How InstaMore collects, uses, protects, and shares information across our website, mobile app, vendor portal, and management systems.
Effective date: August 29, 2026 | Last updated: August 29, 2026
This Privacy Policy explains how InstaMore ("InstaMore," "we," "us," or "our") handles information when you use the InstaMore mobile application, instamore.com, vendor and administration portals, application programming interfaces, customer support, and related loyalty services (collectively, the "Services"). It applies to shoppers, vendor owners and staff, applicants, website visitors, and support contacts.
InstaMore is the service identified in the Apple App Store and Google Play listings. Privacy questions and requests may be sent to [email protected].
Depending on how you use the Services, we may collect your name, email address, verified mobile number, profile photograph, account role, vendor affiliation, optional age range, optional gender, language, country, account status, consent records, and identifiers received from Apple, Google, or Facebook when you choose social sign-in. A social provider may not supply an email address on every sign-in.
We process one-time-code challenges, hashed local credentials where applicable, refresh-session identifiers, two-factor-authentication settings, device and session information, IP address, user agent, timestamps, rate-limit events, fraud signals, and security/audit records. SMS and voice one-time codes are used only with the mobile number you provide. Biometric authentication is performed by the operating system; InstaMore does not receive or store your fingerprint or face template.
We collect participating-vendor visits, opaque QR/barcode token activity, loyalty transactions, invoice or command references, spend amounts, points, rewards, cashback, redemptions, tiers, promotions, bookmarks, notification engagement, membership status, and vendor-specific history needed to provide and audit the loyalty service. Tokens displayed for scanning are signed, purpose-limited, expiring credentials and are not intended to expose a sequential customer identifier.
For vendor applicants, owners, and staff, we may collect business and contact details, address and map coordinates, category, public directory content, reward configuration, employee permissions, promotions, customer interactions, support requests, ratings, and security/audit activity. Public vendor profiles may be visible without signing in.
We may collect app version, operating system, device and push-notification tokens, notification preferences and delivery events, diagnostic events, crash or performance information, support messages, and correspondence. The app may request camera access to scan loyalty codes or select a profile image, photo-library access when you choose an existing image, and notification permission to deliver alerts. We do not access these capabilities unless permission is granted or you initiate the feature.
When you visit our website or submit a contact request, we may process your IP address, browser and device information, referring page, approximate request time, name, email, optional phone or company, and the message you submit. Essential cookies or similar storage may be used for security, session continuity, and site operation.
We collect information directly from you; automatically from the app, browser, device, and API requests; from participating vendors when they record an authorized loyalty interaction; from identity providers you select; from Apple App Store and Google Play purchase-verification services; and from service providers that deliver communications, storage, maps, hosting, security, or support.
We do not sell personal information. We do not use the contents of SMS messages or phone calls for advertising. Marketing messages, if offered, require the consent applicable to that channel and can be withdrawn without disabling essential account or transaction notices.
A verified email address or mobile number may be used for passwordless sign-in, registration proof, account recovery, security notices, and loyalty transaction notices. AWS End User Messaging may deliver SMS or voice verification codes. Standard carrier message or call charges may apply. Transactional consent is recorded separately from optional marketing consent.
Push notifications are supported on both iOS and Android. APNs and FCM receive a device token and delivery information needed to route a notification. You can change push permission in device settings and communication preferences in the app. Denying optional notifications does not prevent vendor browsing or other functionality that does not require a notification.
Paid digital memberships are offered only through Apple In-App Purchase/StoreKit on iOS and Google Play Billing on Android. Apple or Google processes the payment and applies its own privacy policy. InstaMore does not receive or store your full payment-card number. We receive and retain limited store data such as product identifier, transaction or purchase reference, verification result, entitlement status, renewal/expiration state, and provider event identifiers needed to grant access, prevent fraud, provide support, and reconcile subscriptions.
We disclose only what is reasonably necessary for the applicable purpose:
Service providers that process user data for InstaMore are expected to protect it consistently with this policy and applicable platform requirements, use it only for authorized services, and apply appropriate security controls.
You may revoke an optional permission in device settings. Some user-initiated features will not function without their necessary permission, but we provide a reasonable alternative where the platform supports one.
We keep personal information only as long as reasonably necessary for the purposes described above, including providing active accounts, honoring subscriptions, preventing fraud and token replay, resolving disputes, maintaining financial and loyalty ledgers, satisfying legal or accounting obligations, and enforcing agreements. Authentication challenges and one-time proofs expire after short, bounded periods. Operational logs, provider events, and security audit records are retained for bounded operational or compliance periods and are access restricted.
When an account-deletion request is completed, we delete or irreversibly de-identify account data that is not required to be retained. Limited transaction, subscription, security, fraud-prevention, tax, accounting, or legal records may be retained where required or reasonably necessary, with access restricted and no use for unrelated marketing. Backups age out according to the backup lifecycle and are not restored for ordinary product use.
You can request deletion inside the app from account/settings controls or use the public instructions at instamore.com/account-deletion. Deleting an InstaMore account does not automatically cancel a store subscription; cancel it first in Apple or Google subscription settings to avoid future store charges.
Subject to applicable law, you may request access to or correction, export, restriction, objection, or deletion of your personal information. You may update available profile and preference fields in the app, revoke optional permissions in device settings, withdraw optional communication consent in the app or by contacting us, and request help at [email protected]. We may verify your identity before acting and may explain when a request cannot be fulfilled in full.
We use measures designed to protect information, including encrypted network transport, role- and tenant-based access controls, signed expiring scan tokens, rate limiting, credential and secret protection, authentication controls, audit logging, provider verification, and restricted production access. No method of storage or transmission is completely secure; please protect access to your email, phone, device, and social identity accounts and report suspected misuse promptly.
InstaMore and its providers may process information in countries other than your own. Where required, we use contractual, technical, or organizational safeguards intended to protect information during cross-border processing.
The Services are not directed to children under 13, and we do not knowingly collect personal information from a child under 13 without legally valid authorization. Users who are not old enough to consent under applicable law must use the Services only with authorization from a parent or guardian. Optional age-range information is not used to create a mandatory demographic profile. Contact us if you believe a child supplied information improperly.
We may update this policy when our Services, providers, or legal obligations change. We will post the revised policy with a new effective date and provide additional notice in the app or by an appropriate communication when a material change requires it. Continued use after an effective update is governed by applicable law and any consent we are required to obtain.
Email privacy, security, or data-rights questions to [email protected], or use the InstaMore contact page. Please do not send passwords, one-time codes, full payment details, or other unnecessary sensitive information.