CRM Base for Photographers

Privacy Policy

Last updated: 22 October 2026

This policy explains what personal data the app “CRM Base for Photographers” (Instagram integration “IG Sync”) processes, why, and what rights you have. It is written to meet the requirements of Ukrainian law, the EU and UK General Data Protection Regulation (GDPR), US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA), and the Meta Platform Terms.

1. Who we are

The app is operated by Maksym Ostapenko, a sole proprietor (FOP) and photographer in Kamianets-Podilskyi, Khmelnytskyi region, Ukraine (the “Operator”). The Operator is the controller of the personal data described here (and the “business” under US state laws). Contact: maxim.ostapenko.work@gmail.com.

2. Personal data we process and where it comes from

The data comes from Instagram (Meta), through the Instagram API with Instagram Login, and only from the Operator’s own Instagram professional account. The app can receive:

• account information: username, account ID and account type;
• conversations in the account’s inbox: usernames and IDs of the people who wrote, timestamps and the text of messages;
• comments on the account’s own posts: commenter username, text and time.

If you wrote to or commented on the Operator’s account, you appear in this data. The app does not receive your Instagram password, your profile, your followers or any other account. We do not collect special categories of data on purpose; if you volunteer such information in a message, we treat it as confidential and use it only to answer you.

3. Why we use it, and our legal basis

We use the data only to run the Operator’s own business correspondence: to summarize new messages and comments, to track what was agreed and who is waiting for a reply, and to create a short daily plan.

• GDPR: our legitimate interest in managing and answering business enquiries (Art. 6(1)(f)), and, where you ask about our services, steps taken at your request before a contract (Art. 6(1)(b)). You may object at any time (see section 9).
• Ukrainian law (Law on Personal Data Protection): processing needed for the Operator to exercise its rights and obligations in business correspondence, and your own contact with the Operator.

We do not use the data for advertising, we do not build advertising or behavioral profiles, we do not make automated decisions that have legal or similarly significant effects on you, and we do not use Instagram data to train AI models.

4. Who receives the data

The Operator and service providers that process data only on the Operator’s instructions to provide this service:

• Meta Platforms (Instagram), which provides the API;
• Notion Labs, where the Operator keeps a private CRM with contact entries and next steps;
• Anthropic, whose AI assistant generates summaries on the Operator’s instructions.

We do not sell or share personal data with anyone else, except where the law, a court or a public authority requires it.

5. International transfers

The Operator is in Ukraine, and the providers above may process data in the United States and other countries outside Ukraine and the European Economic Area. Where required, these transfers rely on safeguards offered by the providers, such as standard contractual clauses or the EU–US Data Privacy Framework. You can ask us for details using the contact above.

6. Storage and retention

The access token is stored on the Operator’s own computer, in a private user folder outside any shared project. Message text is read to create a summary and is not archived in bulk by the app. A CRM entry (name or username, source, date of last contact, next step) is kept while the business relationship is active and for no longer than 24 months after the last contact, and is deleted earlier on your request within 30 days. Summaries may be kept in the Operator’s private files for the same period.

7. Security

Data travels over encrypted connections. Access to the token and to the CRM is limited to the Operator. At this stage the app is read-only, so it cannot change or delete anything in the Instagram account. We will report a personal data breach to the people affected and to the competent authority where the law requires it.

8. No sale, no sharing for advertising

We do not sell personal data and we do not share it for cross-context behavioral advertising, including in the last 12 months. Because of this, there is nothing to opt out of. We do not respond to “Do Not Track” signals differently, because we do not track you across websites.

9. Your rights

Whatever country you live in, you can ask us to tell you what data we hold about you, to correct it, or to delete it. In addition:

• EU, EEA and UK (GDPR): the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where we rely on it. You can complain to your local data protection authority.
• Ukraine: the rights set out in the Law on Personal Data Protection, including to know about processing, to access, to demand changes or deletion and to object. You can complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.
• California and other US states: the right to know what we collect, to request deletion and correction, and not to be discriminated against for using your rights. You can use an authorized agent; we may verify your identity before acting.

To use any of these rights, write to maxim.ostapenko.work@gmail.com or follow the steps in Delete your data. We answer without undue delay and within one month (45 days for California requests). There is no fee unless a request is clearly excessive.

10. Children

The app is a business tool and is not directed at children. We do not knowingly collect data from children under 13 (or under 16 in the EU). If you believe a child’s data is in our records, contact us and we will delete it.

11. This web page

This page is hosted on Tilda, which may use basic technical logs and analytics cookies to deliver and measure the page. We do not add advertising cookies or trackers of our own.

12. Changes to this policy

If the app changes in a way that affects your data, for example if it starts to send messages, we will update this page and the date above before the change takes effect.