Information you give us. Your email address and/or phone number (verified by a one-time password sent over email, SMS or WhatsApp), or your Google account details if you sign in with Google. Your profile and portfolio: name, username, photo, bio, city, professions, skills, social links, uploaded media (images, video, audio, PDFs), work collections, offerings and price ranges, the contact options you choose to publish, and your page theme. An optional date of birth. For paid plans, your billing name and address, and your GSTIN if you provide one. If you join the waitlist: your name, email, phone, desired handle, and how you found us.

Information from platforms you connect. If you connect Instagram, YouTube or Google Drive, we access what you authorise — see section 5.

Information collected automatically. Pages viewed, clicks and interactions, browser and device type, approximate location (country, derived from your IP address), referring website, performance measurements, and error reports. This includes product analytics and session replay — a reconstruction of how the Service was used, so we can find and fix problems. In session replay, everything you type is masked across the product; the single exception is the desired-handle field on our waitlist and claim forms, which is unmasked because the handle is public by design (it is the page address you are asking for). Text already displayed on screen is captured as part of the recording.

Payment information. Plan, amounts, currency, status, mandate status and payment identifiers from our payment processor. We never receive or store your card number, CVV or banking credentials — Razorpay collects those directly.

Visitors to creators’ pages. Public pages can be viewed without an account. For visitors we record only usage data: an anonymous visitor identifier, page-view and click events, and the referring site. Creators see aggregate statistics only — never your identity, IP address or precise location. If you tap a creator’s contact button, you communicate with them directly through your own email, phone or WhatsApp; that conversation does not pass through BreadButter.

• To provide the Service — your account, your public page, uploads, imports and search visibility.
• To verify your identity and keep your account secure — one-time passwords, fraud and abuse prevention, bot checks.
• To process subscription payments, issue invoices (including GST), handle refunds and manage payment mandates.
• To show creators aggregate statistics about their own page.
• To build and improve BreadButter’s own products and features, including our AI features — for example generating suggested profile drafts from content you import, improving recommendations, and analysing usage to fix problems.
• To communicate with you — service and account messages always; marketing and product updates only with your consent (section 6).
• To moderate content, enforce our Terms and Community Standards, and handle grievances.
• To meet legal obligations — tax, accounting, responding to lawful orders, and record-keeping.

We process account, billing and service data to perform our contract with you. Marketing communications and, where required in your region, analytics cookies rest on your consent, which you can withdraw as easily as you gave it. Moderation, security, and tax and record-keeping rest on our legal obligations and legitimate use consistent with the purposes you signed up for. For EU/EEA and UK users, see section 13.

We share personal data only with service providers who process it for us under contract, and where the law requires it. We do not sell personal data.

We also share data at your direction — everything you publish on your public page is public, indexed by search engines and reachable by anyone with the link — and where we must to comply with law or a lawful order, to enforce our Terms and protect users, or in connection with a merger, acquisition or sale of assets (with notice to you).

BreadButter lets you connect accounts you already own so that your existing work can be brought into your Vault and shown on your page. Connecting is entirely optional, is always started by you, and can be undone at any time.

Instagram connector

The Instagram connector is available on our Pro plan, and needs a Professional (Business or Creator) Instagram account — Instagram Login does not support personal accounts. If you are no longer on Pro, you cannot connect Instagram again until you are.

We use Instagram Login. We request read permissions only, and we read only the connecting account’s own data — never anyone else’s. What we read:

• When you connect — your Instagram user id, your username (handle), and how many posts your account has. Used to show which account is connected.
• Your posts and reels — when you browse them to import, and for each one you import: its caption, type, when it was posted, permalink, alt text, like and comment counts, and the image and video links Instagram provides.
• Per-post insights, if you grant them — views, reach, likes, comments, shares and saves for your posts.
• Account insights, if you grant them — once a day: your account type; your follower, following and media counts; your account’s reach, views and interactions; follows and unfollows; and the demographics (age, city, country and gender) of your followers and of the audience that engaged with you.

Insights are private to you. They appear only in your Vault and in the import picker, and are never shown to visitors of your public page.

What we store. For each post you import we store the details listed above, and we keep a copy of each photo at full size and of each video’s poster image in bb.bio storage (for a carousel, its cover image). We do not store video files — videos play from Instagram, through links we refresh while you are connected. The caption is used to make the item searchable in your Vault, and hashtags in it may be added to the item as tags. We also keep a day-by-day history of each imported post’s metrics and, if you granted account insights, a daily snapshot of your account insights, demographics included.

What we never do with Instagram: we do not post or schedule content, do not send or read direct messages, do not follow or unfollow accounts, do not modify or delete any of your Instagram content, and do not access other people’s private data. We do not sell Instagram data, do not use it for advertising or ad targeting, and do not use it to train BreadButter’s own AI features or any other AI model.

How long we keep it. We keep the access token for as long as the connection is active, and delete it when you disconnect or when Instagram expires or revokes it. Imported items and their details stay in your Vault until you remove them or your account is deleted. The metric history and account snapshots are kept for as long as your bb.bio account is active, including after you disconnect Instagram. They are erased when Meta sends us a data-deletion request for that Instagram account, or when your bb.bio account is deleted.

Disconnecting. You can disconnect at any time from Vault → Connectors. Disconnecting in bb.bio deletes our stored access token and stops us reading your account. It does not revoke the grant inside Instagram itself — Instagram keeps bb.bio listed under your connected apps until you remove it there too, from Instagram → Settings → Apps and Websites. Disconnecting does not, by itself, remove items you have already imported or their metric history. Imported items stay in your Vault and on your page, marked “Instagram disconnected” — or “No longer on Instagram” if the post is gone — and nothing is hidden or deleted; you decide whether to keep or remove them.

Deleting imported data. Removing an item takes it off your Vault and your public page. When Meta sends us a data-deletion request for your Instagram account — see our Instagram Data Deletion page for how to make one — we erase, for that account: captions, usernames, metrics, the image and video links from Instagram, the photos and poster images we stored, tags made from hashtags, and the metric history and account snapshots. Only the post’s Instagram address stays on its Vault item, until you remove the item. You can also write to support@thebreadbutter.com and we will handle the request for you.

Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies.

YouTube

BreadButter uses YouTube API Services to let you bring in your own videos, shorts and playlists, and to show statistics about your own channel and videos. By using these features you agree to be bound by the YouTube Terms of Service, and Google’s Privacy Policy applies to data processed by Google. Our access is read-only: we never upload, edit or delete anything on your channel. You can revoke BreadButter’s access at any time from Vault → Connectors, or through Google’s security settings.

Google Drive

If you connect Google Drive, we read only the files you explicitly pick, so you can import them as portfolio items. We do not browse, modify or delete anything else in your Drive. Access can be revoked at any time from Vault → Connectors or through Google’s security settings.

BreadButter’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Links you paste (a separate path from the connectors)

You can also add work by pasting a public link — to an Instagram post, a YouTube video, and around eighteen other platforms. This is a different mechanism from the connectors above: it needs no account connection and gives us no access to any private data. We retrieve the page’s public information — title, description, thumbnail, author name and profile picture, caption, publish date and publicly displayed counts — using our content retrieval provider.

On this path we copy the media files themselves onto our own storage and content delivery network so that your page loads reliably and keeps working if the original link changes. Those copies are served from our CDN and are reachable by anyone who has the file’s address, in the same way the content on your public page is. They are removed when you delete the item or your account.

Where a link you paste shows another person’s information — for example the author name and profile picture attached to a post — we retrieve and display it because you asked us to show that content on your page. If you are that person and want it taken down, write to support@thebreadbutter.com and see our Grievance Redressal page.

Service messages — one-time passwords, security alerts, billing receipts and notices about changes to our policies — are sent as needed to run your account, over email, SMS or WhatsApp. You cannot opt out of these while you hold an account.

Marketing and product updates by email, WhatsApp or SMS are sent only if you opt in, and you can opt out at any time — using the unsubscribe link in any marketing email, by replying STOP or opting out in WhatsApp, or by writing to support@thebreadbutter.com. We keep records of your opt-ins and opt-outs. WhatsApp messages are sent using approved templates through our providers, and SMS in India is sent over registered sender headers and templates.

We use cookies and similar technologies to keep you signed in, keep the Service secure, remember your preferences, and measure how the Service is used. The full list, with purposes and lifetimes, is in our Cookie Policy.

Your media and invoices are stored in India (Mumbai). Some of our providers process data in the United States and other countries — in particular analytics, error monitoring and marketing email (see the table in section 4). We transfer data under contracts that require those providers to protect it, and, for EU/EEA data, under standard contractual clauses where applicable.

We use encrypted connections (HTTPS) throughout, store session tokens in secure HttpOnly cookies, hold connected-platform access tokens server-side, apply access controls, and run on secured cloud infrastructure. Payment credentials never touch our systems. No internet service is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the Data Protection Board of India as the law requires, without undue delay.

Retention by data type:

When you close your account we delete your data except what the law requires us to keep, such as invoices. Copies held in encrypted backups are overwritten on our normal backup cycle, within 90 days.

You can, at any time:

• Access and correct your data — most of it directly in the Service, the rest by writing to us.
• Delete your account and data — write to support@thebreadbutter.com and we will verify you and complete the deletion, except for records the law requires us to keep (such as invoices). A self-service option is being added to account settings.
• Get a copy of your data in a portable format — write to support@thebreadbutter.com.
• Withdraw consent for marketing or, where applicable, analytics cookies, as easily as you gave it. Withdrawing does not affect processing already carried out.
• Nominate someone to exercise your rights if you die or become incapacitated — write to support@thebreadbutter.com.
• Complain — to our Grievance Officer (section 12) and, if you are not satisfied, to the Data Protection Board of India.

Our Terms require anyone under 18 to have their parent or guardian’s consent before using the Service. Where we know an account belongs to someone under 18, we do not send them marketing messages, do not serve targeted advertising, and limit behavioural analytics for that account. Parents and guardians can write to support@thebreadbutter.com about a minor’s account, including to have it removed.

In accordance with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023:

Ayush — Grievance Officer
BREBU MEDIA TECHNOLOGIES PRIVATE LIMITED
Gala 220, Second Floor, Prabhadevi Industrial Estate, Opp. Siddhivinayak Temple, Prabhadevi, Mumbai – 400025, Maharashtra, India
Email: support@thebreadbutter.com
Phone: +91 98198 29691

We acknowledge complaints within 24 hours and resolve them within 15 days. Full timelines, including the 24-hour fast track for impersonation reports, are on our Grievance Redressal page.

EU/EEA and UK. Our legal bases are contract (providing the Service), consent (marketing, and analytics cookies, which are collected before those cookies are set), and legitimate interests (security and moderation). You also have rights to restriction, objection and portability, and to complain to your supervisory authority. International transfers to India and the United States rely on standard contractual clauses with our processors. Contact for all requests: support@thebreadbutter.com.

California. We do not meet the CCPA/CPRA business thresholds. We honour access and deletion requests from all users regardless of where they live.

We will post updates on this page with a new effective date, and will notify you of material changes by email or an in-product notice. Earlier versions are available on request.