Privacy Policy

By accessing or using the Services, you agree to the practices described in this Policy. If you do not agree, please discontinue using our Services.

This Privacy Policy includes details on:

• The information we collect and how we use it
• The Instagram data we read when you connect your account
• How we use AI providers, and what our AI assistant connector reads and records when a brand admin connects Claude, ChatGPT or another AI assistant
• The third-party service providers that process your data
• How cookies and tracking tools are utilized
• How we share your information
• Your privacy rights and choices

3. Sharing Your Information

We do not sell or rent your personal information to third parties. However, we may share information under the following circumstances:

• Service Providers: We work with vendors that process information on our behalf and are required to use it only for the purposes we specify. They currently include Vercel and Amazon Web Services (hosting and file storage), Neon (database), Supabase (authentication), Stripe (payments), Mixpanel (product analytics), Sentry (error monitoring), Resend (email), Quo (text messages), Apify (collection of public Instagram content), and the AI providers described in Section 2
• Brands on Rendezvu: If you agree when you connect it, information from your connected Instagram account, including its insights and post statistics, is shown to users of brands on Rendezvu that are working with you or considering working with you (see Section 8). Public posts and comments that mention a brand may be shown to that brand's users. We use this information inside the Services only; we do not publish it outside of them or sell it
• AI Assistants You Connect: If you are a brand admin and you connect an AI assistant to Rendezvu, the results of the requests that assistant makes are sent to the AI provider you chose. If you are a host, information a brand can already see about you inside Rendezvu may reach that brand's AI provider the same way. See Section 9
• Legal Obligations: We may disclose information to comply with legal processes, protect our rights, or prevent fraud or abuse. See Requests from Public Authorities

Requests from Public Authorities

If a government or other public authority asks us for personal information, including information we receive from Instagram, we handle the request as follows:

• Legality Review: We review every request to confirm it is lawful, valid and properly issued before we respond
• Challenging Unlawful Requests: We challenge or decline requests we believe are unlawful, overly broad or not properly issued
• Data Minimization: When we must comply, we disclose only the minimum information the request legally requires
• Documentation: We keep a record of each request, our response, the legal basis we relied on, and the people and authorities involved

4. Cookies and Tracking Technologies

What Are Cookies?

Cookies are small text files stored on your device to help us understand user behavior, remember your preferences, and improve our Services.

Why We Use Cookies

• Keep you signed in and save your preferences and settings
• Analyze traffic and usage patterns through Mixpanel, our product analytics provider
• Detect errors through Sentry, our error monitoring provider
• Measure the performance of marketing campaigns

Managing Cookies

You can adjust your browser settings to limit or disable cookies. Note that certain features of the Services may not function properly if cookies are disabled.

5. Your Privacy Rights

You have the following rights concerning your personal data:

• Access and Updates: Request access to or correction of your personal data
• Data Deletion: Request deletion of your information by contacting us at support@rendezvu.co, or follow the steps on our Data Deletion page
• Opt-Out of Communications: Unsubscribe from marketing emails using the provided instructions or contact us directly

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Policy or as required by law. Data requested for deletion will be removed unless retention is legally or operationally necessary. Deleting your account also deletes the files you uploaded, such as photos, videos, and attachments, within 30 days, except where we are legally required to keep them.

7. Data Security

We implement industry-standard security measures to safeguard your data. While no system can guarantee absolute security, we continuously improve our safeguards to minimize risks.

8. Instagram Data

This section describes exactly what we read from Instagram when a host chooses to connect an Instagram account to Rendezvu, or a brand connects its own account, why we read it, how long we keep it, and how to delete it. It applies in addition to the rest of this Policy.

a. How the Connection Works

• Connecting is optional. A host starts it from their Rendezvu profile and signs in through Instagram Login (Business Login for Instagram)
• Only professional (Business or Creator) Instagram accounts can connect. Personal accounts cannot
• We request two permissions and nothing else: instagram_business_basic and instagram_business_manage_insights
• Our access is read-only. We never post, comment, send messages, or change anything on your Instagram account

b. Data We Read

• Profile: Instagram user ID, username, follower count, following count, and media count. We also check the account type when you connect, and show you your profile picture, without storing either
• Recent posts: For your 12 most recent posts, the media type, date, like and comment counts, and reach (plus views for videos). We use these only to calculate averages, such as likes, reach and engagement per post and how often you post, and we do not store the posts themselves
• Account insights: Reach, views, accounts engaged, and total interactions over the last 28 days

We do not read your captions, comments, messages, stories, or audience demographics. We read the data above about once a day for as long as you remain connected.

c. Why We Use It

If you agree when you connect, your Instagram stats are shown to brands on Rendezvu that are working with you or considering working with you, including brands you have not worked with before. We keep a record of that agreement: the wording you were shown and when you agreed. If you do not agree, you can still see your own stats, but we do not store them or show them to brands. We use your Instagram data:

• To show those brands your follower count and how your audience interacts with your profile and your posts, labelled as coming from your connected account
• To help match hosts with brands, including the host recommendations brands receive
• To show you your own stats

We do not sell Instagram data and we do not use it for advertising targeting. Other than showing it to brands inside Rendezvu as described above, we do not share it with third parties, except service providers under contract: those that host our infrastructure (such as our database and hosting providers), and the AI providers described in Section 2, which process it only to run features such as the brand assistant and host recommendations and may not use it to train their models.

d. Security

Access tokens are encrypted at rest using AES-256 and are refreshed automatically about every 50 days.

e. Retention and Deletion

• While you are connected, we keep a daily snapshot of your stats for up to 90 days. Older snapshots are deleted automatically
• When you disconnect, we delete your access token immediately and stop collecting data. Instagram-sourced stats are deleted within 30 days
• You can disconnect in Rendezvu, or in Instagram under Settings, then Apps and websites, by removing Rendezvu
• Deleting your Rendezvu account also deletes this data
• You can also request deletion on our Data Deletion page or by emailing support@rendezvu.co

f. Brands Connecting Their Own Account

A brand admin can connect the brand's own professional Instagram account in the brand console, with the same two permissions. We read the data listed in (b) for that account and show it only to that brand's team on Rendezvu, including through AI assistants its admins connect (see Section 9). It is never shown to hosts or to other brands. Disconnecting and deletion work as described in (e).

9. AI Assistant Connectors

Rendezvu runs a connector, built on the Model Context Protocol (MCP), that lets a brand admin connect Rendezvu to a third-party AI assistant such as Claude (by Anthropic) or ChatGPT (by OpenAI) and ask it questions about their own brand's Rendezvu data. This section describes what the connector reads, what we record, and what is shared with the AI provider. It applies in addition to the rest of this Policy.

a. Who Can Connect and How

• Connecting is optional and is available only to Rendezvu accounts with active brand admin access. Host and shopper accounts cannot connect
• You sign in on a Rendezvu page with your Rendezvu email and password or with Google. Your AI provider never sees your Rendezvu password, and we never see your AI provider password
• We then issue your AI assistant an access token that expires after one hour and a refresh token that expires after 30 days and is replaced each time it is used. We store only one-way hashes of these tokens
• The connector is read-only. It cannot create, change or delete anything in Rendezvu

b. Data the Connector Can Read

Every request is limited to the brands you administer, and that limit is checked again on every request. The connector can return:

• Your brand's performance data: attributed sales, orders and commissions, click and conversion analytics, and host performance for your brand
• Your campaigns: opportunities, including briefs, deliverables, payment terms, the hosts assigned and their codes
• Your gifting records: if your plan includes gifting, the gifts you sent, their status and tracking, and the recipient name and shipping address a host submitted to receive the gift
• Your saved brand preferences (brand skills) used to give the assistant context
• Public Rendezvu information: public gear lists, product recommendations and endorsement notes that hosts publish (which can mention any brand), our public documentation, and Rendezvu's own logos

The connector never returns passwords, payment card details, or host email addresses or phone numbers, and it never returns another brand's sales, clicks, campaigns or gifts.

c. What We Record

• The connection: the name the AI client registers with (for example, "Claude"), its redirect address, and the hashed tokens with their issue, expiry and last-used times
• An activity log: for each request, the time, your account, the brands in scope, the AI client name, the name of the tool used, whether it succeeded (with a short error excerpt if it did not), and how long it took. We use this log for security, abuse prevention, support, and improving the connector
• We do not receive your conversation with the AI assistant, only the requests it makes to Rendezvu, and our activity log does not store the contents or results of those requests

d. Sharing With Your AI Provider

When your AI assistant uses the connector, the results are sent to the AI provider you connected, which processes them under its own terms and privacy policy, including its settings for data retention and model training. Rendezvu does not control how the provider handles your conversations. See the Anthropic Privacy Policy and the OpenAI Privacy Policy. We do not sell connector data, and we do not share it with anyone else except the service providers that host our infrastructure.

If you are a host, information that a brand you work with can already see about you inside Rendezvu, such as your performance for that brand, your participation in its campaigns, and the shipping address you submitted to accept its gift, may be retrieved by that brand's admins through the connector and processed by their AI provider.

e. Retention and Disconnecting

• Expired and revoked tokens can no longer be used. We keep connection records and the activity log only as long as needed for the purposes above, then delete or de-identify them
• You can disconnect at any time in your AI assistant's settings
• If your brand admin access ends, the connector stops returning data on the next request, even if a token has not yet expired
• To revoke every connector token on your account, or to request deletion of connector records, email support@rendezvu.co

10. Email Marketing and Host Following

When you click the "Follow" button on a host's profile, you are agreeing to receive email communications from that specific host. Here's what this means:

• Content-Only Communications: You will receive emails containing recommendations, insights, and content updates from the hosts you choose to follow
• No Marketing Lists: We will not add your email address to general marketing lists or promotional campaigns. Your email will only be used for communications from the specific hosts you follow
• Privacy Respect: We greatly respect your privacy and ensure that following a host only results in receiving their content updates, not broader marketing materials
• Selective Updates: You will only receive updates from the people you actively choose to follow. Each host's communications are separate and targeted
• Unfollow Option: You can unfollow any host at any time to stop receiving their communications by contacting us at support@rendezvu.co

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Updates will be posted on this page, and the "Last Updated" date will be revised accordingly.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at support@rendezvu.co