ProfitSignal

Privacy Policy

Effective and last updated: October 25, 2026

Who we are

ProfitSignal operates the ProfitSignal sales workflow application at www.profitsignal.org. Businesses use ProfitSignal to manage leads, conversations, calls and team performance in a shared workspace.

Questions about this policy or your information can be sent to contact@profitsignal.org.

Information we collect

Account and workspace information

When you create or join a workspace, we process the information needed to run your account, such as your name, email address, sign-in details, the workspace you belong to and your role in it.

Information your business adds to ProfitSignal

Workspaces store the records they create or import in the product, such as leads, conversation notes, call records, deals and related activity.

Instagram connections

A workspace can connect its Instagram professional account to ProfitSignal in one of two separate ways: a manual connection using a Facebook Page access token, or Instagram Business Login. Each is described below.

Manual Page-token connection

How an account is connected

A workspace can connect its own Instagram professional account in ProfitSignal's settings by entering a Facebook Page access token for the Facebook Page linked to that Instagram account, together with the app secret of the workspace's own Meta app. ProfitSignal uses the token on its servers to look up the linked Instagram professional account and stores:

  • the Facebook Page access token and the app secret the workspace entered;
  • the Instagram professional account's identifier; and
  • a hashed verification token used to confirm the webhook connection.

For this manual connection, ProfitSignal does not provide a Facebook or Instagram login and does not request Meta permissions through an app of its own; the access token is created by the workspace in its own Meta app.

What we receive and store

When Instagram delivers message notifications for the connected account, ProfitSignal checks each notification's signature and, for messages that contain text, stores:

  • the message text;
  • the sender's Instagram-scoped identifier and, for a new sender, their Instagram name and username;
  • the time Instagram reports the message was sent or, if Instagram does not provide one, the time we processed it; and
  • Instagram's identifier for the message.

Instagram also notifies the connected account of messages that the account itself sends from Instagram. ProfitSignal stores the text of those messages in the same conversation so the history is complete.

ProfitSignal does not send Instagram messages, does not store images, video or other attachments (messages without text are not stored), and does not connect to Facebook Messenger.

How we use it

We use information from a connected Instagram professional account only to:

  • create or update the lead for the person messaging the account;
  • show the conversation history in the workspace's ProfitSignal workflow;
  • include the conversation in the workspace's conversation analysis features, which can use our AI provider;
  • maintain the connection and provide support; and
  • protect the service.

We do not sell personal information, and we do not use Instagram message data for advertising.

Instagram Business Login

How an account is connected

Where Instagram Business Login is available to a workspace, a workspace owner, admin or manager can connect the workspace's Instagram professional account by signing in to Instagram and approving ProfitSignal's app. ProfitSignal asks for permission to read the account's basic profile information and to access the account's Instagram messages. With this connection the workspace does not enter a Page access token or the app secret of a Meta app of its own, and ProfitSignal does not store one.

What we store

  • the access token Instagram issues for the account, stored encrypted on our servers and never returned to the browser, and the time it expires;
  • the Instagram professional account's identifier and username, and the app-specific identifier Instagram provides;
  • the permissions that were granted;
  • which workspace member connected the account, and when; and
  • the connection's status, including whether Instagram reported our message-notification subscription request as successful, when we last processed an incoming text message for it, and the most recent connection error.

While a sign-in is in progress, we also keep a short-lived, hashed record of the request so that a forged or repeated sign-in response can be rejected.

Messages

When an account is connected this way, ProfitSignal asks Instagram to enable message notifications for it. If Instagram reports that request as successful, Instagram can then notify ProfitSignal when someone sends the account a message; if the request fails, we record the failure in the connection's status. We verify the signature on each notification before using it.

While the connection is active, when someone sends the connected account a text message, we store the message text, the time Instagram reports it was sent (or, if Instagram does not provide one, the time we processed it) and Instagram's identifier for the message in the workspace. If the sender is not already a lead in the workspace, we create a lead for them using the name and username Instagram provides for them, where available.

Through this connection, we do not store messages that the connected account itself sends, attachments, or messages without text, and we do not send messages.

Disconnecting

A workspace owner, admin or manager can disconnect the account in ProfitSignal's settings. Disconnecting removes the stored access token from our records and marks the connection as disconnected. It does not delete messages already stored in the workspace, and ProfitSignal does not currently ask Instagram to stop message notifications or to remove ProfitSignal's access; you can remove that access from your Instagram account settings. After the connection is disconnected, we do not store new messages sent to the account through it.

How information is shared

Workspace information is available to the authenticated members of that workspace, according to their role. We use service providers to run ProfitSignal, and they process information on our behalf:

  • Supabase, for our database and account sign-in;
  • Vercel, for hosting the application;
  • Anthropic, for AI features that analyze content in a workspace, which can include conversation content such as connected Instagram conversations;
  • Resend, for sending account and service emails;
  • Stripe, when a workspace connects its own Stripe account to bring its payment records into ProfitSignal; and
  • Meta, to look up the connected Instagram account and sender details, to receive message notifications for either kind of connection, and to complete Instagram Business Login.

We may also disclose information when required by law or to protect the rights and safety of our users and service.

Access controls and security

Workspace data is separated by workspace and is accessible only to authenticated members of that workspace, with database access rules applied to each workspace's records. The access token and app secret for a manual Instagram connection, and the encrypted access token for an Instagram Business Login connection, are kept on our servers and are not returned to the browser. We verify the signature on incoming Instagram message notifications, and information is transmitted over encrypted HTTPS connections.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

Retention and deletion

We keep workspace information, including stored Instagram conversations, while the workspace uses ProfitSignaland as needed to provide the service, unless it is deleted earlier. When a manual Instagram connection is disconnected, ProfitSignal clears the stored access token and app secret for that connection. When an Instagram Business Login connection is disconnected, ProfitSignal clears the stored access token and keeps the account and connection details described above. In both cases, messages already stored remain in the workspace until they are deleted.

You can ask us to delete your information at any time. See our data deletion instructions. We may keep limited information where we must for legal, security or fraud-prevention reasons.

Your choices and rights

You can contact us at contact@profitsignal.org to request access to, correction of or deletion of your information, or to have an Instagram connection disconnected. For a manual connection, you can also revoke the access token in your own Meta app. Revoking the token alone does not disconnect the connection in ProfitSignal; if Meta continues to deliver validly signed message notifications, new messages may still be stored until the connection is disconnected. For an Instagram Business Login connection, a workspace owner, admin or manager can disconnect it in ProfitSignal's settings, and you can remove ProfitSignal's access from your Instagram account settings. Instagram message senders do not need a ProfitSignal account to request action on their own information. We may need to verify your identity before acting on a request.

Children

ProfitSignal is a business tool and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact contact@profitsignal.org.

Changes to this policy

We may update this policy from time to time. When we do, we will post the updated version on this page and change the date at the top.

Contact

ProfitSignal: contact@profitsignal.org. To request deletion of your data, follow the data deletion instructions.