Squid Logistics Privacy Policy

Squid Logistics ("we", "us", or "our") operates a platform that connects service providers such as tattoo artists, hairstylists, and other professionals with clients, facilitating bookings and portfolio management. This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

By using Squid Logistics, you agree to the collection and use of information in accordance with this policy. We are committed to protecting your privacy and ensuring you have a positive experience using our platform.

1. Information We Collect

When you use Squid Logistics, we collect:

• Account Information: Name, email, phone number, and business details
• Instagram Business Data: Profile information and media posts when you connect your account
• Booking Information: Appointment details, client notes, and payment information
• Usage Data: How you interact with our platform and features

2. How We Use Instagram Data

When you connect your Instagram Business account, we use the Instagram Basic Display API to:

• Display your Instagram portfolio on your booking page
• Sync and display your Instagram media posts as part of your professional portfolio
• Create a seamless portfolio experience for potential clients

Data We Access: We only access your public media, captions, and basic profile information through Instagram's Basic Display API. We do not access, store, or process any Instagram messages or direct communication with your followers.

Data Storage & Retention: We store your Instagram access tokens securely to maintain the connection between your Instagram portfolio and booking page. We refresh these tokens as needed according to Meta's platform policies.

Disconnection: You can disconnect your Instagram account at any time through your settings, which will immediately stop any synchronization of your Instagram content.

Note: We only access your Instagram Business account data with your explicit permission and in accordance with Meta's Platform Terms. Our access is limited to the instagram_basic permission scope only.

3. How We Use Your Information

• To provide and maintain our booking and portfolio platform
• To facilitate client bookings and payments
• To display your portfolio to potential clients
• To improve our platform and user experience
• To comply with legal obligations

4. Data Sharing & Disclosure

We may share your information with:

• Service Providers: Companies that help us operate our platform including:
• Supabase - Our cloud database provider that securely stores access tokens and user data
• Vercel - Our hosting provider that processes and serves API requests
• Payment processors (if applicable) to facilitate transactions
• Instagram/Meta: As necessary to display your portfolio through their API
• Legal Requirements: When required by law, court order, or to protect our legal rights

Data Processor Agreements: All of our service providers who may access Instagram data are bound by data processing agreements that ensure the protection and proper handling of your information.

We do not sell or rent your personal information to third parties for marketing purposes.

5. Data Security

We implement appropriate security measures to protect your information, including:

• Encryption: All sensitive data, including Instagram access tokens, is encrypted in transit and at rest
• Access Controls: Strict internal access controls limit who can access your data
• OAuth Security: We implement CSRF protection and secure redirect handling for all OAuth flows
• Regular Monitoring: We conduct security audits and monitor for potential vulnerabilities
• Limited Data Access: We only access the minimum Instagram data required for portfolio display

Data Breach Protocol: In the event of a data breach that compromises your personal information, we will notify you and relevant authorities as required by applicable law.

6. Your Rights & Choices

You have the right to:

• Access: Request a copy of your personal data that we hold
• Correction: Update or correct inaccuracies in your personal information
• Deletion: Request deletion of your account and associated data
• Restriction: Request limitation on how we use your data in certain circumstances
• Portability: Request your data in a structured, commonly used format
• Instagram Disconnection: Disconnect your Instagram account at any time through your settings
• Marketing: Opt-out of marketing communications at any time

To exercise these rights, you can:
1. Use the account settings in your Squid Logistics dashboard
2. Email us at privacy@squidlogistics.co
3. Follow our Data Deletion Instructions for account removal

Response Time: We will respond to your requests within 30 days. If we need more time, we'll notify you and may extend the response period by up to an additional 60 days, depending on the complexity of the request.

7. Legal Compliance

Data Protection Laws: We comply with applicable data protection laws, including:

• Meta Platform Terms: Our use of Instagram data complies with Meta's Platform Terms and Developer Policies
• GDPR Compliance: For EU users, we process data in accordance with GDPR requirements
• CCPA/CPRA: For California users, we honor consumer rights under California privacy laws
• National Security Requests: We carefully review and validate any government or authority requests for user data

Legal Basis for Processing: We process your data based on legitimate interests (providing our service), consent (when you connect your Instagram account), contractual necessity (to fulfill our agreement with you), and legal obligations.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify you of any significant changes by:

• Posting the new policy on this page
• Updating the "Last Updated" date at the top of this policy
• Sending you an email notification if the changes materially affect your rights

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.