Guidepost Privacy Policy

In effect from 15 September 2026 · https://guidepost.komen.now/privacy

1. Who we are

Guidepost is an Instagram automation and insights service operated by Komen (“we”, “us”) at guidepost.komen.now. It is used by many creators. Each creator signs up with an email address and connects one Instagram professional account into a Workspace.

This policy covers three groups of people:

Creators who sign up and connect an Instagram account (“you” in most of this policy).
Commenters and senders: people who comment on a creator’s posts or message a creator’s account.
Visitors who open a creator’s Bio page or a link Guidepost sent.

2. What Guidepost does

For each connected Instagram account (an “Account”), Guidepost:

sends an automated private reply when a comment, direct message or Story reply contains a keyword the creator has set up (a “Campaign”), and optionally posts a short public reply to the comment;
replaces the link in that reply with a short link on our domain so the creator can count how many replies were opened;
shows the creator their own posts, Instagram Insights and audience aggregates in a private dashboard;
on paid Plans, writes AI reports about the creator’s own posts and account;
serves a public Bio page (/go/<handle>) with one button per active Campaign.

3. Data held per Account

Instagram data comes from the Instagram API provided by Meta Platforms, Inc. (“Meta”), after the creator grants Guidepost access through Instagram Login. Each Account’s data is stored separately from every other Account and is visible only to Members of its Workspace.

Data	Whose	Source
Instagram user ID, username, an API access token (stored encrypted), its expiry and the permissions granted; the Account’s timezone and settings (goal, brand notes, follow gate, pause)	Creator	Instagram Login; set by the creator
Posts and reels: media ID, caption, media type, permalink, thumbnail URL, post date, like and comment counts	Creator	Instagram API
Insights for each post and for the account per day (views, reach, likes, comments, saves, shares, follows, profile visits, follower count), kept as a history of snapshots	Creator	Instagram API
Audience aggregates: follower counts by age band, gender, country and city, weekly. No individual follower is identified.	Creator’s followers, in aggregate	Instagram API
Every comment on the creator’s posts and every message to the account that Meta sends us: comment or message ID, text, the sender’s Instagram username and Instagram-scoped user ID, the time received, and the raw webhook payload. A comment or message that matches no keyword is kept but marked ignored.	Commenters and senders	Instagram webhooks
For a direct message that a Campaign answers: whether the sender already followed the account, as Meta reports it	Senders	Instagram API
Delivery record: whether a private reply and public reply were sent, the message IDs returned by Instagram, any API error, and any mark the creator adds (for example Converted, or a name, email or phone number the person later shared)	Commenters and senders	Generated by Guidepost; entered by the creator
Short-link clicks: the time of the click and a one-way hash of the browser name, so repeated taps are not mistaken for several people. No IP address is stored.	Visitors	Generated by Guidepost
Bio page clicks: a count per Campaign. Nothing about the visitor is stored.	Visitors	Generated by Guidepost
AI reports: the advice text generated from the creator’s captions, Insights and cover images, the creator’s feedback on it, and the cost of each run	Creator	Generated via OpenAI

Guidepost does not read a creator’s follower list, does not access other people’s profiles or posts beyond what is listed above, and never receives card numbers.

4. Your Workspace and sign-in

To run your Workspace we also hold:

your email address, and the email address of each Member you invite;
sign-in links: sign-in is by a single-use link emailed to you (there are no passwords). We store a hash of each link, when it was requested, the requesting IP address, and when it was used. Links expire after 15 minutes.
sessions: a hash of the session token, the IP address and browser at sign-in, and the expiry;
the Workspace name, Handle, timezone, Plan, status and trial end date;
your Stripe customer and subscription IDs (see Processors).

5. How we use data

Comment and message data is used to detect a keyword, send the reply the person asked for, post the public confirmation, avoid answering the same person twice for the same Campaign, and show the creator their Deliveries and Leads.
Media, Insights and audience data is used to show the creator their performance, to choose which posts run a Campaign, and, on paid Plans, to produce AI reports.
The access token is used only to call the Instagram API on the creator’s behalf.
Email and sign-in records are used to sign you in, send transactional email (sign-in links, trial and billing notices) and limit abuse of the sign-in form.
Billing records are used to charge for the Plan and to decide which features a Workspace has.

We do not use any of this data for advertising or profiling, and we never sell it.

6. Processors and third parties

Meta Platforms, Inc. — Guidepost reads Instagram data and sends replies through the Instagram API. Meta’s handling of that data is governed by the Meta Privacy Policy.
Amazon Web Services — the application, its database and its logs are hosted on a server we control in AWS’s Asia Pacific (Singapore) region.
OpenAI, L.L.C. (USA) — when an AI report is run, we send OpenAI the creator’s own captions, Instagram Insights numbers, audience aggregates, brand notes and public cover images. We never send comment or message text, commenter or sender usernames, email addresses or any other person’s data, and we do not allow OpenAI to use what we send for training. See the OpenAI Privacy Policy.
Stripe, Inc. — payment is handled by Stripe Checkout and the Stripe customer portal. Card details are entered on Stripe’s pages and never touch Guidepost. Stripe receives your email address and billing details and sends receipts. See the Stripe Privacy Policy.
ZeptoMail (Zoho Corporation) — sends our transactional email (sign-in links, trial and billing notices). ZeptoMail receives your email address and the content of each message. See the Zoho Privacy Policy.
Cloudflare, Inc. — every request to Guidepost passes through Cloudflare's network, which terminates HTTPS and provides DNS and DDoS protection. Cloudflare sees IP addresses and request metadata in transit. See the Cloudflare Privacy Policy.

No other third party receives the data. We do not share, sell or transfer it to data brokers, advertisers or analytics providers.

7. Retention

Access token and Account settings: kept while the Account is connected. Disconnecting (by the creator, or by removing Guidepost in Instagram) discards the token at once.
Media, Insights, audience and AI reports: kept while the Workspace exists, so reports can compare posts over time.
Comment, message and Delivery records: kept while the Workspace exists so the creator can confirm deliveries, resolve failed sends and see Leads. Deleted with the Workspace, or sooner on request (see Deleting data).
Sign-in links: expire after 15 minutes. Sessions: expire after 30 days without use and can be revoked earlier.
Server logs: kept for 30 days, then deleted.
Billing records: Stripe keeps invoices under its own policy. We keep the Stripe IDs until the Workspace is deleted.
Deleted Workspaces: everything is removed 7 days after deletion is requested.

8. Security

All traffic to Guidepost uses HTTPS.
Instagram access tokens are encrypted at rest with a key stored outside the database.
Incoming Instagram webhooks and Stripe events are verified with the sender’s request signature before they are processed.
There are no passwords. Sign-in links are single-use and short-lived; sessions are held server-side and can be revoked.
Every query is scoped to one Account, so one Workspace cannot read another’s data.

9. Cookies

The public parts of this site (the Bio page and short links) set no cookies and use no analytics or tracking. The private dashboard sets a single session cookie so you stay signed in.

10. Your rights

Depending on where you live, you may have the right to access, correct, export, restrict or delete personal data we hold about you, and to object to its processing. To exercise any of these rights, contact us using the details in Contact. We respond within 30 days.

11. Deleting data

Creators. You can delete everything yourself:

In the dashboard, open Settings → Delete workspace (the Workspace owner only). Instagram is disconnected and any subscription cancelled at once.
After a 7-day grace period the Workspace, its Account and all data listed above are permanently deleted. Short links from a deleted Workspace stop working.

Through Instagram. Removing Guidepost from your Instagram account (Settings → Website permissions → Apps and websites) disconnects the Account: the access token is discarded and Campaigns stop. If you also send a data deletion request there, Meta forwards it to us; we delete that Account’s data and return a confirmation code and a status page you can check.

Commenters, senders and visitors. Email us (see Contact) with your Instagram username and, if you remember it, the account or post concerned. We delete every comment, message and Delivery record linked to your username and Instagram-scoped user ID within 30 days and confirm by email. Blocking or restricting the creator’s account on Instagram stops further data reaching us.

12. Children

Guidepost is not directed at children. Creators must be at least 18. Instagram requires users to be at least 13, and we do not knowingly process data from anyone younger. If you believe we hold such data, contact us and we will delete it.

13. Changes

If we change this policy, we will update the date at the top of this page and, for material changes, email Workspace owners. Please check back periodically.

14. Contact

Questions, access requests or deletion requests: email hengj.94@gmail.com.