpenAI, L.L.C., USA). We use OpenAI's API to power the AI coach chat, daily task generation, weekly strategies, content recommendations, conversation summaries, coach memory, creator profile synthesis, and content moderation. Depending on the feature, the data sent to OpenAI may include your Instagram username and bio, follower and engagement statistics, excerpts of your post captions and hashtags, your goals and preferences, your coach chat messages, and your free-text AI instructions.

Google (Google LLC, USA) — Gemini API. For an optional video analysis feature, we may upload short excerpts of your Reels (up to the first 30 seconds) together with their captions to Google's Gemini API to produce a description of the video's topics, spoken content, and visuals. Uploaded files are deleted from Google's systems after analysis completes. This feature is currently disabled by default and enabled only for limited testing.

Both providers process this data as our processors, under their business API terms. Neither OpenAI nor Google uses data submitted through these business APIs to train their models, per their respective API data-usage policies.

We do not train, fine-tune, or build any machine-learning model — our own or anyone else's — on your personal data. Boom has no training pipelines, no fine-tuning jobs, and no data-labeling programs. Your content is used only to generate responses for you, in the moment, via the provider APIs described above. The only AI-related data we retain are the outputs generated for your account (your plans, summaries, profiles, and coach replies), which remain part of your account data and are deleted with it.

To keep AI interactions safe, we run automated safety and moderation checks on coach conversations (including sending message text to OpenAI's moderation endpoint) and apply guardrails that constrain what the coach can say and do. The coach can only access data belonging to the account you are signed into; it has no ability to look up other users.

We share personal data only with the service providers ("processors") we need to run Boom, with Instagram/Meta at your direction, and with brands when you explicitly opt in. We never sell your data, and we never share it for third-party marketing or advertising.

Meta Platforms (Instagram API). All of your Instagram data originates from Meta, and when you schedule or publish a post through Boom, we transmit your media and caption back to Instagram to publish it on your behalf. Your use of Instagram remains governed by Meta's own terms and privacy policy.

OpenAI and Google. As described in Section 4, for AI processing only.

Wasabi Technologies (object storage). Photos and videos you upload for publishing are stored in Wasabi cloud storage located in Frankfurt, Germany (EU). Files are accessible only through secure, time-limited links and are delivered through our content delivery network.

Cloudflare, Inc. (CDN and security). Cloudflare delivers media files and protects our websites against attacks. Cloudflare may process your IP address as part of providing these services.

Brands, when you opt in. If — and only if — you enable "Discoverable by Brands" in Settings, registered brands can see your collaboration profile: your username, display name, profile picture, bio, niche tags, follower and engagement statistics, aggregated audience demographics, example posts, and indicative pricing. Brands can add you to shortlists and campaigns and send you collaboration requests through Boom. This switch is off by default, and you can turn it off at any time, which removes you from brand search results.

We may also disclose personal data if required by law, regulation, or valid legal process, or to protect the rights, safety, and security of Boom, our users, or the public. If Boom is involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to this Policy.

Boom's databases and file storage are hosted on servers located in Germany, in the European Union. Your Instagram data, uploaded media, coach conversations, and all account data described in this Policy are stored there.

Some of our processors are located outside the UK and EEA — most notably OpenAI and Google (United States) for AI processing, and Cloudflare (global network) for content delivery and security. Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards recognized under the UK GDPR and EU GDPR, such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, and, where applicable, the EU–US Data Privacy Framework.

Subscription payments are processed by our third-party payment processor Stripe. When you purchase a subscription, your payment card details are collected and processed directly by the processor under its own privacy policy; Boom never receives or stores your full card number. We receive only what we need to administer your subscription, such as confirmation that payment succeeded and your subscription status. Brands' campaign budgets and creators' indicative prices entered inside Boom are stored as plain numbers and are not connected to any payment instrument.

We keep your personal data for as long as your account exists, so that your history, analytics, and coaching context keep working for you. Some operational data is deleted automatically on a rolling schedule: synchronization job records are deleted after 30 days; published, failed, or cancelled scheduled posts are deleted after 90 days; daily plans are deleted after 90 days; weekly strategies are deleted after 12 months; and security rate-limiting counters expire automatically within minutes to hours. Standard server logs are rotated on a short cycle.

When you disconnect an Instagram account, we stop all synchronization with Instagram for that account. When your account is deleted (see Section 9), we delete the personal data associated with it — your profile, Instagram data and tokens, uploaded media, coach conversations and memory, plans, and derived profiles — except where we are legally required to retain specific records, in which case we retain only what the law requires, for as long as it requires.

Disconnect Instagram. You can disconnect your Instagram account in Settings at any time, which stops all further data collection from Instagram. You can also revoke Boom's access directly in your Instagram app under *Settings → Website permissions / Apps*, which immediately invalidates our access token.

Brand discoverability. You control whether brands can find you. The "Discoverable by Brands" switch in Settings is off by default and can be turned off again at any time.

AI coach data. You can delete individual coach conversations in the app. You can edit or clear your personal AI instructions at any time.

Access, correction, deletion, portability. Subject to applicable law (including the UK GDPR and EU GDPR), you have the right to access the personal data we hold about you, to have inaccurate data corrected, to receive a copy of your data in a portable format, to object to or restrict certain processing, and to have your data deleted. You can delete your Boom account at any time in Settings, which removes the personal data associated with it as described in Section 8. To exercise any of your other rights — or to request deletion by email instead — contact us at dzianis@instasensei.com and we will respond within one month.

Complaints. If you are in the UK, you can complain to the Information Commissioner's Office (ico.org.uk). If you are in the EEA, you can complain to your local supervisory authority. We would appreciate the chance to address your concern first.

The Boom application sets no cookies. To keep you signed in, the web app stores a session token and a small number of technical values (your OAuth state, platform type, and theme preference) in your browser's local storage. These stay on your device, are not shared with third parties, and are removed when you log out or clear your browser data. The mobile app stores your session token in the device's secure storage.

Our marketing website (getboom.ai) uses a small set of third-party services: PostHog for product analytics, a lightweight performance-measurement script that reports page-speed metrics, Cloudflare (which sets a short-lived security cookie to protect the site from automated abuse), and Google Fonts for typography. These services may process your IP address and basic browser information. They are used to understand how visitors use our site and to keep it fast and secure — not for advertising.

Protecting your data is a core part of how Boom is built. All communication between your device and our servers is encrypted; sensitive credentials such as Instagram access tokens are stored in encrypted form; passwords are never stored in a readable form; uploaded media can only be accessed through secure, time-limited links; and access to production systems is restricted to a small number of authorized personnel. Our AI features run behind additional moderation and safety layers, and we continuously review, test, and strengthen these safeguards. In the unlikely event of a security incident affecting your personal data, we will inform you and the relevant authorities as required by law.

Boom is not directed at children. You must meet Instagram's minimum age requirements and be at least 16 years old (or the age of digital consent in your country, if higher) to use the Services. We do not knowingly collect personal data from children; if we learn that we have, we will delete it.

We may update this Policy as Boom evolves or as legal requirements change. If we make material changes, we will notify you through the Services or by other reasonable means before the changes take effect, and we will update the "Last updated" date above. Your continued use of the Services after changes take effect means the updated Policy applies.

SENSEI AI LTD (company number 17066563, England and Wales). Email: dzianis@instasensei.com. Address: Suite G1d Kingswood House, Richardshaw Lane, Pudsey, Leeds, England, LS28 6BN. If you have questions about this Policy, your data, or your rights, we're happy to help.