Privacy Policy

Who is responsible

Influmatik (www.influmatik.com) is published by Oneiric Supply LLC, a New Mexico (USA) limited liability company, registered with the New Mexico Secretary of State, principal office: 8206 Louisiana Blvd NE, Suite A, Albuquerque, NM 87113, USA, the data controller for the processing described here.

Privacy contact: contact@influmatik.com.

Creators' own pages (sites, courses, funnels, newsletters, notices under /legal/…) have their own notices: for their audience's data, the creator is the controller and Influmatik acts on their behalf as a processor.

Your account and creator workspace

• Name, email address and password (stored hashed, never readable).
• Login sessions (IP address and browser, kept for security; a session lasts 30 days).
• Your workspace content: profile, niche, declared social accounts, ideas, scripts, calendar, brand kit, products, results you enter, invited members (their address receives the invitation email).
• If you join another creator's workspace: your arrival, visits, what you launch there and its credit usage are visible to its owner, who can remove your access.
• Your credits and their history, and your referral code.
• Against serial sign-ups (at most 3 welcome bonuses per connection per day), a truncated IP address (last digits erased, never the full address) and the outcome of the check, not linked to your account, deleted after 30 days.
• Your acceptance records: the version of the terms you accepted, and each "I have reviewed this content and I am solely responsible for it" attestation (content and its version, date, a hash of your IP address, never the address itself), kept while the account exists and then 5 years as evidence in case of dispute.

Legal basis: performance of the contract (Terms of Use). Kept while your account exists; deleted with all workspace content on request.

Free audit

You enter an Instagram or TikTok handle: we read its public data (profile, recent posts and their visible stats) through the Apify scraping service, and Claude (Anthropic) writes the analysis. No login to the audited account is requested.

• The report is stored with a share link; the profile picture and displayed thumbnails are copied to our storage (Vercel Blob), because platform links expire.
• To prevent abuse (3 audits per day per IP address), we keep a non-reversible hash of the IP address, never the address itself.
• Your email is optional and used to send the report. Follow-ups (day 1, 3 and 7; at most 3 emails over 10 days) are only sent if you tick the dedicated box, never pre-ticked.

Legal bases: legitimate interest (providing the requested audit, preventing abuse); consent for follow-ups, withdrawable from any email. Retention: email and consent proof 3 years after your last contact; report while its share link is in use, deleted on request.

Audited without asking for it? Email us and we delete the report.

Newsletter and waitlist

With your consent (dedicated, unticked box) we keep your email, the chosen newsletter, the social handles you give, and proof of consent (text shown and date). Emails are sent through Brevo. Legal basis: your consent. One-click unsubscribe in every email. Kept 3 years after your last contact; never sold or shared.

The link that brought you

When you arrive through one of our links (an Influmatik Instagram or TikTok account, a campaign, the badge on a creator's site) or through an ad, we remember that link for 30 days in a cookie: the Influmatik account (src), the campaign (utm_source, utm_medium, utm_campaign, utm_content) and the click ID that Meta, TikTok or Google add to the link (fbclid, ttclid, gclid). It is stored with your signup (account, waitlist, newsletter, free audit) so we know which links work.

On the home page, we show one of our 5 versions of the page at random and remember it for 90 days in a cookie, so you see the same one again. The version you saw is stored with your signup, separately from the link that brought you, so we know which one speaks best.

It is never sent to Meta, TikTok or Google, nor used to follow you on other sites. Legal basis: legitimate interest. Kept as long as the signup it belongs to.

Smart inbox

If you connect an email address, we receive messages sent to it (sender, subject, text, attachment list). Claude sorts, summarises and drafts replies; you approve them, or Autopilot sends them under the rules you set.

• Mailbox access tokens (e.g. Hostinger) are encrypted at rest.
• Spam and blocked senders: deleted after 30 days.
• Email content (text, subject, summary, draft, reply): erased 12 months after the last exchange; only minimal statistics remain (sender domain, category, dates).

Telegram and WhatsApp notifications

If enabled, we send summaries of important emails to Telegram or WhatsApp (Meta), where you can approve a reply. We keep the chat identifier and notification links (deleted after 90 days). You can disconnect the channel at any time.

Instagram connection (Meta API)

If you connect your professional Instagram account (Instagram API with Instagram Login), with your permission we read once a day your profile (username, account type, followers, media count), your media (caption, type, permalink, timestamp, likes, comments) and insights (reach, views, interactions, followers gained) to power your Statistics tab.

• We never publish, comment or send messages on your behalf, except what you trigger yourself: publishing a post you confirm, or the comment and message automation described in the next section.
• The access token is encrypted at rest (AES-256-GCM) and refreshed automatically.
• Data is shown only to you and your workspace members, never sold or shared.
• Disconnecting from your profile, or removing Influmatik in Instagram (deauthorize callback), deletes the token immediately; statistics already collected stay in your workspace.
• A data deletion request from Instagram deletes the connection, statistics and imported media immediately and returns a status page with a confirmation code.

Legal basis: performance of the contract, at your request. Kept until disconnection, workspace deletion or a deletion request.

Instagram comments and messages

A creator can enable, for a keyword, an automatic reply to the comments and messages received on their Instagram account. If you comment on or write to that account, your data is processed by Influmatik on the creator's behalf, as a processor: the creator is the controller. We never publish, comment or send anything from your own account.

What we receive from Instagram (Meta): your app-scoped Instagram id, your username, the text of your comment or message, the media concerned, whether you follow the creator's account, and timestamps. Your email address and first name only reach us if you enter them yourself on the guide's page, with your consent (dedicated, unticked box; separate newsletter box).

• Purpose: replying to your comment and sending you the guide you asked for. No prospecting and no unsolicited message: every message replies to a comment or a message you sent, within the time limits set by Meta.
• Send "STOP" in the conversation: no automated message is sent to you any more ("START" resumes them).
• Legal bases: the creator's legitimate interest in answering those who write to them; your consent for your email address and for the newsletter, withdrawable at any time.
• Retention: comments, messages and automated replies are deleted after 180 days; contacts without any exchange for 365 days are deleted; an email address left on the guide's page is kept 3 years after your last contact, as for the creator's funnel.
• Recipients: Meta (Instagram), Brevo (guide delivery by email), Vercel and Neon (hosting).

Your rights (access, rectification, erasure, objection) can be exercised with the creator, or by emailing contact@influmatik.com: we forward the request and answer within one month.

Credits for a story or a post

If you declare a share, we store the chosen media (identifier, link, date), your Instagram username, your follower count and its views. With Instagram connected, we read your active stories and recent media, then the views of the chosen one and whether it is still online (24 hours for a story, 30 days for a post). Otherwise, you send us two screenshots and the view count, reviewed by the Influmatik team.

We also count visits arriving through your referral link (a total, without identifying visitors).

Legal basis: performance of the contract, at your request. Screenshots are deleted 90 days after the declaration; the rest is kept while your workspace exists.

Trend monitoring and reports

To find what works in a niche we read public posts every night, or when a creator taps “Actualiser ma veille” (refresh), from reference accounts chosen by creators and for niche reports, through Apify and Scrape Creators: caption, visible stats, account name. When a creator tells us which accounts inspire them, we read their latest public posts through Apify to derive a style profile (formats, pacing, tone), kept in their workspace and never published. Public reports only cite public content and link to its author. Legal basis: legitimate interest. Quoted and prefer not to be? Email contact@influmatik.com.

“Analyze an account”: at a creator's request, we search public Instagram or TikTok profiles and read the latest public videos of the chosen account (profile, captions, visible stats) through Apify, to show which ones performed best. This public data is cached (reused for a few days to avoid reading it again) and the result stays in the creator's workspace, never published.

Reporting content (/signaler): we keep the reported address, the reason, your description, your email if you give it and a hash of your IP address (against abuse), to handle the report and meet Digital Services Act obligations. Legal basis: legal obligation. Kept 2 years after the decision.

Artificial intelligence

Your inputs and the data needed for a generation are sent, at generation time, to:

• Anthropic (Claude): scripts, ideas, analyses, audits, reports, email sorting and replies;
• Kie.ai, ElevenLabs and Higgsfield: images, voice and video, from your prompts and any reference images you provide.

These providers process the data to deliver the service to us. No decision with legal effects on you is fully automated: you review what is published or sent, unless you enable Autopilot yourself.

Shop and payments

When the shop is open, an order stores products, customisation, amount and shipping address. Payments are processed by Stripe; we never see or store card numbers. Legal basis: performance of the order; accounting records are kept for the legal period (10 years).

Courses and guides

To sell with Stripe, you open a Stripe Express account (Stripe Connect): Stripe itself collects and verifies your identity and bank details, under its own privacy policy. Influmatik only keeps the account identifier, its country and its status (onboarding completed, payments and payouts enabled, information requested by Stripe).

If you connect a sales platform (Lemon Squeezy or Whop), we keep its webhook address specific to your workspace, its signing secret (encrypted at rest, AES-256-GCM), your account identifier on the platform and the last event received. For each sale, the platform sends us the buyer's email and name, the amount and the order number, so the guide can be delivered.

Your buyers' data, whether students of your courses or readers of your guides (email, name, purchases, access, lesson progress, guide opens), is processed by Influmatik on your behalf, as a processor: you are the controller, and the privacy policy generated for your site explains it to them. A guide buyer joins your workspace's fans without being subscribed to your newsletter. Stripe payments go through its secure page: we never see card numbers. Your videos are kept in private storage (Vercel Blob) and can only be played through temporary links.

Legal basis: performance of the contract (selling your courses and guides, paying out your revenue). Kept while your workspace exists; sales accounting records for the legal period (10 years).

Creators' email campaigns

A creator can announce a new guide, programme or update to the people on their list. For these people, the creator is the controller and Influmatik acts on their behalf as a processor. Only contacts who agreed to receive the creator's news and offers (separate box, never pre-ticked) receive a campaign; never those who only asked for the guide, nor buyers without that consent.

For the creator, we record the text of each campaign (drafted with AI, reviewed by them), the chosen audience and, per recipient: the send, the open (measured by Brevo, approximate), the click on the button, unsubscribes, address errors, and any purchase of the announced product within the following 7 days.

• One-click unsubscribe in every email (link and header recognised by mailbox providers); an address that bounces or reports spam is never contacted again.
• Legal bases: the recipient's consent for sending; the creator's legitimate interest for statistics.
• Retention: per-recipient tracking while the campaign exists in the workspace; deleted with the contact.
• Sender: the creator's address on their own domain or, failing that, an address in their name assigned by Influmatik (for example enki-fit@mail.influmatik.com), shown with their brand name. Replies go to the creator's contact address; a reply written directly to the assigned address is received by Brevo and filed in the creator's Influmatik inbox (sender, subject, text, list of attachments, never their content), with the same retention as the inbox.
• Recipients: Brevo (sending, open tracking and receiving replies), Anthropic (drafting the text, without recipients' addresses; sorting received replies if the creator uses the inbox), Vercel and Neon (hosting).

Appointment booking and calendars

If you open your booking page, your guests' data (name, email, phone when requested, message, answers to the questions you ask before booking, time slot, time zone, text of the ticked box) is processed by Influmatik on your behalf, as a processor: you are the controller, and the privacy policy generated for your site explains it to them. It is used for confirmations, reminders and changes, and deleted 12 months after the appointment.

To only offer your free slots, you can link your calendar: through its secret iCal address, or by connecting Google Calendar or Outlook. We only keep busy times (start and end), never titles, locations, attendees or descriptions. The iCal address and connection tokens are encrypted in our database (AES-256-GCM); with Google or Outlook, we also add each booked appointment to your calendar, and remove it if it is cancelled.

• Imported busy times are replaced at each read (about every 10 minutes) and erased when you remove the calendar.
• The iCal feed of your appointments is a secret address only you know; you can change it at any time.
• Disconnecting Google or Outlook from your Appointments page erases the tokens immediately.

Legal basis: performance of the contract, at your request. Kept while the calendar stays linked or your workspace exists; appointments: 12 months after their date.

Hosting and service providers

We sell no data. Only these providers have access, for their task:

• Vercel: hosting and functions (Frankfurt region), file storage (Vercel Blob), anonymous cookie-free audience measurement (page views, country, device type; nothing that identifies you);
• Neon: PostgreSQL database (Frankfurt, eu-central-1);
• Anthropic, Kie.ai, ElevenLabs, Higgsfield: AI generation;
• Apify: public Instagram and TikTok data;
• Scrape Creators (United States): public Instagram and TikTok posts for trend monitoring;
• Brevo: email delivery;
• Meta (Instagram, WhatsApp), Telegram, Hostinger, ManyChat: only if you connect them;
• Google (Google Calendar) and Microsoft (Outlook): only if you connect your calendar for appointment booking;
• Stripe: shop, course and guide payments, Stripe Connect accounts of creators who sell with Stripe;
• Lemon Squeezy and Whop: guide sales platforms, only if you connect one (they send us your sales).

Transfers outside the EU

Data is hosted in the EU (Frankfurt). Some providers, notably US-based ones (Anthropic, Vercel, Neon, Scrape Creators and others), may access it from outside the EU. Such transfers rely on GDPR safeguards: a European Commission adequacy decision where applicable, otherwise standard contractual clauses.

Cookies

No advertising cookies and no trackers from other sites. Our cookies run the service; three remember the link that brought you and the version of the home page (see “The link that brought you”):

• better-auth.session_token: your login (30 days);
• influmatik_ref: referral or affiliate link clicked (60 days);
• influmatik_src: the Influmatik Instagram or TikTok account that brought you (30 days);
• influmatik_page: the version of the home page you were shown, so you see the same one again (90 days);
• influmatik_utm: the campaign or ad that brought you (utm_*, click ID; 30 days);
• influmatik_audits: free audits you unlocked (1 year);
• influmatik_email: email left on an audit (30 days);
• ig_oauth_nonce: Instagram connection security (10 minutes);
• rdv_oauth_nonce: Google or Outlook calendar connection security (10 minutes);
• ig_connect_started: marks the start of an Instagram connection so help can be shown if it does not complete (2 hours at most);
• influmatik_demarrage: setup steps already celebrated and whether the setup card is hidden (1 year);
• prompteur: teleprompter settings (1 year);
• influmatik_theme: your light, dark or system display choice (1 year);
• im_eleve: a student's login to their courses, on a creator's site only (90 days).

The browser also keeps a few display preferences (local storage).

Your rights

You can access, correct, delete or export your data, object to processing based on legitimate interest, restrict it, and withdraw consent at any time. Email contact@influmatik.com; we answer within one month. You may also lodge a complaint with the CNIL (www.cnil.fr) or your local data protection authority.

Security

Encrypted connections (HTTPS), hashed passwords and encrypted access tokens, data separated per creator workspace, access limited to those who need it.

Minimum age

Influmatik is for people aged 15 and over.

Changes

When this policy changes, its version date changes; for significant changes we notify you by email or in the app. The French version prevails.