Privacy Policy

Instora ("we", "us", or "our") operates instora.io and provides AI-powered real estate marketing tools. This Privacy Policy explains what information we collect, how we use it, and the choices you have over your data.

By using Instora you agree to the collection and use of information as described here. If you do not agree, please do not use the service.

• To provide, operate, and improve the Instora service
• To generate AI-powered marketing content using the listing details you provide
• To process payments and manage your subscription via Stripe
• To send transactional emails — kit ready notifications, new lead alerts, team invitations, and billing alerts — based on your notification preferences
• To send buyers the emails they ask for — confirmations of their messages and open house visits, and updates on homes they follow
• To enforce our Terms of Service and prevent abuse
• To respond to support requests and communicate with you about your account

We do not sell your personal information to third parties. We do not use your listing content or property data to train AI models.

We share information only with the third-party services required to operate Instora:

• Supabase — database and file storage, hosted on AWS infrastructure in the United States
• Stripe — payment processing. Stripe's privacy policy is available at stripe.com/privacy
• Anthropic — AI content generation. Listing details you enter are sent to Anthropic's API to produce marketing copy. Anthropic's privacy policy is available at anthropic.com/privacy
• Vercel — application hosting and deployment, and privacy-friendly page analytics (no advertising or tracking cookies)
• Upstash — rate limiting to protect against abuse. Your IP address or account ID is held briefly to count requests
• Sentry — error monitoring. When something goes wrong we receive technical details about the error, your browser and IP address, and for a sample of sessions (and sessions where an error occurs) a recording of what happened on screen, so we can fix problems. Text and anything you type are masked in these recordings
• Slack — our team's internal messaging. Support requests you send us, basic details of new accounts and listings (name, email, agency, listing address), an activity log of leads, Call and Text taps, showings booked, open houses and the emails Instora sends about them, and short error reports when something breaks, are posted to our private Slack workspace. For buyers, that log shows only a name and a partly hidden email address, never phone numbers or messages
• Calendly — if a listing agent has connected their Calendly, the showing scheduler on their listing page is provided by Calendly, and anything a buyer enters there is handled under Calendly's privacy policy
• Our email provider — sends sign-in links and notification emails from our instora.io mail server

We may disclose information if required by law, legal process, or to protect the rights and safety of Instora, our users, or others.

When you generate a marketing kit, Instora creates a publicly accessible landing page at a URL in the format instora.io/listing/your-address. This page displays the property details you entered — address, price, bedrooms, bathrooms, photos, and key highlights — along with your name, agency, and any profile photo and phone number you've added. It is accessible to anyone with the link, without requiring a login.

If you create an agent page (instora.io/agent/your-name), it is public in the same way and shows your profile details, bio and your active and sold listings. Listing pages and agent pages are included in our sitemap so search engines can find them.

You can take a listing's public page down at any time by setting its status to Unpublished in your dashboard, or mark it Sold to keep the page up with a Sold badge.

A pitch (a kit for a home you haven't listed yet) is not public: it has a private preview link for the homeowner, isn't shown on your agent page and isn't in our sitemap or search engines. It becomes a public listing page only when you publish it.

If you connect an Instagram professional account or a Facebook Page (Pro and Team plans), Instagram or Facebook gives us an access token for it, which we store encrypted, along with the account or Page ID, its name or username, and its profile picture link. We use it only to publish the posts you choose to publish from Instora, and to keep the connection active. We don't read your messages, followers, comments, other posts or your personal Facebook profile.

Images for a post are stored privately for a few minutes while Instagram copies them, then deleted. We keep a record of each post you publish (the listing, the caption and a link to the post).

To delete this data: disconnect the account in Settings → Social accounts (the token is deleted straight away), or remove Instora under Instagram → Settings → Apps and websites, or Facebook → Settings → Business integrations. Deleting your Instora account deletes everything. You can also email us at the address below and we'll delete it within 30 days. Posts already published stay on Instagram or Facebook until you delete them there.

If you are a home buyer or visitor using a page an agent has published with Instora, this section explains what we collect from you.

• Enquiries — when you send an agent a message from a listing page or agent page, we collect your email address and, if you provide them, your name and message.
• Open house sign-ins — when you sign in at an open house, we collect your name and email and, if you provide them, your phone number, whether you are working with an agent, whether you are pre-approved, when you hope to buy, and any note. If the internet connection drops, your sign-in is kept on that device until it can be sent, then removed from it.
• Home updates — when you ask for updates on a home, we collect your email address and send you emails when its price changes, an open house is scheduled, or it sells. Every update email has a link to stop them, and you can also use your email app's unsubscribe button.
• New listings from the agent — if you have contacted an agent through Instora, they may send you one email when they list a new home, at most once a week. Every one has a link to stop emails from that agent, which also stops their updates on homes you follow.
• Follow-ups from the agent — after you contact an agent, ask for updates or a home value, Instora may send up to three short emails in the agent's name over the following week (unless the agent turns this off). They stop once the agent has been in touch with you, and every one has a link to stop emails from that agent.
• Page statistics — when you view a listing page or agent page, or tap its Call or Text button, we record the event, the page, where you came from, and a code made from your IP address and browser that changes every day. It lets us count daily visits for the agent without cookies and without storing your IP address, and can't be used to follow you across days or sites.
• Where you came from — if you arrived from a tagged link or QR code (for example, an agent's Instagram post), we record that source with your enquiry so the agent knows which marketing works.

We store these details for the agent and send them to the agent by email so they can reply to you. We also send you a confirmation email; replies to it go to the agent. Once the agent receives your details, how they use them is up to the agent and their brokerage. We do not use your details for our own marketing.

Call and Text buttons open your own phone app and contact the agent directly; we don't see those calls or messages. Showing bookings are handled by Calendly, as described above.

• Account data — retained for as long as your account is active. You can delete your account at any time from Settings, which immediately deletes your profile, profile photo, listings, photos, public pages, agent page and buyer leads.
• Buyer enquiries and open house sign-ins — retained until the agent deletes the lead's listing or closes their account.
• Home update subscriptions — retained until you unsubscribe or the agent deletes the listing or closes their account. After you unsubscribe we keep a record that you did, so you aren't emailed again.
• Page statistics — retained until the agent deletes the listing or closes their account. Agents see totals only, never individual visitors.
• New-listing email contacts — the date an agent last emailed you about a new home, and whether you asked them to stop, retained until the agent closes their account so your choice is respected.
• Listings and generated kits — retained until you delete them from your dashboard or close your account.
• Photos — retained in storage until you delete the listing or close your account.
• Billing records — retained by Stripe for seven years as required for financial compliance, including after you delete your account.

Depending on your location you may have rights including:

• Access — request a copy of the personal data we hold about you. You can download it yourself from Settings → Your data
• Correction — request correction of inaccurate data
• Deletion — delete your account and associated data yourself from Settings → Your data, or ask us to
• Portability — request your data in a machine-readable format
• Objection — object to certain types of processing

To exercise any of these rights, email us at privacy@instora.io. We will respond within 30 days.

We implement industry-standard security measures including encrypted data transmission (HTTPS), encrypted data storage, row-level security on our database, and access controls that limit data access to authenticated users. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Instora is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the app. Your continued use of Instora after changes take effect constitutes acceptance of the updated policy.

Questions about this Privacy Policy or your data? Email us at privacy@instora.io.