Privacy policy

Final Touch Social is run by Final Touch Websites, Calgary, Alberta, Canada ("we"). This policy says what we collect, why, and what we do to keep it safe. It is written to be read, not skimmed, and it is short because we collect little.

What we collect

• Your application: if you apply for a spot, the business name, city, email, Instagram handle and website you give us, and what you write about your business. We use it to decide whether we're a good fit and to invite you. If we don't invite you, you can ask us to delete it at any time.
• Your account: your name and email address and, if you sign in with Google, the name and profile picture Google provides. We never have a password for you: sign-in is by a one-time email link or Google.
• Your business profile: what you tell us about your business (name, city, what you sell, who it is for, tone, brand colours, logo) so we can write and design posts for it.
• Your Instagram connection: when you connect a professional Instagram account through Instagram's own login, Instagram gives us your account id, username and an access token that lets us publish to your account and read your recent posts. We never see your Instagram password.
• Posts: the drafts we write, your edits, and what was published, with Instagram's basic numbers for each post (reach, views, likes, comments, saves, shares) so you can see how it did. We record these once a day for a post's first 30 days, so you can see how a post grew and not only where it ended up.
• Your account's numbers: once a day, your follower count and Instagram's account totals for the day (reach, profile views, website taps). Instagram does not keep this history for you, so we keep it from the day you connect. We also look at these numbers across our customers, in aggregate, to learn what kind of post works for what kind of business; we never publish or share one business's numbers.
• Security records: sign-ins, connections and disconnections, publishes and failures, with the time, IP address and browser type. Never the content of emails or tokens.
• Billing: handled by Stripe. We keep your Stripe customer id and subscription status. We never see or store card numbers.

How we use it

• To write and design posts for your business, using an AI model (Anthropic's Claude) that receives your business profile and your edits. We do not permit the provider to train on your data.
• To publish approved posts to your Instagram account on your schedule, and to read your recent posts so we never flood your feed or repeat ourselves.
• To show you what is scheduled, what was published and how it did.
• To keep the service secure and to answer your questions.

We do not sell your data, show you ads, or use your data to market to anyone else.

Email we send you

Sign-in links, "your week is ready", invitation and application emails, and replies to your questions. Nothing else: no newsletters and no promotions unless you ask for them. Every non-essential email says how to stop it; replying "stop" to any of them works too. Weekly emails stop when you pause or cancel.

Cookies and tracking

Only the cookies needed to keep you signed in and to complete sign-in and Instagram connection safely. No analytics, no advertising pixels, no third-party scripts in your browser. Details in the cookie policy.

How we protect it

• Your Instagram access token is encrypted at rest (AES-256-GCM) with a key that is not stored in the database. It is never written to logs and is never displayed, including to us.
• Everything is served over HTTPS. The application sets a strict content-security policy and other browser protections.
• Sign-in links work once and expire in 10 minutes. Sessions can be revoked by signing out.
• Each customer's data is separated by account; our code never looks up another customer's data on your behalf.

Who else touches your data

Only the services needed to run the product, each under its own privacy terms:

• Vercel (hosting and temporary image storage, United States)
• Neon (database, United States)
• Inngest (scheduling of posts; receives only ids, never tokens or content)
• Anthropic (writing drafts from your business profile)
• Resend (sending our emails)
• Google (only if you choose to sign in with Google)
• Meta / Instagram (publishing to your account)
• Stripe (payments)

Some of these are in the United States; your data may be stored or processed there under their terms.

Children

Final Touch Social is a service for businesses and is meant for adults. You must be 18 or older to create an account. We don't knowingly collect information about anyone under 18; if we learn we have, we delete it.

How long we keep it

• Your Instagram token: until you disconnect, revoke access from Instagram, or your subscription ends. Deleted immediately in each case.
• Rendered images: only while Instagram needs to fetch them, then deleted.
• Everything else: while you have an account, and up to 30 days after you ask us to delete it. Invoices as long as Canadian tax law requires.

Your rights

You can see, correct, export or delete your data at any time. Most of it you can change yourself in the app; for the rest, email hello@finaltouchwebsites.com. See data deletion for the steps. We follow Canada's PIPEDA and Alberta's PIPA. If you are not satisfied with how we handled a request, you can contact the Office of the Information and Privacy Commissioner of Alberta.

Changes

If this policy changes in a way that matters, we email you before it takes effect.

Contact

Final Touch Websites · Calgary, Alberta, Canada · hello@finaltouchwebsites.com