Who we are

Kizuki is operated by André Brito (andrebrito.dev), based in Brazil, who is the controller of the personal data described here. For anything about privacy, write to [email protected].

This policy covers the Kizuki website, the Kizuki web app at app.kizuki.invalid and the Kizuki MCP server used by AI assistants.

The short version

Kizuki is read-only towards Instagram. It never posts, comments, sends messages or changes anything on your accounts.
We collect insights so you keep the history Meta deletes. We keep them while the account is connected, and delete them when you disconnect it or delete your Kizuki account.
We do not sell your data, we do not show ads and we do not use third-party advertising trackers.
Your Meta access token is encrypted, never logged, never shown by the API and never shared with anyone, including the people you share an account with.
You can delete everything yourself, at any time, in a few clicks. See User Data Deletion.

Data we collect

When you sign in with Google

You sign in to Kizuki with Google (OpenID Connect). We receive and store your Google account identifier, email address, name and profile picture URL. We never see your Google password.

When you connect an Instagram account

You connect Instagram professional (business or creator) accounts through Facebook Login for Business. We ask Meta only for these permissions:

instagram_basic: read the profile and the list of posts of the Instagram account.
instagram_manage_insights: read the insights of the account and of its posts, reels and stories.
pages_show_list: list the Facebook Pages you manage, to find the Instagram accounts linked to them.
pages_read_engagement: read the Page details needed to reach the linked Instagram account.

With those permissions we store:

Your Facebook app-scoped user ID and the Meta access token for the connection. The token is encrypted at rest with AES-256-GCM.
The Instagram account profile: username, name, profile picture, follower, following and media counts, and the name of the linked Facebook Page.
Account insights collected every day, such as reach, views, followers and engagement metrics.
Posts, reels and stories metadata (caption, permalink, media type, timestamps and thumbnail URL) and their insights over time.
Audience demographics, aggregated by Meta: age, gender, city and country. We never receive or store data about individual followers.
The raw responses of the Instagram API, kept for up to 30 days to investigate collection problems.

When you use Kizuki

Sessions: the IP address and browser user agent of each signed-in session, stored with the session.
Daily activity: the days on which you used Kizuki, to understand product usage.
Audit logs of workspace actions (invitations, shares, account connections) and of the tool calls made by your AI assistants through the MCP server.

When we email you

We send transactional emails (invitations and notices about your account) and product emails such as updates and announcements. We keep delivery logs of those emails. If you unsubscribe, we keep your email address on a do-not-email list so we never email it again.

How we use your data

To provide Kizuki: sign you in, collect and store the insights of the accounts you connect, show them in your dashboard, share them with the people you choose and answer your AI assistants. Legal basis: performance of our contract with you.
To keep Kizuki secure and working: manage sessions, prevent abuse, investigate errors and keep audit logs. Legal basis: our legitimate interest in a safe, reliable service.
To understand usage in aggregate (for example, how many people are active each day) and improve the product. Legal basis: our legitimate interest.
To email you: transactional emails are part of the service; product emails rely on our legitimate interest or your consent, and every one has a one-click unsubscribe link.
To meet legal obligations and respond to lawful requests from authorities.

How we use Instagram data

Data received from Meta is used only to show you, and the people you share an account with, the insights of that account inside Kizuki and through your AI assistants. We do not sell it, use it for advertising, or share it with data brokers. We do not publish, comment, message or change anything on Instagram or Facebook.

Kizuki is not affiliated with, endorsed by or sponsored by Meta Platforms or Instagram.

International transfers

Some of our providers process data outside Brazil, for example in the United States. When that happens we rely on the safeguards allowed by the LGPD and, where applicable, the GDPR, such as contractual clauses with those providers.

How long we keep data

Insights, posts, stories and audience data: while the Instagram account stays connected. Keeping the history Meta deletes is the purpose of Kizuki. They are deleted when you disconnect the account or delete your Kizuki account.
Raw Instagram API responses: up to 30 days.
Your Kizuki account, sessions and activity: until you delete your Kizuki account.
Email delivery logs: until you delete your Kizuki account. Your address stays on the do-not-email list only if you unsubscribed.
Backups: they rotate out within 30 days, so deleted data disappears from them within that period.

Security

Traffic to Kizuki is encrypted in transit. Meta access tokens are encrypted at rest with AES-256-GCM, are never written to logs and are never returned by our API. Sessions are kept on our servers and access to the data is limited to what is needed to run the service. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

Your rights

Under the Brazilian General Data Protection Law (LGPD) and, where it applies, the GDPR, you can:

confirm whether we process your data and get access to it;
correct incomplete, inaccurate or outdated data;
delete your data, or have it anonymized or blocked;
receive your data in a portable format;
object to processing based on legitimate interest;
withdraw consent at any time, for processing based on consent;
get information about who we share your data with.

Most of this you can do yourself in Kizuki. For anything else, email [email protected] from the address of your Kizuki account. We answer within 15 days. You can also complain to the Brazilian data protection authority (ANPD) or to the authority of your country.

Deleting your data

You can delete your Kizuki account, disconnect a single Instagram account, remove Kizuki from your Facebook settings or ask us by email. The steps and exactly what each option deletes are on the User Data Deletion page.

Cookies and local storage

The website stores only your theme and language preference in your browser's local storage.
The app uses a strictly necessary session cookie to keep you signed in.
We do not use analytics or advertising cookies.

Children

Kizuki is not meant for people under 18 and we do not knowingly collect their data. If you believe a minor has created an account, email [email protected] and we will delete it.

Changes to this policy

If we change this policy, we will update the date at the top of this page. If the change is significant, we will also tell you in the app or by email before it takes effect.

Contact

André Brito (andrebrito.dev), Brazil. Email: [email protected]. See also the Terms of Service.