Social Commerce Privacy Policy

1. Who We Are & Scope

Kinect, Inc. (“Kinect,” “we,” “us”) provides an AI commerce platform for brands. This Social Commerce Privacy Policy covers our social commerce features, which let a brand connect its social media accounts (such as an Instagram professional account) to Kinect, receive and manage direct messages and related interactions in a shared inbox, and respond to the people who message them, including with AI assistance. We process personal data in two capacities. For our own purposes, such as operating merchant accounts and this website, we act as the data controller. For the messages, contacts, and interactions a brand manages through Kinect, the brand is the data controller and Kinect acts as a data processor, handling that data only on the brand’s instructions and to provide the service. Our general Privacy Policy at trykinect.ai/legal/privacy covers the rest of the Kinect platform; where the two overlap, this policy governs the social commerce features.

2. Who This Policy Covers

In this policy, we describe how we process personal data relating to the following people:

• •Merchants and their teams: The brands that use Kinect and the staff members they invite to the dashboard.
• •Social contacts: The people who send direct messages to, comment on, or otherwise interact with a brand’s connected social media accounts. We have no direct relationship with these individuals; we process their data on the brand’s behalf.
• •Website visitors: People who browse trykinect.ai or submit a form there. See our general Privacy Policy for the details of website data handling.

3. How We Collect Information

What we collect depends on how you interact with Kinect. Most of it falls into the following situations:

• •When a brand connects a social account: When a merchant connects an Instagram professional account (or another supported social account) to Kinect, we receive data about that account and its conversations through the platform’s official APIs and webhooks, under the permissions the merchant grants during the connection flow.
• •When someone messages a connected brand: When a person sends a direct message to a brand’s connected account, the social platform delivers that message to Kinect so the brand can read and answer it. We collect the message content, the sender’s public profile information as shared by the platform, and message metadata such as timestamps.
• •When merchants use the dashboard: When a merchant or team member uses the Kinect dashboard, we collect account details, the replies and notes they write, and usage and log data such as IP address, browser type, and the pages and features used.
• •When you contact us: When you email us or submit a form, we store the content of the message and your contact details so we can respond.

4. What Information We Collect

Through the social commerce features, we collect and process the following data:

• •Merchant account details: Name, email, company, and workspace settings for the merchants and team members who use the dashboard.
• •Connected social account data: The identifiers, username, and profile information of the social accounts a merchant connects, along with the access tokens needed to receive and send messages on the merchant’s behalf. Tokens are stored encrypted and used only to operate the connection.
• •Messages and conversation content: The direct messages, story replies, and comments exchanged between a brand and its social contacts, the replies sent from Kinect (whether written by a person or drafted with AI assistance), and conversation state such as read status and assignment.
• •Social contact profiles: The public profile information the platform shares about a person who messages the brand, such as username, display name, and profile photo, so the brand can recognize who it is talking to.
• •Usage data and logs: Technical data collected automatically when the service is used, including IP address, device and browser information, and feature usage. We use this to keep the service reliable and secure.

5. How We Use Information

We use the information above to: deliver messages between social platforms and the brand’s inbox in Kinect; let merchants and their teams read, organize, assign, and answer conversations; generate AI-assisted replies and summaries when the merchant uses those features; help the brand recognize returning customers and connect conversations to their commerce context; send merchants service communications such as notifications, security alerts, and support responses; maintain security, prevent abuse, and enforce rate limits; comply with law; and improve the reliability and quality of the service. We do not sell personal information, we do not use social contacts’ data for advertising, and we do not use one brand’s conversation data to serve another brand.

6. Platform Data From Meta & Other Social Platforms

Where Kinect receives data through Meta’s APIs (Instagram and Facebook) or other social platforms’ APIs, we use that data only to provide and improve the service the merchant connected, consistent with the platform’s terms, including Meta’s Platform Terms and Developer Policies. Specifically: we request only the permissions the features need; we use platform data solely to operate the merchant’s inbox and messaging features; we do not sell platform data, use it for advertising, or build profiles unrelated to the service; and we delete platform data when the merchant closes their Kinect account or asks us to, except where retention is required by law. When a merchant disconnects an account, we delete its access tokens and stop receiving new data from the platform; the conversation history already in the merchant’s inbox remains available to the merchant until it is deleted as described in the Data Retention section below. People who message a brand can stop at any time, and can ask the brand or the platform to delete their conversation data.

7. AI Processing & Subprocessors

Kinect uses large language models to help brands answer conversations. When a merchant uses AI-assisted features, message content and relevant store context are sent to AI model providers through an AI gateway solely to generate a draft or response. AI providers process this data to provide the service and are not permitted to use it to train their models under our agreements. We rely on the following categories of subprocessors to deliver the social commerce features:

• •Social platform APIs: Meta’s messaging APIs (and those of other connected platforms) receive the replies a brand sends so they can be delivered to the recipient.
• •AI model routing & providers: Vercel AI Gateway routes inference requests to LLM providers (such as Anthropic, OpenAI, and Google) to generate assistant responses and drafts.
• •Hosting & infrastructure: Fly.io and Vercel host the application and serve API and webhook traffic.
• •Database: A managed PostgreSQL database (Supabase) stores conversations, connected-account configuration, and analytics.
• •Email: Transactional and inquiry email is sent via Resend.

8. How We Share Information

We do not sell personal data to third parties for commercial or advertising purposes. We share information only as needed to run the service: with the brand whose account a person is messaging, since the conversation belongs to that relationship; with the social platform, to deliver replies through its APIs; with the subprocessors listed above, who are bound by contract to protect the data and use it only to provide their service to us; with professional advisors where necessary; where required by law or to protect the rights, safety, and security of Kinect, merchants, or the people messaging them; and, if Kinect is involved in a merger, acquisition, or sale of assets, as part of that transaction, in which case this policy continues to apply to the transferred data.

9. Your Rights & Choices

Depending on where you live (for example, under GDPR in the EU/UK or the CCPA/CPRA in California), you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You also have the right to complain to your data protection authority. If you messaged a brand through a social platform, please direct your request to that brand first, since the brand controls that data; we support merchants in fulfilling these requests. You can also contact us directly at hello@trykinect.ai and we will help route or fulfill the request. We do not discriminate against you for exercising these rights.

10. Data Retention

We retain conversation data and connected-account configuration for as long as the merchant’s account remains active and the data is needed to provide the service, and as required to meet legal, security, and accounting obligations. Disconnecting a social account deletes its access tokens and stops new collection, while the existing conversation history stays in the merchant’s workspace so the brand keeps its customer records. When a merchant closes their Kinect account, or upon a valid deletion request, we delete or anonymize the associated data within a reasonable timeframe, unless a longer retention period is required by law or necessary to establish, exercise, or defend legal claims.

11. International Data Transfers

Kinect is based in the United States, and our subprocessors may process data in the United States and other countries. Where personal data is transferred across borders from the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as standard contractual clauses, and require our subprocessors to maintain comparable protections.

12. Children’s Privacy

The Kinect dashboard is built for businesses and is not intended for anyone under 18. The messaging features are not directed to children under 13 (or the minimum age required by the social platform in the applicable jurisdiction), and we do not knowingly collect personal information from children. If we learn that we have collected personal data from a child without the required consent, we will delete it promptly. If you believe a child has provided us information, contact us at hello@trykinect.ai.

13. Security

We take reasonable and appropriate measures to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. All data exchanged between clients, social platforms, and our servers is encrypted in transit using TLS, data is encrypted at rest, access tokens are stored encrypted, webhooks are verified, and we follow least-privilege access controls. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard safeguards. If a security incident results in unauthorized access to personal data and is likely to result in a risk to your rights and freedoms, we will notify affected parties without undue delay after becoming aware of the breach, along with the measures taken in response.

14. Legal Basis for Processing (EEA & UK)

If you are in the EEA or the UK, our legal basis for processing depends on the context: we process merchant data to perform our contract with the merchant (Art. 6(1)(b) GDPR); we process data based on our legitimate interests (Art. 6(1)(f) GDPR) to communicate about the service, maintain security, and prevent abuse; and we process data based on consent (Art. 6(1)(a) GDPR) where you have opted in, for example to marketing communications, which you can withdraw at any time. For the conversations a brand manages through Kinect, the brand determines its own legal basis as the controller, and we process on its behalf.

15. For California Residents

If you are a California resident, the CCPA/CPRA gives you the right to know the categories and specific pieces of personal information we have collected about you, the sources it came from, our purposes for collecting it, and the categories of third parties with whom it is shared; the right to request deletion and correction; and the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law. You may submit a request at hello@trykinect.ai, and you may use an authorized agent with written permission. We will verify your identity, acknowledge your request within 10 business days, and respond within 45 days (extendable to 90 with notice).

16. Changes to This Policy

We may update this policy from time to time to reflect legal, technical, or business developments. When we make material changes, we will update the “Last updated” date below and, where appropriate, notify merchants before the changes take effect. Continued use of the service after an update constitutes acceptance of the revised policy.