Privacy policy
1. Who we are
Vinco Sport Ltd, company no. 08776048, registered in England and Wales. Registered office: Suite 5, Camellia House, 76 Water Lane, Wilmslow, SK9 5BB, United Kingdom is the data controller for personal data processed in connection with Engage. Contact: https://services.vincosport.com/contact.
2. Data we collect
Account and contact details you provide; usage and device data collected automatically; and the service-specific data described in section 3. We collect no more than the service needs to run.
3. Service-specific processing
These provisions describe how this particular service handles data. Where they differ from the general sections below, these apply.
- Engage is operated by Vinco Sport Ltd as data controller. It is not provided, sponsored, endorsed by, or affiliated with Meta or Instagram, and it connects only through Meta's official Instagram Platform.
- For people who interact with a connected account we process their Instagram username and id, the comment or message that triggered the automation, their replies and button taps, and the conversation state needed to run the exchange: the automation they are in, tags applied, opt-in status and the messaging-window timestamps.
- For operators we process name, email, their Engage sign-in and role, the Instagram account connected, the access token Meta issues, and activity logs.
- We request only three Instagram permissions and use each solely as stated: basic account access to identify the connected account; comment management to receive comment events and post the public reply; message management to send and receive the automated conversation.
- We do not sell personal data, do not use it for advertising, ad targeting, profiling, credit or eligibility decisions, and never transfer it to data brokers. Engage carries no third-party trackers or analytics.
- Data is stored in the EU (Ireland), encrypted in transit and at rest with a customer-managed key. Access tokens are held only by the backend, never in your browser. Our only processors are Meta and our cloud hosting provider, both named in the full privacy policy.
- We do not collect payment card details, government identifiers, location, contact lists or special category data, and Engage is not directed at children.
- Retention: conversation data is deleted 24 months after a person's last interaction; operator data 12 months after access ends; operational markers after 7 days; server logs after 30 days. Disconnecting an Instagram account immediately deletes its automations, conversation history and access token.
- To delete your data: account holders disconnect the account in Engage; anyone who commented or messaged can ask via our contact form at services.vincosport.com/contact, giving their Instagram username. No account is needed, there is no charge, and we act within one month.
- You can revoke access at any time in Instagram under Settings, Website permissions, Apps and websites.
- UK GDPR rights (access, correction, erasure, restriction, objection, portability) are exercised through our contact form at services.vincosport.com/contact. You may also complain to the Information Commissioner's Office at ico.org.uk.
4. How we use data
To provide and improve the service, meet contractual and legal obligations, secure our systems, and, with consent, send relevant updates. Legal bases: contract, legitimate interests, and consent where we ask for it. Any additional or narrower basis for this service is set out in section 3.
5. Sharing & transfers
Shared only with processors working under contract for us (for example hosting and support tooling), and never sold. The processors used for this service are identified in section 3. Where personal data leaves the UK, it is protected by an adequacy decision or by standard contractual clauses.
6. Retention
Kept only as long as needed for the purposes above, then deleted or anonymised. The retention periods that apply to this service are set out in section 3.
7. Your rights
Access, rectification, erasure, restriction, portability and objection, exercised via https://services.vincosport.com/contact. You may also complain to your supervisory authority (UK: the ICO).
8. Deleting your data
You can ask us to delete the personal data we hold about you at any time, https://services.vincosport.com/contact. We will delete it, other than anything we must keep by law, and confirm when it is done, within one month as UK GDPR requires.