Privacy Policy

Last updated: October 15, 2026 Effective date: October 15, 2026

This Privacy Policy describes how Insider ("Insider," "we," "us," or "our") collects, uses, and discloses information when you use the Insider mobile application and related services (collectively, the "Service"). The Service connects restaurants ("Restaurants") with content creators ("Creators") for promotional experiences.

By creating an account or otherwise using the Service, you agree to the practices described in this Policy. If you do not agree, do not use the Service.

Quick summary (for convenience only — the full Policy controls):

• We are a U.S.-based service. Use of the Service is restricted to users 18 years of age or older.
• We collect the information you give us (name, email, date of birth, social handles, business details, photos), information generated by your use (claims, redemptions), and limited device/log data.
• Creators connect an Instagram professional account. While it is connected, we regularly collect your account details, follower demographics, posts, stories and their statistics from Instagram, and we save copies of the stories and reels you post as proof. See Section 4.6.
• We do not sell your personal information for money, and we do not use facial recognition or biometric identifiers.
• You can delete your account from inside the app at any time.

1. Who we are and how to contact us

Insider is operated by Insider Members, Inc., based in Miami, Florida.

For privacy questions, requests, or to exercise your rights, contact us at:

Email: privacy@jointheinsider.com

Mail: Available upon request at privacy@jointheinsider.com

2. Scope

This Policy applies to the Insider mobile app on iOS, our backend services, and any web pages we operate that link to this Policy. It does not apply to:

• Restaurants' own websites, social media, in-store experiences, or marketing channels;
• Third-party platforms you connect or refer to (e.g., Instagram, TikTok, YouTube), including how those platforms handle what you post on them.

We are not responsible for the privacy practices of those third parties. Review their policies separately. This Policy does cover the information we receive from those platforms when you connect an account to Insider, such as the Instagram data described in Section 4.6.

3. Age restriction — no users under 18

The Service is not directed to children, and we do not knowingly collect personal information from anyone under the age of 18. As part of the Creator application flow, we require users to confirm a date of birth showing they are at least 18 years old. Restaurant accounts must be created and managed by an adult authorized to represent the business.

If you believe a person under 18 has provided us personal information, email privacy@jointheinsider.com and we will delete it. This Service is not designed to comply with the Children's Online Privacy Protection Act ("COPPA") because it is not intended for children under 13.

4. Information we collect

4.1 Information you provide directly

Creator applicants and Creators:

• First and last name
• Date of birth (used solely to verify the 18+ age requirement and is not displayed publicly)
• Email address
• Your Instagram account, which you connect through Instagram's own login (see Section 4.6), and, if you provide them, TikTok and YouTube handles and approximate follower counts
• City / location (Miami neighborhoods or city)
• A short verification code sent to your email and your acknowledgement of the Insider community principles
• Links to content you post as proof of completing an experience (e.g., Instagram Stories, Reels, Posts). Proof on Instagram is usually detected automatically from your connected account (see Section 4.6).

Restaurant applicants and Restaurant users:

• First and last name of the person applying
• Company / restaurant name
• Business email and phone number
• Website (optional)
• How they heard about Insider (optional)
• Restaurant profile information you publish (name, neighborhood, cuisine type, bio, cover image)
• Experience content you publish (headline, description, requirements, expiry date, experience images, claim limits, minimum follower thresholds)
• QR scan events and claim/redemption decisions you take in the app

4.2 Information generated through your use of the Service

• Claims and redemptions: when a Creator claims an experience and when a Restaurant scans or otherwise confirms a redemption, we store records (experience, restaurant, creator, timestamps, status, deliverable proofs, and any dispute status).
• Account state: authentication tokens, application status (received / under review / approved / rejected), and timestamps reflecting when notifications were sent or acknowledged.
• Support and dispute communications.

4.3 Information collected automatically

• Device and log data: IP address, device type and OS version, app version, language, time zone, crash reports, and basic diagnostic events generated by the operating system and our backend (Supabase).
• Cookies and similar technologies (web only): if you visit a web page operated by us, we may use strictly necessary cookies and limited analytics cookies. The Insider mobile app does not use browser cookies, but it does use local storage on your device to keep you signed in (via Async Storage / Supabase).

4.4 Camera and photo library

The app requests access to your camera so that Creators can scan Restaurant QR codes to redeem experiences and so that you can take photos for experience images. It requests access to your photo library so you can upload existing images. We only access the camera and photo library when you take an action that requires it. We do not continuously record audio or video, and we do not run facial-recognition or biometric-identification processing on any image you provide.

4.5 Location

When you open the restaurant map, the app asks permission to use your device's precise location. If you allow it, we use your location only on your device — to show your position on the map (the "blue dot") and to re-center the map on you when you tap the recenter button. We do not store your precise location, and we do not transmit it to our servers or to any third party. It is used only while the map is open and is not retained afterward.

When we ask for your city or neighborhood (for example, in the Creator application), we use the text you type; we do not derive it from GPS. You can decline or later revoke the location permission at any time in your device's operating-system settings — the map still works without it (you simply won't see your own position on it).

4.6 Information from your Instagram account

Creators connect an Instagram professional (Business or Creator) account by signing in through Instagram's own login screen, usually while applying. You give Insider permission to read your basic account information and your account insights (Instagram's "instagram_business_basic" and "instagram_business_manage_insights" permissions). We never see your Instagram password. Instagram gives us an access token, which we keep on our servers and never on your device, and which we renew automatically while you stay connected.

What we collect from Instagram (Meta Platforms, Inc.):

• Account details: your Instagram user ID, username, account type, and follower count.
• Audience demographics: breakdowns of your followers by age range, gender, city, and country, as totals reported by Instagram. Instagram only provides these for accounts with at least 100 followers. They describe your audience as a whole, not individual followers.
• Account statistics: 28-day totals for your account, such as reach, views, profile views, website clicks, accounts engaged, likes, comments, saves, shares, replies, follows and unfollows, and profile link taps.
• Posts and reels: for your most recent posts (up to 50 each time we check), the caption and the hashtags and accounts it mentions, the post's link, type, thumbnail link, and posting time, plus performance statistics (such as reach, views, likes, comments, saves, and shares) for posts from the last 90 days.
• Stories: the same details and statistics for any story that is live on your account when we check. Instagram only makes a story available to us during the 24 hours it is live.

When we collect it. We collect this when you connect your account and about once a week after that while it stays connected. After you redeem an experience that requires Instagram content, we also check your live stories (and your recent posts, if a reel is due) repeatedly until the posting window for that experience closes. Each check covers all of your live stories, not only the one about the Restaurant, and we record the details listed above for each of them.

Proof of experiences. When a story or reel matches an experience you redeemed (for example, it was posted after your visit and mentions the Restaurant's Instagram account), we attach it to your claim as proof. If we are not sure a post belongs to a claim, we show it to you to confirm. You can also paste a link to your own post or story. Because stories disappear after 24 hours, we save a copy of the image or video of each story or reel attached as proof, in private storage. We also record whether a proof story was removed before its 24 hours were up, and collect its final statistics. Proof goes to Insider's review queue, where our staff can approve or reject it, and the Restaurant can dispute it. If nobody rejects or disputes it before the dispute window closes, the claim is approved automatically.

How we use it. We use Instagram data to:

• review your Creator application, including your follower count and where your followers are located (for example, the share of your followers in Florida);
• check whether you meet an experience's minimum follower count;
• detect, match, and review proof that you completed an experience;
• show you your own statistics and audience in the app;
• show Restaurants the proof posts for their experiences and how those posts performed;
• detect fraud and abuse, such as fake-follower behavior or proof removed early; and
• develop and improve how we match Creators with Restaurants and experiences.

Who sees it. You see your own Instagram data in the app. A Restaurant sees only the proof posts attached to claims on its own experiences (the post or story, our saved copy of it, and its statistics) and your follower count. Restaurants do not see your audience demographics, your account statistics, or your other posts and stories. Authorized Insider staff can see all of it. We do not sell Instagram data or use it for advertising.

Disconnecting. You can remove Insider's access at any time in Instagram's settings, under the apps and websites connected to your account. Once access is removed or expires, we stop collecting data from your account, and the app will ask you to reconnect. Experiences that require Instagram content can't be claimed while your account is disconnected. If your Creator application is not approved, we stop collecting data from your Instagram account. Data we have already collected is kept and deleted as described in Sections 8.1 and 9.

4.7 Information we do not collect

• We do not store or transmit your precise GPS location. As described in Section 4.5, precise location is used only on your device to render the map, and is never sent to us or retained.
• We do not collect government-issued ID numbers, Social Security numbers, financial account numbers, or payment card numbers. Insider does not currently process payments in the app.
• We do not collect health information.
• We do not purchase data from data brokers.

5. How we use information

We use the information described above to:

1. Operate the Service — create and authenticate accounts, review and decide on Creator and Restaurant applications, publish experiences, accept claims, validate QR redemptions, detect and review proof of experiences, surface a Creator's claim history and content statistics, and surface a Restaurant's redemption and content analytics. Section 4.6 lists how we use data from your Instagram account.
2. Communicate with you — send transactional emails tied to your account (application received, verification, approval, rejection, redemption disputes, account-deletion confirmations). We may also send service-related announcements (security, policy changes, material product changes). Marketing email is sent only with your consent and you can unsubscribe at any time.
3. Enforce our rules and prevent abuse — investigate suspected fraud, fake-follower behavior, ineligible applicants, misuse of experiences, harassment, and violations of our Terms.
4. Comply with legal obligations — respond to lawful requests, enforce contracts, and protect our rights and the rights of users and the public.
5. Improve the Service — diagnose crashes, fix bugs, and measure aggregate usage. We do not use your personal information to train third-party generative AI models.

We do not use your information for automated decision-making that produces legal or similarly significant effects about you. Creator application decisions are reviewed by a human.

6. How we share information

We do not sell personal information for money. We share information only as described below:

• With other users of the Service, by design.
  • Creators' public-facing information (name or chosen display name, Instagram handle, city, follower count, and content attached as proof of an experience, including our saved copy of it and its Instagram statistics) may be visible to the Restaurant whose experience you claim and, where shown, to other authorized users.
  • Restaurants' public-facing information (name, neighborhood, cuisine type, bio, cover image, and the contents of any experience you publish) is visible to approved Creators browsing the app.
• Service providers ("processors") acting on our behalf. We use the following categories of vendors, each bound to use your information only to provide services to us:
  • Supabase, Inc. — database, authentication, file storage, and serverless functions.
  • Resend (Plus Five Five, Inc., resend.com) — to send transactional and verification emails (e.g., email verification codes, application-status notices, redemption and dispute notices, and account-deletion confirmations).
  • Crash and error reporting providers — to receive crash dumps and diagnostic events.
  • Cloud hosting and CDN providers — to host our backend and serve images.
• Compliance, safety, and legal. We may disclose information if we believe in good faith that disclosure is necessary to: (a) comply with applicable law, lawful subpoena, court order, or other legal process; (b) enforce our Terms or other agreements; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of Insider, our users, or the public.
• Business transfers. If Insider is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or material change in use of your information.
• With your consent or at your direction, including when you choose to publicly post or share content.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws — for any user, regardless of age. The Service is in any case restricted to users 18 and older (see Section 3).

7. Legal bases (and notice for U.S. state-law purposes)

We are a U.S.-based service. The categories of personal information we collect and the purposes of processing are described above. We collect and use information based on:

• the performance of our agreement with you (operating your account, processing claims and redemptions);
• our legitimate business interests in operating, securing, and improving the Service and preventing fraud and abuse;
• legal compliance; and
• your consent where required (e.g., camera, photo library, marketing email).

8. Your privacy rights

The rights you have depend on where you live.

8.1 All users — built-in controls

• Access your information by signing into the app and viewing your profile, applications, and claims.
• Correct or update your profile and Restaurant or Creator information from inside the app.
• Delete your account at any time from Me → Delete Account in the app (Creators and Restaurants both have a delete-account flow). We will:
  • For Creators: hard-delete your Creator profile, your Instagram connection and access token, all data we collected from your Instagram account, and saved copies of your proof stories and reels. Past claim records may be retained by the Restaurant in anonymized form (your handle and proof URLs are wiped, and your account is unlinked from the record).
  • For Restaurants: soft-delete your Restaurant profile, anonymize identifying business PII, and expire and hide active experiences. Past claims remain visible to the Creators who earned them, but the restaurant name is shown as "Closed restaurant."
  • Retain a salted hash of your email in an internal audit log so we can detect re-signups using the same email. The email itself is not retained.
• Disconnect Instagram by removing Insider's access in Instagram's settings (see Section 4.6). This stops further collection. To have the Instagram data we already collected deleted without deleting your account, email privacy@jointheinsider.com.
• Withdraw consent for camera and photo-library access at any time in your device's OS settings. (Some features will stop working without that access.)
• Opt out of marketing email by using the unsubscribe link in the email or contacting us.

8.2 California residents (CCPA / CPRA)

If you are a California resident, you have the following rights, subject to verification and exceptions in the California Consumer Privacy Act, as amended by the CPRA:

• Right to know the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties to whom we disclose it.
• Right to delete personal information we have collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of "sale" or "sharing" of personal information. We do not sell personal information for money, and we do not "share" personal information for cross-context behavioral advertising. Because we do not engage in these practices, no opt-out signal is required, but we honor Global Privacy Control (GPC) browser signals on any web pages we operate.
• Right to limit use of sensitive personal information. We do not use sensitive personal information beyond the purposes permitted by Cal. Civ. Code § 1798.121.
• Right to non-discrimination for exercising these rights.

To submit a request, email privacy@jointheinsider.com from the email address on your account. We will verify your identity by confirming control of the account email and may ask for additional information if needed. You may use an authorized agent; we will require written, signed permission and may require verification directly from you. We respond within 45 days, with a 45-day extension where permitted.

Sources. We collect personal information directly from you, automatically from your device and our servers, and from Instagram (Meta Platforms, Inc.) when you connect your Instagram account.

Categories of personal information collected in the past 12 months (CCPA categories):

The Service is restricted to users 18 and older, and we do not sell or "share" personal information as those terms are defined under the CCPA. Accordingly, the CCPA's minor-specific opt-in requirements (Cal. Civ. Code § 1798.120(c)) do not apply to us.

8.3 Other U.S. state privacy laws

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, or any other U.S. state with a comprehensive privacy law in effect, you have analogous rights of access, deletion, correction, and (where applicable) appeal of a denial of a privacy request. To exercise these rights, contact privacy@jointheinsider.com. To appeal a denial, reply to our decision email within 60 days; we will respond in writing.

8.4 Illinois residents — biometric notice

We do not collect, store, or use any "biometric identifier" or "biometric information" as those terms are defined by the Illinois Biometric Information Privacy Act (740 ILCS 14/). We do not run facial-recognition, voiceprint, retinal/iris-scan, fingerprint-scan, or hand-scan processing on any photo or video you upload or stream through the app.

8.5 EU/UK visitors

The Service is intended for users located in the United States. If you access the Service from outside the U.S., you understand that your information will be transferred to, processed, and stored in the United States, which may have different data-protection rules than your jurisdiction. By using the Service you consent to this transfer. If you are an EU or UK resident and would like to exercise rights under the GDPR or UK GDPR, contact privacy@jointheinsider.com.

9. Data retention

We keep personal information only as long as needed for the purposes described above and to satisfy our legal, accounting, and dispute-resolution obligations. In particular:

• Account information is retained while your account is active.
• After account deletion, claim history is retained in anonymized form as described in Section 8.1.
• A salted hash of your email is retained indefinitely in an internal audit log of account deletions to detect re-signups.
• Instagram data (account details, follower demographics, statistics, and post and story details) is retained while your Instagram account is connected to your application or Creator account, and is deleted when you delete your account. If you disconnect Instagram, we stop collecting, and what we already collected is kept until you delete your account or ask us to delete it.
• Saved copies of proof stories and reels are deleted 30 days after the content was posted. If the claim is still under review or in dispute at that point, we keep the copy until that is resolved, then delete it.
• Application records for unsuccessful applicants, including the Instagram data collected while the application was open, are retained for up to 24 months to support repeat-application review and fraud prevention; you may request deletion sooner.
• Backups are rotated on a schedule of up to 35 days.
• Logs and diagnostic data are retained for up to 12 months.

10. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your information, including encryption in transit (HTTPS/TLS), encryption at rest for our managed database and object storage, row-level-security policies on our database, scoped service credentials, and access logging. No security measure is perfect. We cannot guarantee the security of information transmitted to or stored on the Service. You are responsible for keeping your account credentials confidential and for using a strong, unique password.

If we become aware of a breach of security affecting your personal information, we will notify you and the appropriate regulators as required by applicable law.

11. Communications and marketing — TCPA-style notice

We send transactional messages tied to your account (verification codes, application status, redemption events, dispute notices, security notices, account-deletion confirmations) using the email address on your account. These messages are part of the Service and you cannot opt out of them while you maintain an account.

We do not currently send promotional SMS text messages. If in the future we provide SMS messaging, we will obtain your express prior written consent, disclose message frequency, disclose that consent is not a condition of purchase, and provide a STOP / HELP opt-out mechanism that we honor immediately.

If we send you promotional email, we will identify it as an ad, include a working unsubscribe mechanism, and honor opt-outs promptly, consistent with the CAN-SPAM Act.

12. User-generated content and FTC endorsement disclosures

The Service is built around content created by Creators about Restaurants in exchange for things of value (e.g., a free or discounted meal). The Federal Trade Commission's Endorsement Guides require Creators to clearly and conspicuously disclose any material connection to a Restaurant when posting endorsements. Creators are solely responsible for making appropriate FTC-required disclosures on their own social channels and for the accuracy of their statements. Insider provides community principles requiring honest posts, but does not preview, approve, or guarantee the content of third-party posts.

If you believe content you encounter on or through the Service infringes your rights or violates the law, contact privacy@jointheinsider.com.

13. Third-party links and platforms

The Service references and may link to third-party platforms such as Instagram, TikTok, and YouTube. We do not control those platforms and are not responsible for their content, terms, or privacy practices. Following such a link or interacting with such a platform is governed by that third party's policies.

14. Do Not Track

The Insider mobile app does not respond to browser-based "Do Not Track" signals because no consistent industry standard exists. We honor opt-out signals where required by applicable law (including the Global Privacy Control on any web pages we operate).

15. International users

The Service is operated from the United States and intended for users in the United States. If you access the Service from outside the U.S., your information will be transferred to, processed, and stored in the U.S. as described in Section 8.5.

16. Changes to this Policy

We may update this Policy from time to time. If we make a material change, we will notify you by email, in-app notice, or other reasonable means before the change takes effect. The "Last updated" date at the top of this Policy reflects the most recent revision. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

17. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or your information, contact us at:

Insider Members, Inc. — Privacy privacy@jointheinsider.com