Privacy policy

Information you give us

• Account. Your email address, and, if you use Google to sign in, the basic profile Google shares for that login. Tobin does not use a password of its own. Sign-in is a magic link or Google, through our authentication provider.
• Waitlist. If you request beta access, we store the Gmail and Instagram username you submit and, if you add them, your name and business name.
• Business profile. The name, city, category, website, Instagram handle, offer, and sending preferences you enter (hours, daily limit, whether automatic sending is on).
• Messages and collaborations. Drafts, messages sent from your account, replies, and details a conversation produces, such as a visit time or a shipping address a creator chooses to send.

Information that is already public

To find creators, we collect publicly available information: Instagram handles, display names, bios, follower counts, public posts, public comments, public tags, and similar profile details. We may also use public web pages, such as a business website, to understand what you offer.

We store a copy of that public information so we can show it in your account, score fit, and avoid contacting the same person twice. We do not buy private contact lists, and we do not ask creators for information that is not needed to run a collaboration you started.

Instagram and other connections

We do not store your Instagram password. When you turn on sending, you sign in to Instagram yourself inside a hosted browser session run by our infrastructure partner, Browserbase. The cookies that keep that session signed in stay in that hosted browser context. They are not saved as a password in our database, and we do not ask you to type your Instagram password into a Tobin form.

If you connect Instagram through Meta’s official login, we store an encrypted access token for the permissions you approve, so we can read replies and related account activity. You can disconnect that connection in settings.

If you connect Google Calendar, we store the tokens Google issues for the calendar access you approve, and we use them only to place visits you are booking.

How we use information

• To run the product: find creators, draft and send messages you have enabled, and keep a record of what happened.
• To decide who is a plausible fit for the offer you described.
• To keep the service safe: enforce daily limits, pause sending, and investigate abuse or errors.
• To operate the beta: approve accounts and email you about access or the product.
• To fix bugs and understand, in aggregate, whether the product is working.

We use automated systems, including AI models, to rank creators and write or continue messages. Those systems can be wrong. A person at your business can edit drafts, leave automatic sending off, and pause the workflow. We do not use your content to train a public model that we sell to other customers.

Who we share it with

We share information with service providers only so they can do a job for us:

• Supabase, for the database and sign-in.
• Browserbase, for the hosted Instagram browser session.
• OpenAI, to draft and continue messages and to help judge fit.
• Apify and similar data tools, to read public Instagram and web information.
• Vercel, to host the website.
• Google and Meta, when you connect their products.
• Email delivery, to send sign-in links and product email.

We may also disclose information if the law requires it, or to protect Tobin, our users, or someone else from harm or fraud. If we are involved in a merger or sale of the service, customer information may transfer with it.

We do not sell personal information, and we do not share it for cross-context advertising.

How long we keep it

We keep account, business, and conversation records while your account is open and for a limited time afterward, so we can resolve disputes, meet legal duties, and avoid re-contacting people you already reached. Public creator records are kept while they are useful to your account. You can ask us to delete your business account by emailing [email protected]. We will delete or de-identify what we can, and we may retain a small record of the request and anything we must keep by law.

Security

We encrypt Instagram API tokens, restrict access to production systems, and rely on our providers’ security for sign-in and the hosted browser session. No method of storage or transmission is perfect. You are responsible for the email account you use to sign in, and for who you allow to use your Tobin account.

Creators

If you are a creator who received a message from a business using Tobin, that message came from the business’s Instagram account. The business decides the offer and whether to contact you. To ask about information we hold from public sources, or to ask us to stop using a public profile in our product, email [email protected]. Opting out of a conversation with a business is handled with that business, in the thread.

Children

Tobin is for businesses, not for children. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

Where information is processed

We and our providers may process information in Canada and in the United States. By using Tobin you understand that your information may be handled in those countries, which may have different privacy rules than the country you live in.

Changes and contact

We will update this page when the policy changes and change the date at the top. Continued use of Tobin after a change means you accept the update.

Questions: [email protected]. The rules for using the product are in the Terms.