Privacy Policy

This Privacy Policy describes how Winfetti ("Winfetti," "we," "us," or "our") collects, uses, and shares information in connection with the Winfetti service (the "Service"), which enables businesses to run instant-win campaigns on Instagram. Winfetti is operated by Winfetti ("GFEF"), a foundation organized under the laws of Japan.

By using the Service, or by participating in a campaign powered by Winfetti, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Service or participate in Winfetti-powered campaigns.

1. Who We Are and Who This Policy Covers

This Privacy Policy applies to two groups of individuals:

• Business Users — businesses and their authorized staff who connect an Instagram professional account to Winfetti to run campaigns.
• Participants — Instagram users who enter a Winfetti-powered campaign by commenting on a campaign post.

2. Information We Collect

2.1 Information Received from Meta Platforms

When a Business User connects an Instagram professional account, and when Participants interact with campaign posts, we receive information from Meta Platforms, Inc. ("Meta") through the Instagram API, including:

• Instagram account identifiers (app-scoped user ID) and usernames
• Comments posted on designated campaign posts, including comment text, comment ID, and timestamp
• Media information for the connected account's own posts (media ID, caption, permalink, media type)
• Access tokens required to operate the Service on behalf of the Business User

2.2 Information Generated by the Service

• Campaign entry records (which account entered which campaign, and when)
• Draw results (win or lose) and prize fulfillment status
• Server logs, including timestamps and technical event data, used for reliability and security

2.3 Information Provided by Business Users

• Business contact details (name, email address, company name)
• Campaign settings (prize descriptions, odds, winner limits, notification message text)
• Billing information, processed by our payment provider (we do not store full payment card numbers)

We do not collect Participants' email addresses, phone numbers, passwords, or payment information through the Service.

3. How We Use Information

We use the information we collect to:

• Operate campaigns: receive comment events, record entries, prevent duplicate entries, and conduct instant prize draws
• Deliver campaign results to Participants via Instagram private reply (direct message) in response to their comment
• Provide Business Users with campaign analytics and entrant history
• Maintain, secure, and improve the Service, including detecting fraud and abuse
• Communicate with Business Users about their account and the Service
• Comply with legal obligations and enforce our Terms of Service

We send messages to Participants only as a direct response to their voluntary participation in a campaign. We do not use the Service to send unsolicited or promotional messages.

4. How We Share Information

We do not sell personal information. We share information only in the following circumstances:

• With the Business User running the campaign. Participants' usernames, comments, entry records, and results are made available to the business that operates the campaign they entered.
• With service providers. We use third-party infrastructure providers to host and operate the Service, including Supabase, Inc. (database hosting), Render Services, Inc. (application hosting), Vercel, Inc. (website hosting), and Cloudflare, Inc. (DNS and network services). These providers process data on our behalf and are bound by contractual confidentiality obligations.
• With Meta. Our use of Instagram data is subject to Meta's Platform Terms and Developer Policies. We interact with Meta's APIs to operate the Service.
• For legal reasons. We may disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of Winfetti, our users, or the public.
• Business transfers. In connection with a merger, acquisition, or sale of assets, information may be transferred to the successor entity, subject to this Privacy Policy.

5. Data Retention

We retain campaign entry data for the duration of the campaign and for a reasonable period thereafter to support prize fulfillment, dispute resolution, analytics, and legal compliance. Business Users may delete campaigns and associated entry data at any time. When a Business User disconnects their Instagram account or terminates their subscription, we delete associated access tokens promptly and delete or anonymize remaining data within 90 days, unless retention is required by law.

6. Data Deletion Requests

Participants may request deletion of their personal information at any time by contacting us at the email address below. Please include your Instagram username and, if known, the campaign you entered. We will process verified requests within 30 days.

If you disconnect Winfetti from your Instagram account through Instagram's settings, we will receive a deauthorization notice and delete associated tokens.

7. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect information, including encryption in transit (TLS), signature verification of all incoming webhook events, restricted access credentials, and hosting on providers that maintain industry-standard security certifications. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International Data Transfers

Winfetti is operated from Japan. Data may be processed in Japan, Singapore, and the United States by us and our service providers. By using the Service, you understand that your information may be transferred to and processed in countries other than your own, which may have different data protection laws.

9. Children's Privacy

The Service is intended for business use and for participation by individuals who meet Instagram's minimum age requirements. We do not knowingly collect personal information from children under 13 (or the applicable minimum age in your jurisdiction). If you believe we have collected such information, please contact us and we will delete it.

10. Your Rights

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, delete, or restrict processing of your information, and the right to data portability. Residents of California may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to opt out of any sale of personal information (we do not sell personal information). Residents of the European Economic Area and United Kingdom may have rights under the GDPR and UK GDPR. To exercise any of these rights, contact us at the address below. We will not discriminate against you for exercising your rights.

11. Third-Party Services

The Service operates on Instagram, a service provided by Meta. Your use of Instagram is governed by Meta's own terms and privacy policy, which we do not control. This Privacy Policy does not apply to Meta's collection or use of your information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date above. Material changes will be communicated to Business Users by email or through the Service. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: