Privacy Policy

What Instagram Data We Access

• —Instagram Business account profile information (username, account ID, profile picture) via instagram_business_basic
• —Instagram Direct Messages received from your customers via webhooks via instagram_business_manage_messages

How We Use This Data

• —Profile information is displayed in your Chatmount dashboard to confirm which Instagram account is connected
• —Incoming DMs are processed through your AI chatbot to generate AI-assisted replies on your behalf
• —DM content is sent to our AI provider (OpenAI) solely to generate a response — OpenAI does not use API inputs to train its models

What We Do Not Do

• —We do not store Instagram DM content permanently — messages are processed in real-time to generate a response
• —We do not sell or share Instagram user data with any third parties
• —We do not use Instagram data for advertising or marketing purposes
• —We do not access media, stories, posts, or follower data — only Direct Messages and basic profile information

Data Retention

• —Instagram access tokens are encrypted and stored only for as long as the integration is active
• —When you disconnect Instagram, your access token is immediately and permanently deleted from our systems
• —Message content may be briefly retained in memory during an active chat session for conversation context, but is not written to long-term storage

Your Control

• —You can disconnect your Instagram account at any time from the Integrations dashboard inside Chatmount
• —Disconnecting immediately revokes all of our access to your Instagram data
• —If you delete your Chatmount account, all Instagram-related data (profile information, encrypted access tokens, and any logged conversations) is permanently deleted from our systems within 30 days

Google Data We Access

• —Your Google account email address and OpenID identifier (via openid and userinfo.email). Used to sign you in and to confirm which Google account is connected to an integration.
• —Specific Google Drive files you select via Google Drive Picker (via drive.file). We can only read and write the exact spreadsheet(s) you pick. We cannot see, read, or modify any other file in your Drive.
• —Permission to create calendar events on the calendar you select (via calendar.events). We only create events through this scope; we do not modify or delete events we did not create.
• —Free/busy time ranges on the calendar you select (via calendar.readonly). We only read whether a time range is busy — we do not read event titles, descriptions, attendees, or any other event details.

How We Use This Data

• —Sign-in: to authenticate you into Chatmount and create or load your account.
• —Google Sheets lead export: each new lead captured by your chatbot is appended as a new row to the spreadsheet you picked. When possible the data is mapped to your existing column headers; if the sheet is empty we write a default header row once.
• —Calendar bookings: when a visitor picks a slot in your chat widget, we create a calendar event on the calendar you chose with the visitor's name and email as an attendee plus an auto-generated Google Meet link. The event description contains only the information the visitor submitted in the lead form.
• —Free/busy lookups: we query free/busy ranges on demand to generate the list of available time slots shown to visitors. This data is used in-memory and never stored.

What We Do Not Do

• —We do not sell, rent, or share your Google data with any third party.
• —We do not use your Google data for advertising, marketing, or to train AI or machine-learning models.
• —We do not access any Google services, APIs, or data beyond the scopes listed above.
• —We do not read or store Google Drive files other than the spreadsheet you explicitly picked.
• —We do not read Google Calendar event details (titles, descriptions, attendees, locations) — only free/busy time ranges.
• —We do not allow humans to read your Google data except as required for security investigations, to comply with law, or with your explicit consent.

Data Retention & Revocation

• —Your Google OAuth refresh token is encrypted at rest and stored only while the integration is connected.
• —The IDs of the spreadsheet and calendar you selected are stored as configuration. We do not store file contents — we only write to them.
• —Disconnecting an integration from the Chatmount dashboard immediately and permanently deletes the encrypted tokens from our systems.
• —You can also revoke Chatmount's access at any time from myaccount.google.com/permissions.