Privacy Policy — Instagram Feed & Widget

Effective 2026-09-15.

This app ("Instagram Feed & Widget", "igwidget") lets a Shopify merchant display their own Instagram content on their storefront. This policy explains what data we access, why, and how long we keep it.

What we do not collect

• We do not request any Shopify customer, order, or checkout data. The app's Shopify access scope is limited to read_themes (used only to help place the storefront widget via the Shopify Theme Editor).
• We never ask for, and never store, an Instagram password.
• We do not track individual storefront visitors: no cookies, IP addresses, or device identifiers are stored for the widget's view-count reporting feature — only an aggregate daily count per widget.

What we do collect, and why

• Your Shopify store domain — to identify your account and associate your widgets and Instagram connection with your store.
• Your connected Instagram account's username, profile picture, and account type — obtained via Meta's official Instagram API with Instagram Login, after you explicitly authorize the connection. Used to display your profile info on your widgets.
• An encrypted Instagram access token — required to fetch your media on your behalf. It is encrypted at rest (AES-256-GCM) and never exposed to your storefront or logged in plain text.
• A cached copy of your recent Instagram posts (image/video URL, caption, timestamp, permalink) — so your storefront widget loads fast and keeps working even if Instagram is briefly unavailable. This cache refreshes automatically and expires on a schedule tied to your plan.
• Your widget configuration (design, layout, colors, text) — what you set up in the app.

How long we keep it

Data tied to a connected Instagram account is deleted immediately when you disconnect that account from the app. When you uninstall the app, your shop is marked uninstalled right away; Shopify's mandatory shop/redact webhook (sent roughly 48 hours after uninstall, per Shopify's process) triggers a full deletion of every remaining record tied to your shop — Instagram accounts, tokens, widgets, and cached media.

Third parties

Data is exchanged only with Meta (to authenticate and fetch your Instagram media) and Shopify (for app installation, billing, and theme integration). We do not sell or share your data with anyone else.

Your rights

You can disconnect your Instagram account at any time from the app's Instagram Accounts page, which deletes that account's data immediately. Uninstalling the app removes everything else. For any other request (including a GDPR data request or deletion request), contact us at support@artvibe.site.

Contact

Questions about this policy: support@artvibe.site.