Blanc Privacy Policy

This policy explains what personal data Blanc processes, why, who receives it, how long it is kept and how you can exercise your rights.

Who we are

Blanc is operated by Blanc, whose contact details are below. Blanc connects to a business's Instagram professional account and conducts Instagram Direct conversations on the business's behalf. For any privacy question or request, write to info@nowblanc.com.

Whose data this policy covers

• Customers: people who sign in to Blanc, and the members of their projects.
• Counterparts: people who send messages to an Instagram account connected to Blanc. They do not use Blanc themselves. The business that connected the account controls that account; counterparts can also contact the business about their messages.

Data we process

Your Blanc account

When you sign in with Google, Blanc receives and stores your Google account identifier, email address, name and profile picture address, and refreshes them each time you sign in. The sign-in token from Google is not stored. For each session, Blanc stores only a hash of the session token, its expiry and when it was last used; it does not store your IP address or browser details.

Content you enter

Project names, project members and their roles, the knowledge document with the full text of each save, automations, templates, uploaded files, and conversations with the AI assistant, including its proposals, your ratings and your review decisions.

Instagram connection

For each connected account: the Instagram account ID, username, name and profile picture address, and the access token that Meta issues, which is encrypted.

Instagram conversations and media

For each conversation of a connected account: the counterpart's Instagram-scoped ID, username, name and profile picture address; the message text, reactions, story links and times of messages in both directions; and copies of received media files up to 25 MB each, kept in private storage.

Dictation

Dictation audio is sent for transcription and is not stored. The transcript is returned to your message box.

Product analytics

When product analytics is turned on, Blanc records how the product is used: your internal user ID, email address and name, the project ID and name, and details of actions such as which feature was used and its outcome. Production analytics does not contain message, knowledge or transcript content.

Server logs

The service keeps technical logs on its server to keep it working. The logs are limited in size and contain no message content and no access tokens.

How we use data

• To show conversations to you and the members of your project.
• To prepare and send replies on your behalf, including automatic replies through automations.
• To run your automations.
• To answer questions and maintain your knowledge through the AI assistant.
• To keep the service secure and working.
• To understand how Blanc is used.

Who receives data

Blanc shares personal data only with the following providers, and only what each needs to deliver the service:

• Meta (Instagram) receives the text and file attachments of messages sent on your behalf, requests for counterpart profiles, and changes to message subscriptions. Meta delivers incoming messages and media to Blanc.
• OpenRouter, and the AI model provider it routes each request to, receive what the AI features need: conversations with the AI assistant, including the Instagram messages they quote and counterparts' names and usernames; your knowledge document; the text of incoming messages, to decide which automation applies; the material for daily knowledge reviews; and dictation audio, for transcription. Requests ask that providers do not collect the data, and transcription requests also require that the provider keeps no data.
• DigitalOcean hosts the server in Toronto that stores the service's data: the database, stored files and logs.
• Cloudflare provides DNS for the service's addresses. When Blanc stores files in Cloudflare R2, Cloudflare holds received media and project files in private storage. Cloudflare Email Routing receives messages sent to info@nowblanc.com, including privacy and deletion requests, and forwards them to the operator's mailbox.
• Google provides sign-in. The sign-in page loads Google's sign-in script, and profile pictures load from Google.
• PostHog provides product analytics. When product analytics is turned on, PostHog receives the data described under Product analytics above.

We do not sell personal data, and personal data is not used for advertising.

Where data is stored

The service's data is stored in Canada, on a server in Toronto, Canada, operated by DigitalOcean. Some of the providers above may process data outside Canada, including the United States.

Visiting this website

When you visit this website, your browser connects to a server in Toronto operated by DigitalOcean, which receives your IP address and the request needed to deliver the page. The website keeps no access logs, sets no cookies and uses no analytics.

How long we keep data

• An Instagram account's connection, conversations, messages, received media and automations are kept while the account is connected. They are deleted when a project owner or administrator chooses Disconnect or when the project is deleted: database records at once, stored files within minutes.
• Removing Blanc's access in Instagram or Meta settings stops new data but deletes nothing already stored. The data is kept until Disconnect, deletion of the project or a verified deletion request.
• Copies of incoming message text in automation run history are kept for up to 100 days, then deleted automatically, or earlier when the connection is deleted.
• Project content, such as the knowledge document and its history, conversations with the AI assistant, ratings, templates and files, is kept until the project is deleted. An uploaded file is removed 24 hours after nothing uses it.
• Your Blanc account is kept until you make a verified deletion request.
• A session stays valid for 30 days and ends earlier when you sign out.
• Manual requests are completed within 30 days of verification.

Deleting your data

A project owner or administrator can disconnect an Instagram account, which deletes that account's Instagram data in Blanc. The project owner can delete the project, which deletes everything in the project. Disconnect keeps some project content, such as conversations with the AI assistant and the knowledge document, until the project is deleted. Deleting a Blanc account or one person's conversations is possible by email request. Deletion requests that come from Meta are handled by a person, after verification. See how to delete your data for every path and what it deletes.

Your rights

You can ask for access to the personal data Blanc holds about you, ask us to correct it, ask us to delete it, and withdraw your consent to its processing. To make any of these requests, write to info@nowblanc.com with the Instagram username or Blanc account email the request concerns and what you are asking for. We verify your identity and the scope of the request first, and complete it within 30 days of verification.

Your name, email address and profile picture come from your Google account and are updated each time you sign in. Customers can also withdraw consent by disconnecting an Instagram account or deleting the project. Counterparts can also contact the business they messaged.

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to complain to the Office of the Privacy Commissioner of Canada.

Security

• Connections to the service use HTTPS.
• Instagram access tokens are encrypted at rest.
• Session tokens are stored only as hashes.
• Stored files are kept in private storage, accessible only through the Blanc service.
• Access to a project depends on each member's role, which the service checks on every action.
• Server logs contain no message content, and production analytics contains no message content.

Changes to this policy

We may update this policy when Blanc changes. The updated policy is published on this page with a new effective date.

Effective date: November 14, 2026.