Who is responsible
Stepinway operates Stepinway Social at insta.retrina.com. Our contact address is Office 708, International Business Tower, Business Bay, Dubai, United Arab Emirates. Contact [email protected] for privacy questions. This policy covers this service, including visitors, customers, team members and people whose messages or comments are processed through an authorised connected account.
Information you provide
We collect registration details such as your name, email address and password hash; workspace and team permissions; page details; uploaded content, drafts, brand instructions and knowledge documents; and information you submit in support or privacy requests. Please provide only information you are authorised to share.
Information from Instagram
When a working integration is enabled and authorised, we may process account identifiers and profile details, media and captions, comments, conversation and message content, associated participant identifiers, timestamps and available performance metrics. The actual data depends on Meta permissions and your use of each feature. Connection tokens are used to access authorised services. We do not ask for your Instagram password.
How information is used
We use information to create and secure accounts, separate workspaces, apply page permissions, display and analyse authorised page activity, prepare content or reply suggestions, carry out authorised actions, and respond to requests. Where applicable law requires a legal basis, these activities rely on providing the requested service, consent for optional integrations, legitimate security and operational interests, or legal obligations, as appropriate.
AI-assisted features
When you use an enabled AI feature, relevant message text, instructions, brand knowledge or content prompts may be sent to OpenAI to generate a response or draft. Avoid sending sensitive information that is unnecessary for the task. AI output can be inaccurate and should be reviewed. Provider processing is also governed by the provider’s applicable terms and privacy documentation. We do not claim that every provider keeps no logs.
Who can access information
Authorised workspace members see data according to their assigned permissions. Service administrators may access information for support, security and operation. Hosting and infrastructure providers process information needed to run the service; Meta processes authorised integration requests and OpenAI processes enabled AI requests. Our deployed site uses Cloudflare for web delivery and security. Information may also be disclosed where required by law or to protect legal rights. We do not sell personal information.
Cookies, logs and security
We use session cookies to support login, forms and language preferences. Server and security logs may contain IP addresses, browser details, request times and errors. Contact forms use anti-abuse controls. We apply access controls, password hashing and encrypted storage for configured integration secrets. No system can guarantee absolute security. Report suspected vulnerabilities through Contact us using the security category.
Where data is processed
The service is operated from the UAE. Hosting, infrastructure and connected providers may process information in other countries. Applicable protections and provider arrangements depend on the services used. Contact us if you need information about processing relevant to your account.
Retention
Account and workspace information is retained while needed to provide the service. Support requests, security records and backups may be retained as needed to resolve issues, protect the service or meet legal obligations. There is currently no universal automatic expiry for workspace records. Verified deletion requests are handled by administrators; limited information may need to be retained for legal or security reasons, which we will explain where applicable. Backup removal follows the applicable backup lifecycle, rather than an instant deletion promise.
Your choices and requests
You may request access, correction, deletion or information about your data through Contact us or [email protected]. Where applicable, you may also object to or restrict processing, withdraw consent or complain to your relevant supervisory authority. These options are available even if you cannot sign in. We may ask for proportionate proof that you control the relevant account before disclosing or deleting data. See Data deletion for instructions.
Connected-page visitors
If you messaged or commented on a connected business page, you can identify that page and your Instagram username in a request. The business may separately control its own records; this policy does not govern copies it holds outside our service.
Children and updates
This service is intended for adult business users, not children. Contact us if you believe a child has provided personal information. We may update this policy as the service changes; the updated version and date will appear here.