Privacy Policy

1. What we collect

Account and waitlist data. We collect the email address you provide when joining the waitlist or creating a Moments account, together with authentication identifiers and basic account settings. We use waitlist information to manage beta access and send requested product updates.

Personas, content and publishing data. We process the names, descriptions, reference images, prompts, generated images and videos, captions, schedules, publishing choices and related records you create in Moments. We use this information to provide generation, planning, download and publishing features.

Instagram professional account data. When you choose “Connect Instagram,” we redirect you to Instagram's authorization flow. If you authorize Moments, Meta may provide us with an access token and basic information about the professional account you selected, such as its Instagram account ID, username, account type, name, profile picture, media count and granted permissions, where available. We do not use this integration to access consumer Instagram accounts or unrelated information.

Technical and security data. We process IP address, browser and device information, timestamps, request and error information, and operational logs needed to secure, troubleshoot and operate Moments. Logs may include internal account, persona, connection and publishing identifiers and limited Instagram account information, but we do not intentionally write Instagram access tokens to application logs.

Advertising measurement. We use Google Ads conversion tracking to measure whether our ads lead to waitlist signups. If you arrived through one of our ads and join the waitlist, Google may receive a conversion signal, and with enhanced conversions, a hashed (one-way encrypted, unreadable) version of the email you submitted, used only to improve ad measurement.

Cookies and local storage. We use cookies and similar technologies for the analytics and advertising purposes above, and local storage to remember your preferences in the app.

2. Why we collect it (legal bases)

We process account, persona, generation, scheduling and publishing data to provide the service you request and perform our agreement with you. We process Instagram professional account data based on your explicit decision to connect an account and to perform the connection and publishing actions you request. We process limited technical and security data for our legitimate interests in protecting, maintaining and improving Moments. We rely on consent for analytics and advertising technologies where applicable law requires it. We also process information where necessary to comply with law or establish, exercise or defend legal claims.

3. How we use Instagram data

Moments uses the instagram_business_basic permission to confirm that you connected the intended Instagram professional account, display that account's identity in Moments, let you select the correct account for publication, and associate publishing requests with the account you authorized. Where you authorize publishing functionality, we use the applicable publishing permission only to create or schedule the publishing actions you request.

We access only accounts you explicitly authorize. We do not sell Meta Platform Data, use it to create advertising profiles, access consumer Instagram accounts, or retrieve unrelated information. We do not use Instagram access tokens or connected-account data to train general-purpose artificial intelligence models.

4. Who we share data with

We share data only as needed with service providers that operate Moments on our behalf:

• Supabase (account authentication and managed database services, including storage of encrypted Instagram access credentials and connected-account metadata)
• Google Cloud (application hosting, media storage, secrets management, security and operational logging)
• Google AI services (content generation requested by users; we do not intentionally send Meta Platform Data to these services)
• Google (Google Ads conversion measurement, including hashed emails through enhanced conversions)
• Our form and email infrastructure providers, used to store the waitlist and send you emails

We may also disclose information where required by applicable law, or to protect the rights, security and integrity of users, Moments or others. We do not sell personal data or Meta Platform Data and do not share it for third-party advertising.

5. Retention, disconnection and deletion

We retain account, persona and content data while your account is active and as needed to provide Moments. Publishing records may be retained to show status, troubleshoot failures, prevent duplicate actions and maintain an appropriate audit history. Waitlist emails are kept until the beta program ends or you ask to be removed, whichever comes first. Technical logs, analytics and advertising data are retained according to our configured retention periods and the applicable provider's retention settings.

When you disconnect Instagram, Moments immediately removes the stored access credential and marks the connection as disconnected so it can no longer be used for refresh or publishing. We may retain limited connected-account metadata and publishing history until you delete your Moments account or ask us to delete it, unless retention is required for security, legal compliance or dispute resolution. When you delete your Moments account, we delete the associated application state and stored media from our active systems. Residual copies may remain temporarily in protected backups and service logs until their ordinary deletion cycles complete.

6. Security and international processing

We use technical and organizational measures designed to protect personal data, including encrypted network connections, restricted service access and application-level encryption of Instagram access tokens before database storage. No online service can guarantee absolute security.

Our service providers may process information in countries other than your own. Where required, we rely on contractual and other lawful transfer safeguards made available by those providers.

7. Your rights and choices

Depending on where you live (including the UK and EU under GDPR, and certain US states), you may have the right to access, correct, delete, or receive a copy of your personal data, object to or restrict its processing, and withdraw consent at any time. To exercise any of these, email us and we will handle it: hello@gemzy.co.

You can disconnect an Instagram account inside Moments, request an export or deletion of your Moments account data, opt out of non-essential analytics and advertising technologies where available, and unsubscribe from product emails using the link in those messages. Disconnecting or deleting data in Moments does not delete content already published to Instagram; you must manage published content through Instagram.

8. Children

Moments is not directed at children under 16, and we do not knowingly collect their data. If you believe a child provided us data, contact us and we will delete it.

9. Controller, contact and changes

Gemzy determines the purposes and means of the processing described in this policy. For privacy questions, requests or complaints, contact privacy@gemzy.co.

If this policy changes materially, we will update the date at the top and, where appropriate, notify affected users by email or inside Moments.