Last updated: May 30, 2026
PointShift ("we", "us", "our") operates an e-commerce platform that lets businesses build and run online stores, including an optional onboarding flow that imports branding and products from a connected Instagram business account. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using PointShift you agree to this policy.
When you create an account or configure a store, we collect information such as your name, email address, business name, and store settings. If you process orders, we handle order and customer details that you and your customers provide.
If you choose to connect an Instagram business account, you authorize us through Facebook Login to access, on your behalf: your Facebook Pages list, the Instagram business account linked to a Page, your Instagram profile (name, username, biography, profile picture, follower and media counts), your recent media (images, captions, and like/comment counts), a Page access token, and — only if you opt in — products from a linked Meta Commerce Catalog. We access this data solely to set up and theme your online store.
We use the information to provide and operate the platform; import your logo, brand colors, and products to build your store; process orders and payments; provide support; secure the service and prevent abuse; and comply with legal obligations. We do not use your Instagram or Facebook data for advertising, and we do not sell it.
Our use and transfer of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies, including any limited-use requirements. Instagram and Facebook data is used only to provide the onboarding and store features you request.
Access tokens and other secrets are encrypted at rest. Images imported from Instagram are downloaded and re-hosted on our own infrastructure. We apply administrative and technical safeguards appropriate to the sensitivity of the data, although no method of transmission or storage is completely secure.
We retain account and store data for as long as your account is active or as needed to provide the service. Imported Instagram tokens are retained only while needed to operate the connection and can be revoked at any time. We delete data on request or when it is no longer required.
We share information only with service providers that help us operate the platform (for example hosting, payment processing, and Meta APIs), when required by law, or to protect our rights and users. We do not sell personal information.
Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can disconnect a connected Instagram account at any time, which stops further data access.
You can remove our app from your Facebook account settings, which revokes our access and the tokens we hold. You can also request deletion of the data associated with your connection; our automated data-deletion endpoint processes such requests and provides a confirmation. To request deletion or ask questions, contact us at the address below.
We use cookies and similar technologies that are necessary to authenticate sessions, operate the platform, and remember preferences such as language. You can control cookies through your browser settings, although disabling them may affect functionality.
PointShift is intended for businesses and is not directed to children. We do not knowingly collect personal information from children.
We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date. Material changes may be communicated through the platform.
If you have questions about this Privacy Policy or your data, contact us at support@pointshift.net.