Privacy Policy

Beavly ("Beavly," "we," "us") is operated by MB Dropkeyz, based in Lithuania. This Privacy Policy explains what information we collect when you use Beavly (at beavly.app), why we collect it, how we use and protect it, and the rights you have over it.

1. Who this applies to

Beavly is used by social media managers, agencies, and independent creators ("account holders") to track Instagram performance for the brands, clients, or their own accounts they manage. This policy covers both the account holder who signs up for Beavly, and the Instagram account data an account holder connects or is authorized to connect.

2. Information we collect

2.1 Information you provide

• Account information: your name and email address, collected and managed through our authentication provider, Clerk.
• Billing information: your subscription plan and payment status, handled by our payment processor, Stripe. We do not store your full card details ourselves.
• Communications: messages you send us, such as support requests.

2.2 Instagram data

When you connect an Instagram Business or Creator account to Beavly, Instagram (via Meta's Graph API) grants us read-only access to:

• Public profile information (username, profile photo, follower count, account type)
• Media (posts, captions, media type, timestamps)
• Insights metrics (reach, impressions, profile views, and per-post engagement such as likes, comments, saves, and shares)

We request only the instagram_business_basic and instagram_business_manage_insights permissions. We cannot post, message, or change anything on a connected account, and we never request permissions that would let us do so.

2.3 Usage information

We automatically collect limited technical information when you use Beavly, including basic log data (such as IP address and browser type) used to operate and secure the Service. We do not currently use third-party advertising or analytics trackers; if this changes, we will update this policy and this section.

2.4 Cookies

Beavly uses only the cookies strictly necessary to keep you signed in and to operate the dashboard securely (set by our authentication provider, Clerk). We do not use cookies for advertising or cross-site tracking.

3. How we use your information

We use the information above to:

• Provide the dashboard showing your connected accounts' Instagram performance
• Generate the PDF, PowerPoint, Excel, and CSV reports you request
• Keep your dashboard up to date through periodic automatic syncing
• Process billing and manage your subscription
• Provide customer support and respond to your inquiries
• Maintain the security and reliability of the Service

We do not use Instagram data for advertising, and we do not sell it.

4. Legal basis for processing (EEA/UK users)

Where GDPR applies, we process your information on the following legal bases: performance of a contract (providing the Beavly service you signed up for), your consent (where you explicitly connect an Instagram account), and our legitimate interests in operating and securing the Service.

5. How we share your information

We do not sell, rent, or trade your personal information. We share it only with service providers who help operate Beavly, each acting on our behalf and contractually bound to protect it:

• Meta — the source of Instagram data itself
• Clerk — authentication
• Stripe — billing and payments
• Railway — hosting and database infrastructure

We may also disclose information if required by law, legal process, or a valid request from a public authority.

5.1 International data transfers

Some of our service providers may process data outside the European Economic Area, including in the United States. Where this occurs, we rely on appropriate safeguards recognized under GDPR, such as Standard Contractual Clauses, to protect your information.

6. Data security

Instagram access tokens are encrypted at rest (AES-256-GCM) and never stored in plain text. Access to the dashboard requires you to be signed in, and all traffic to Beavly is encrypted via HTTPS. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Data retention and deletion

Data for a connected account is kept for as long as that account remains connected in Beavly. You can remove a connected account at any time from your dashboard, which permanently and immediately deletes its Instagram connection, every metric we've synced for it, and every report generated for it.

If you disconnect Beavly from your Instagram account directly (via Instagram's own "Apps and Websites" settings), Meta notifies us automatically and we delete the corresponding data the same way, in line with Meta's Data Deletion Request requirements.

If you cancel your Beavly subscription, we may retain limited account information as required for legal, accounting, or fraud-prevention purposes, even after your connected accounts' data has been deleted.

8. Your rights

8.1 All users

You can access, correct, export, or request deletion of your data at any time by removing the relevant connected account in Beavly, updating your account settings, or contacting us at support@beavly.app.

8.2 GDPR rights (EEA / UK users)

If you are located in the European Economic Area or United Kingdom, you have the right to:

• Access a copy of your personal data
• Rectification of inaccurate or incomplete data
• Erasure of your personal data
• Restrict processing of your data
• Data portability, receiving your data in a structured, machine-readable format
• Object to processing based on our legitimate interests

As a Lithuania-based company, we handle these requests in line with GDPR. You may also lodge a complaint with the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI) or your local supervisory authority.

8.3 California privacy rights (CCPA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request deletion of your personal information, to opt out of the sale of personal information (we do not sell personal information), and to non-discrimination for exercising these rights.

9. Children

Beavly is a business tool and is not directed at, or intended for use by, anyone under 16.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will note any changes by updating the "Last updated" date above, and for material changes, we may notify you by email.

11. Contact us

Questions about this policy or your data: support@beavly.app.

Beavly, operated by MB Dropkeyz.