Privacy
Last updated 15 September 2026
inStorify helps brands find retail stockists and manage the orders that follow. This explains what personal data we handle, why, and what you can ask us to do with it.
Who we are
inStorify is the data controller for your account, and a data processor acting on your instructions for the store data you bring with you. Reach us at [email protected].
What we process
| Data | Where it comes from | Why |
|---|---|---|
| Your account: name, email, workspace | You, at signup | To run your account and sign you in |
| Retail store contacts: business name, address, email, phone | Our store database, or a list you import | To send the outreach you compose, on your behalf |
| Outreach activity: sends, opens, clicks, replies | Generated as your campaigns run | To show you what's working and stop contacting people who've replied or opted out |
| Order email and customer name | Your connected Shopify store | To match an order to the retailer you contacted, and show you who ordered |
| Mailbox access: if you connect Gmail, Outlook or IMAP | You, by authorising it | To send from your address and detect replies |
We ask Shopify only for order email and customer first and last name. We do not request or store your customers' phone numbers or addresses.
What we don't do
- We don't sell personal data, and we never have.
- We don't market to your customers. The retailers we contact come from our own database or from a list you provide. Never from your Shopify customer data.
- We don't use your data to train AI models, ours or anyone else's.
- We don't share one brand's data with another. Every workspace is isolated.
Who we share it with
We use a small number of providers to run the service, each handling only what it needs:
- Gadget: hosting and database
- Amazon Web Services (SES): sending email and receiving replies
- Shopify: if you connect a store
- Google and Anthropic: the AI features: matching stores to your brief, and drafting suggested replies
We share data with them to provide the service, not for their own purposes. We'll also disclose data where the law requires it.
How long we keep it
- Account and workspace data: while your account is open. Deleted on request.
- Store contacts and outreach history: while your workspace is active.
- Shopify order email and customer name: while the store stays connected. Removed when we receive a redaction request, and automatically 48 hours after you uninstall the app.
- Opt-outs and bounces: kept indefinitely, on purpose. If someone asks never to be contacted again, we have to remember them in order to honour it.
Your rights
Depending on where you live, you can ask for a copy of your data, correct it, delete it, or object to how we use it. Email [email protected] and we'll respond within 30 days.
If you're a shopper who received an email from a brand using inStorify, the unsubscribe link in that email stops all further contact immediately, across every brand on the platform. You can also email us directly.
Security
Data is encrypted in transit and at rest by our hosting provider. Environments are separated, staff access is limited to those who need it, and we keep written retention and incident-response policies. If something does go wrong, we'll tell affected customers without undue delay.
Found a vulnerability? Email [email protected]. We won't pursue good-faith reports.
Changes
We'll update this page when what we do changes, and change the date at the top. If the change is significant, we'll tell you rather than rely on you noticing.