ITSOLUTION
ONDO · Instagram data

Instagram Data Notice

This notice applies to ONDO's official Instagram API integration operated by ITSOLUTION Co., Ltd. Development and validation currently use a Meta app, Facebook Page, and professional Instagram account managed by the Company. This does not mean that customer account connections or a public data service have launched.

Article 1. Purpose and scope

We review selected public hashtag posts, original links, publication times, and available engagement metrics for brand and content-strategy research. Limited results are not presented as Instagram-wide rankings, sales, reach, or growth rates.

Authorized operators run a server-to-server integration and inspect a private report. The integration remains in development and app-role validation; production approval is not implied.

Article 2. Data processed

  • Authentication and permissions: administrator-approved access tokens, app, Page and professional Instagram account identifiers, and permitted scopes. We do not ask for passwords or verification codes through the data request channel.
  • Public content: hashtags and official identifiers, post and carousel-item IDs, original links, captions, publication times, media types, provided asset URLs, like and comment counts, and pagination data. We do not infer values the source does not provide.
  • Validation records: query time, API version, request count, processing time, and source usage and error signals. We treat public links and captions as potentially identifying information.
  • Private reports omit access tokens and signed media URLs and do not embed or download media binaries. The report generator performs no LLM analysis, model training, or automatic external publishing.

Article 3. Retention and access

Source responses are processed during a run. Private reports, execution evidence, and minimal test copies needed for validation are kept in a restricted company work environment. Continuous collection of official integration history and a separate customer database are not currently active. Test copies that retain original identifiers are not described as anonymous.

Copies are kept only while needed for validation, review, or regression testing and deleted when that purpose ends. A valid deletion request covers retained copies too. Access tokens are held in a restricted authentication environment only while authorized and are deleted or revoked when use ends. Expiry of a URL does not itself delete stored information.

Retained validation copies include private local evidence and selected repository fixtures. A deletion review includes repository history as well as current reports. We report the actual outcome and any remaining restriction; deleting one file does not necessarily erase every copy.

Article 4. Service providers

GitHub may be used for private source and test storage, and OpenAI may assist development with limited materials. Cloudflare Email Routing and Google Workspace carry inquiries and deletion requests. Google Firebase hosts this public notice. These roles do not imply that ongoing collection or analysis of official Instagram data is already in operation.

These services may use processing environments and support staff outside Korea, including in the United States. We do not guarantee that all materials are processed only in Korea. We check applicable providers and processing regions for the actual service and contract. The provider disclosures below cover entire services; they do not mean that every provider or country received every item of data.

Google Workspace
Service providers

Article 5. Access and deletion requests

  1. Put ‘ONDO Instagram data request’ in the subject. Include the original post link or Graph media ID, the access, correction, or deletion you request, and only the information needed to confirm you are the person concerned or an authorized representative. Do not send passwords, access tokens, or verification codes.
  2. We verify your authority and identify the information. Account login IDs and post IDs are different and are not treated as the same identifier. If more verification is needed, we ask only for the necessary details.
  3. For an authorized request, we review current reports, source validation material, test copies, and relevant retained history, then take the appropriate action. We tell you when we do not hold the information and report the result and any remaining limits.
  4. If a legal retention duty prevents immediate deletion, we explain the reason and scope. Temporary copies used to handle the request are deleted when the process ends, and only necessary details remain in the outcome record.

Article 6. Safeguards and authority requests

We restrict access and keep credentials out of public repositories and reports. If a government agency requests personal information, we review the legal basis, challenge improper requests, minimize any data disclosed, and record the request, decision, and response. Any disclosure requires individual review and approval by the Company's representative.

This notice describes the official integration as of October 7, 2026. We update it when functionality, providers, or retention methods change. The website Privacy Policy separately covers visitor analytics and general inquiries.

Website policy
Privacy Policy