Privacy Policy

1. Scope

GainDesk is a workspace for fitness coaches and related businesses to organize Instagram direct-message conversations, track prospects, prepare replies, create follow-up tasks, and generate internal sales insights. This Privacy Policy applies to information processed through GainDesk.

Instagram and Meta process information under their own terms and privacy policies. This policy describes GainDesk's processing after information is made available to GainDesk through the Instagram API or entered into GainDesk by a workspace user.

2. Information We Process

Depending on how GainDesk is used, we may process the following categories:

• Account and workspace information: account email address, name, workspace membership, role, business profile, booking link, offer details, qualification rules, tone preferences, and reply templates.
• Instagram professional account information: Instagram account identifier, username, profile image URL when available, account type when available, connection status, access token, and connection or synchronization timestamps.
• Instagram direct-message information: conversation and message identifiers, participant identifiers, usernames or names when made available by Instagram, message text, attachments indicators, message direction, timestamps, and technical webhook payloads.
• Workspace records: prospect status, lead score, notes, tags, follow-up tasks, saved reports, reply drafts, sent replies, and internal activity records.
• Billing information: subscription plan, subscription status, Stripe customer and subscription identifiers, billing event records, and related timestamps. Payment-card details are handled by Stripe and are not stored directly by GainDesk.
• Technical and diagnostic information: synchronization results, integration errors, webhook events, and security-related request information needed to operate and troubleshoot the service.

3. Instagram Professional Account Integration

Connecting Instagram is optional. GainDesk uses Instagram API with Instagram Login for professional accounts. GainDesk does not require Facebook Page Login for this integration.

GainDesk currently requests these Instagram permissions:

• instagram_business_basic to identify and display the connected professional Instagram account.
• instagram_business_manage_messages to receive, synchronize, display, and send Instagram direct messages on behalf of the connected professional account.

When an account is connected, GainDesk stores the Instagram access token server-side and uses it to perform authorized Instagram API requests. The access token is not intentionally returned to the browser through the connected-account status endpoint.

4. How Information Is Used

GainDesk uses information to:

• authenticate users and provide authorized workspace access;
• connect and manage Instagram professional accounts;
• receive, synchronize, organize, display, and send Instagram messages;
• create prospect records, follow-up tasks, internal notes, and reports;
• prepare AI-assisted conversation analysis and reply drafts;
• send automatic replies only when an authorized workspace user enables available autopilot functionality;
• provide subscription, billing, administration, and usage features;
• secure, maintain, debug, and improve the service; and
• comply with legal obligations and enforce applicable agreements.

Instagram message content may be processed to produce lead insights, summaries, recommendations, and suggested replies. Workspace users remain responsible for reviewing GainDesk outputs and using the service lawfully.

5. Service Providers and Disclosure

GainDesk may disclose information to service providers when necessary to operate the service. Current integrations in the application include:

• Meta and Instagram for professional-account login, authorized API operations, and webhook delivery;
• Supabase for authentication and application data storage;
• Anthropic when configured for AI-assisted analysis or reply generation; and
• Stripe for checkout, customer, subscription, and billing operations.

GainDesk may also disclose information when required by law, to respond to valid legal process, or to protect the rights, safety, and security of GainDesk, its users, or others.

6. Retention, Disconnecting Instagram, and Deletion

GainDesk retains information for as long as reasonably necessary to provide the service, maintain security, comply with legal obligations, resolve disputes, and enforce agreements. Retention may vary by data category and the reason the information is held.

A workspace user can remove a connected Instagram account from GainDesk. Removing or deauthorizing an Instagram connection stops future authorized use of that account token. Existing workspace conversations or business records may remain unless a deletion request is made and applicable retention obligations permit deletion.

Meta may send GainDesk an Instagram data-deletion request at:

https://getgaindesk.com/api/meta/data-deletion

That callback processes Meta's signed request and returns a confirmation URL. For a broader request to delete GainDesk workspace data, use the contact method below. A request may require identity or authority verification before action is taken.

7. Security

GainDesk uses technical and organizational measures intended to protect information. These include authenticated workspace access, server-side handling of integration credentials, access controls for workspace data, webhook-signature verification when configured, and restricted service-role operations. No method of storage or transmission can be guaranteed to be completely secure.

8. Your Choices and Requests

Depending on your relationship with GainDesk and applicable law, you may request access, correction, or deletion of information associated with GainDesk. Workspace administrators may also remove an Instagram connection from the GainDesk settings page.

If your information appears in a conversation managed by a business using GainDesk, you may contact that business directly or contact GainDesk using the method below so that the request can be evaluated and routed appropriately.

9. Children

GainDesk is a business workspace and is not directed to children. Do not use GainDesk to intentionally collect information from children in a manner that violates applicable law.

10. Changes to This Policy

This Privacy Policy may be updated from time to time. The date at the top of this page indicates when it was last revised. Material changes should be communicated as appropriate for the nature of the update.

11. Contact

For privacy questions or requests, contact the GainDesk representative or support channel through which you communicate with GainDesk and identify the request as a privacy or data-deletion request. Include enough information to identify the relevant GainDesk workspace or connected Instagram account. Do not include passwords or Instagram access tokens.

Website: https://getgaindesk.com