Impression Privacy Policy
Impression Technologies, Inc. ("Impression", "we", "us") runs useimpression.com. Invited creators use it to build storefronts of products they recommend, and they can connect their Instagram account to show their verified profile. This policy explains what personal data we collect and why, how we protect it, how long we keep it, who processes it for us, and how anyone can have it deleted.
1. Who is responsible
Impression Technologies, Inc., a Delaware corporation at 310 Alder Rd, Dover, DE 19904, United States, is the controller of the personal data described in this policy, including the data we receive from Meta when a creator connects their Facebook and Instagram accounts ("Platform Data"). Impression alone decides why and how that data is used.
Send privacy questions and requests to privacy@useimpression.com.
2. What this policy covers
This policy covers useimpression.com, including our home pages, the creator area (/creator) and creator storefronts, and the Instagram connection a creator makes through Facebook Login. It does not cover Facebook, Instagram or the retailers you reach from a storefront; each has its own privacy policy.
3. What we collect
3.1 Creator accounts
Creator accounts are by invitation only, and Impression creates them. For each account we keep the email address, display name and country, whether it is a review account, and the password as a salted one-way hash only. We cannot read your password.
When you sign in, a cookie named __Host-impression_session keeps you signed in. It is strictly necessary; we use no advertising or analytics cookies.
To slow down password guessing, we count failed sign-in attempts against your account and your network address. We store both only as keyed one-way hashes.
3.2 Creator applications and demo requests
Forms on our home pages. If you apply as a creator or request a demo through the forms on our home pages, we keep what you enter: your name, email, social platform and handle, audience and notes, and for demo requests your company and job title. We also keep your browser type and the page you sent the form from. These forms are stored in Google Sheets (section 7).
The creator application in the app. If you apply through the application form in the app, we keep what it asks for: email and display name; whether you apply for yourself or for someone you represent; your country of residence, the countries you promote in and your preferred language; your public profile links, categories and short descriptions; how you heard about us; and your confirmations, including that you are an adult. To limit abuse, we also keep keyed one-way hashes of your network address, email and profile link.
3.3 Facebook and Instagram (the Instagram connection)
Connecting Instagram is optional. You choose "Connect Instagram" and sign in with Facebook in Meta's own window, so Impression never sees your Facebook password. Meta shows the permissions Impression asks for, and you can decline some of them.
| What we read | Meta permission | Why |
|---|---|---|
| Your Facebook name and profile picture | public_profile | Shown in Settings → Profile so you can confirm which Facebook account is connected |
| The email address on your Facebook account | email (optional) | Shown in Settings → Profile as your contact email, and used only for messages about your account |
| The Facebook Pages you manage, each with its linked Instagram account | pages_show_list | Lets you choose which Instagram account to connect. We keep only the Page you choose. |
| The name of the business portfolio that holds that Page | business_management | Shows how your account is linked. If your Page role comes through that portfolio, it also lets us read your Instagram posts. We do not read or manage ad accounts or any other business assets. |
| Your Instagram username, profile picture, account ID, follower count and number of posts, and your six most recent posts (type, image or thumbnail link, link to the post, time posted, likes and comments) | instagram_basic, pages_read_engagement | Shows your Instagram profile and recent posts in Settings → Profile |
| Accounts reached in the last 28 days, and accounts reached by each of those six posts | instagram_manage_insights, pages_read_engagement | Shows your verified reach in Settings → Profile |
We also keep the ID Facebook gives you for Impression; the chosen Page's ID and name and your Instagram account ID; which permissions you granted or declined; the access token Meta issues to Impression; and when you connected and when we last read your data.
When we read it. Only when you open Settings → Profile and our copy is out of date. We do not read in the background.
What we never do with it.
- We never post, comment, send messages or change anything on your Facebook or Instagram accounts.
- We do not read Page posts, comments, messages, ad accounts or audience demographics.
- We do not download your photos or videos. We keep Meta's links to them, which are refreshed when we read.
- We show this data only to you, in Settings → Profile. It does not appear on storefronts.
- We do not sell it, use it for advertising or share it with brands or retailers.
3.4 Visitors to storefronts and the site
You don't need an account to visit. We use no analytics or advertising tools of our own. Our hosting provider keeps standard request logs (network address, browser, page requested and time) to run and secure the site. Our home pages and legal pages, including this one, load fonts from Google Fonts, so your browser contacts Google, which receives your network address. They remember the language you choose in your browser's local storage.
Storefronts link to retailers, and some links earn Impression a commission. Third parties, including Amazon and other retailers and advertisers, may serve content and advertisements, collect information directly from visitors, and place or recognize cookies on visitors' browsers. Their practices are governed by their own privacy policies.
Do Not Track. Some browsers send a "Do Not Track" signal. We don't track visitors across other sites, so our site doesn't change how it works when it receives one. Sites you reach through our links may handle it differently.
3.5 Messages you send us
If you email us, we keep your message and address so we can answer.
4. How we use it
We use personal data only to:
- run the creator area and storefronts, and show a connected creator their own profile;
- review applications and demo requests, and contact creators about their accounts;
- keep the service secure and working: sign-in throttling, abuse prevention, fixing errors;
- meet legal obligations.
We do not sell personal data, use it for advertising, or build profiles for anyone else.
5. How we protect it
- Facebook access tokens are encrypted with AES-256-GCM before they are stored. The key is held only in our hosting environment's secret settings, never in the database. Each encrypted token is bound to your account and connection.
- Kept out of logs: access tokens, authorization codes, Meta's signed deletion requests and email addresses are removed before anything is logged.
- Signed requests to Meta: every request we send to Meta carries a proof signed with Impression's app secret, so a stolen token alone is not enough.
- Access: all traffic uses HTTPS. Database access is restricted to the application and to authorized Impression personnel.
No method of storing or sending data is completely secure, so we cannot guarantee absolute security. We will notify affected users of a breach as the law requires.
6. How long we keep it
- Instagram connection data is kept while you stay connected, and deleted when you ask us to delete it (section 8).
- If your Facebook access expires, we keep the last copy so you can reconnect in one step, until you reconnect or ask us to delete it.
- While you choose a Page, we hold the list of your Pages and the encrypted token only until you choose a Page, cancel or start again.
- Account data, applications and demo requests are kept for as long as needed to run the service and for our legitimate business records. Records we must keep for legal, tax, accounting or security reasons are kept as long as those reasons require. You can ask us to delete your data at any time (section 8).
- Hosting request logs are kept for a limited period set by our hosting provider.
7. Who processes data for us
These service providers process personal data only on our behalf, to provide their service to us, under written agreements:
| Provider | What it does |
|---|---|
| Vercel Inc. | Hosts the site and runs its code. Data passes through it and appears in request logs. |
| Supabase, Inc. | Database: accounts, applications, connection data and encrypted tokens |
| Google LLC | Email (Google Workspace), and storage of the home-page forms (Google Apps Script and Google Sheets) |
We will update this list before any other provider processes personal data for us. No affiliated company has access to this data.
Meta. When you connect, data passes between you, Meta and Impression under Meta's own terms and privacy policy.
Legal requests. We disclose personal data only when valid legal process requires it. We review each request for legal validity, challenge requests we believe are unlawful or overbroad, disclose only the minimum required, and keep a record of each request.
Business transfers. If Impression is merged, acquired or sells its assets, personal data may transfer as part of that transaction and remains protected by this policy or one at least as protective.
8. Deleting your data, and your other choices
Anyone can ask us to delete their data. Email privacy@useimpression.com from the address on your account or application. We will confirm your request and delete your data promptly, within any period the law requires. The same address handles requests to see, correct or get a copy of your data.
We are adding self-service controls: Disconnect in Settings → Profile, automatic deletion when you remove Impression in your Facebook settings, and Delete account. We will update this policy when they are available.
You won't be treated differently for using any of these choices.
9. Children
Creator accounts are for adults (18 or older) only, and creators confirm this when they apply. The site is not directed at children under 13, and we do not knowingly collect their data. If we learn that we hold a child's data, we delete it.
10. Where data is processed
Impression is based in the United States. Data is processed in the United States and in the regions our service providers use.
11. Changes to this policy
When this policy changes, we update the date at the top. For a material change, we will also tell signed-in creators by email or in the app.
12. Contact
- Privacy: privacy@useimpression.com
- Account help: support@useimpression.com
- Post: Impression Technologies, Inc., 310 Alder Rd, Dover, DE 19904, United States