ChamTracker Privacy Policy

Last updated: 14 August 2026

ChamTracker is a sales-analytics tool for teams who manage Instagram direct messages on behalf of a business. This policy explains what we collect, why, and how it is deleted. It covers two groups of people: the businesses who connect their Instagram account, and the people who message those businesses.

Who we are

ChamTracker is operated by JIRTEC LTD, a company registered in England and Wales (company number 14592030), registered office: 4 Stanhope Road, St. Albans, England, AL1 5BL. For any privacy question or request, contact aidanryancham@gmail.com. We aim to respond within 30 days.

What we collect

When a business connects its Instagram professional account, Instagram asks that business to grant ChamTracker permission to read its direct messages. Only after that permission is given do we receive:

• The content and timestamps of direct messages sent to and from the connected business account, including message text and indicators for attachments such as photos or voice notes.
• The Instagram user ID and username of each person in those conversations, and read receipts and reactions on those messages.
• Basic details of the connected account (its Instagram ID, username and account type) and an access token, which is stored encrypted.
• Account details of the ChamTracker user (email address, time zone) and basic usage statistics, shown on their own dashboard and used for operating the service (aggregate usage and spend controls).

We only receive messages sent after an account is connected. We do not collect anything from accounts that have not been connected, and we do not collect payment details.

Why we use it

Message data is used to produce sales statistics and a follow-up worklist for the business whose inbox it is. That includes counting outbound messages, replies, follow-ups and bookings, and categorising conversations so the business can see which leads need attention, including the type of problem a lead has described. We also count how often those categories come up across a business's own conversations, and turn those counts into suggested topics for that business to talk about publicly. Those suggestions are produced from counts alone; they never contain anyone's messages.

Where a business enables team access, a team member's statistics and conversations are also visible to a manager within the same business - but only after both that team member and the manager have accepted the link. Manager access is read-only, every manager view is logged, either side can end it at any time, and message text sent before 6 August 2026 is never shown to managers. The lawful basis for this visibility - which includes a team member's activity metrics and how they compare within their team - is the business's legitimate interest in overseeing its own sales activity. A team member can object at any time: revoking the link in Settings ends the manager's access immediately, and they can also contact us at the address above.

We do not sell or license data, we do not use it for advertising, and we do not build profiles of the people being messaged for any purpose beyond serving the business whose conversations they are. We do not combine one business's message or lead data with another's. The one exception is an optional leaderboard a setter can choose to join: if they opt in, other participating ChamTracker users can see the display name that setter chooses and their own activity counts (such as the number of messages and follow-ups they sent) - never any message content, lead details, or another business's private data. A setter can leave the leaderboard at any time. Similarly, posts on the in-app feedback board - the display name the author chooses and the text they write - are visible to other ChamTracker users across businesses, and any user can report a post for moderation.

Automated analysis

To categorise conversations, message text is sent to Anthropic's Claude API, which acts as a service provider processing the data on our instruction only. Before text is sent, we mask email addresses, phone numbers and long digit strings. This analysis produces summary categories; it does not make decisions about individuals. These categories, and the metrics and suggestions built from them, are generated automatically and can be wrong or incomplete - they are estimates to help a business prioritise, not statements of fact, and are meant to be checked against the actual conversation.

Who processes data on our behalf

• Supabase - database hosting (servers in Frankfurt, Germany).
• Vercel - application hosting.
• Anthropic - conversation categorisation, as above.
• Resend - transactional email (for example, alerts that a connection needs attention).
• Meta Platforms - the source of the message data, under the permission granted by the connected business.

Where your data is processed

Our database is hosted in the EU (Frankfurt, Germany). Some providers we use - Vercel (application hosting), Anthropic (categorisation) and Resend (email) - process data in the United States. Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards for that transfer, such as the UK International Data Transfer Addendum or an equivalent mechanism.

How long we keep it

Raw message text is deleted after 90 days. The resulting statistics (counts and dates, with no message content) are kept while the account is active so historical trends remain available. Raw webhook records are deleted after 90 days. If an account is closed, its data is deleted. If a connection is removed, the user chooses whether to erase its data immediately or keep the statistics; either way, message text still expires after 90 days.

Your rights

If you are in the UK or EU you have the right to access, correct, export, restrict or delete your personal data, and to complain to a supervisory authority (in the UK, the Information Commissioner's Office).

If you messaged a business and want your data removed, email aidanryancham@gmail.com with the Instagram username you messaged from. We will delete your messages from our systems and suppress future collection for that username. You do not need a ChamTracker account to make this request. See the separate notice for message recipients for more on how this data is handled.

A business can disconnect its Instagram account at any time, from ChamTracker or from Instagram's own settings under Apps and Websites. Disconnecting stops all further collection immediately.

Security

Access tokens are encrypted before storage. Data is separated per account by database-level access rules, and all traffic is encrypted in transit. Where team access is enabled, a manager can view a linked team member's data only while both sides' acceptance stands; that access is read-only, each view is logged, and it ends immediately when either side revokes it. No system is perfectly secure, but we limit what we collect and how long we keep it. The platform operator may access data where necessary to provide support or to handle a legal or data-protection request.

Children

ChamTracker is a business tool intended for professional use and is not directed at children. You must be at least 18 years old to create an account, and we do not knowingly collect personal data from children as account holders.

Changes

If this policy changes materially we will update the date above and notify account holders by email. On 6 August 2026 this policy was updated to describe team access - manager visibility of a linked team member's data within the same business. On 7 August 2026 the operator's legal details (JIRTEC LTD) were added; nothing about data handling changed. On 11-12 August 2026 it was updated to describe categorising the type of problem a lead has described, and turning category counts into suggested content topics. On 14 August 2026 it was updated to describe the optional cross-business leaderboard, US data processing, the minimum-age requirement, and to note that automated categories are estimates.