Privacy Policy
Data we receive from Instagram
Starfish Influencers Agency (“Starfish”, “we”) operates campaign-reporting tools for influencer marketing campaigns. When a creator (influencer) connects their Instagram professional account to our app StarfishAgency Insights, or is contracted on a campaign we manage, we receive the following data through Meta’s Instagram API, with the creator’s authorisation:
- Profile information — username, account ID, profile picture, follower count
- Media and metadata — posts, reels and stories published as part of a contracted campaign, with their captions, hashtags, and publish dates
- Performance insights — views, plays, reach, impressions, likes, comments, saves, shares, and watch time for campaign content
- Audience demographics — aggregated age ranges, gender split, and top locations of the account’s audience, as reported by Instagram
We do not receive or store the creator’s Instagram password. Authorisation happens on Instagram’s own login screen, and access is limited to the read-only permissions shown on that screen. We do not access direct messages. We do not collect data about the creator’s followers as individuals — demographic data arrives from Instagram already aggregated and anonymised.
Why we use it
This data is used for exactly one purpose: producing campaign performance reports for the brands that contracted the campaign. Metrics for the creator’s campaign content are compiled, checked, and delivered to the campaign’s client. We do not sell this data, use it for advertising audiences, or share it with anyone other than the campaign client, and we act on each creator’s data only in connection with campaigns they are contracted on.
How long we keep it
| Data | Retention period | Why |
|---|---|---|
| Access tokens (the credential Instagram issues when an account connects) | Life of the connection; deleted within 7 days of disconnection | Needed to fetch campaign metrics; useless and deleted once access is withdrawn |
| Raw API responses (unprocessed data returned by Instagram) | 90 days on a rolling basis | Validation and audit of report figures; can be re-fetched if needed |
| Comment text used for sentiment analysis | 90 days after classification | Audit of the classification; the published report carries only aggregate counts |
| Campaign figures incorporated into delivered client reports | Duration of the campaign plus 24 months | Delivered contractual work product; retained for billing, dispute resolution, and legal record-keeping, with the creator’s consent recorded in their campaign agreement |
After each period expires the data is deleted from our systems. Aggregated figures in reports already delivered to clients (for example, a campaign’s total views) are part of the delivered document and are not retroactively removed from it.
When we delete regardless of the periods above
We delete the relevant data as soon as reasonably possible, and in any case within 30 days, when:
- the creator disconnects our app from their Instagram account,
- the creator (or Meta) asks us to delete it,
- the campaign relationship ends and no retention purpose above applies, or
- we stop operating the reporting service.
How to disconnect or request deletion
A creator can withdraw our access at any time from inside Instagram: Settings → Security → Apps and websites → StarfishAgency Insights → Remove. Disconnection stops all further data collection immediately.
To request deletion of data we already hold, see our Data Deletion page or email database@starfish.agency. We action deletion requests within 30 days and confirm completion by email.
