Privacy Policy

This Privacy Policy describes how FrostChanger (“we”, “us”, “our”, or “Elevion”) collects, uses, discloses, and protects personal information when you use our website at elevion.cc and our application at elevion.cc/app (collectively, the “Service”).

Controller within the meaning of Art. 4 (7) GDPR: Pelle Krukow, trading as FrostChanger, Ballindamm 3, 20095 Hamburg, Germany. We have not appointed a data protection officer because we are not legally required to. Contact: [email protected].

1. Information we collect

1.1 Information you provide directly

• Account info: name, email address, password (stored as a salted Argon2id hash, never in plaintext).
• Billing info: name, billing address, VAT/tax ID (optional), and payment method details. Card numbers and bank details are collected and stored by our payment processor Stripe. We never see or store full card numbers.
• Content you create: campaign names, keywords, message templates, automation schedules, and any data you input while configuring the Service.
• Communications: emails you send us for support, feedback, or legal inquiries.

1.2 Information we receive from Meta Platforms (Instagram)

When you connect your Instagram account, you authorize us (via OAuth) to access data from Meta’s Instagram Graph API. We request the minimum permissions necessary for the Service to function. Specifically:

• instagram_business_basic: we receive your Instagram user ID, username, profile picture URL, follower count, media count, and account type (Business or Creator). Used to identify your account and display your profile within the Service.
• instagram_business_manage_comments: we read comments on your posts (including the commenter’s username and comment text) to detect keywords you’ve configured, and we reply to those comments on your behalf when a match is found. Required to deliver the keyword-DM automation feature.
• instagram_business_manage_messages: we send private Direct Messages from your Instagram account to users who commented on your posts (in response to keyword matches you configured), and we receive DMs users send back to you so you can track responses. Required to deliver automated outreach.
• instagram_business_manage_insights: we read aggregate analytics for your account and posts (reach, views, interactions, engagement, follower count over time). Used to power the analytics dashboard in the Service.
• instagram_business_content_publish: we publish the photos, videos, carousels, and stories that you create and schedule in the Service to your Instagram account at the time you choose. We never publish content that you did not create or schedule yourself.

We also store an access token issued by Meta so we can perform these operations on your behalf. The token is stored encrypted at rest and is revoked whenever you disconnect your Instagram account or request data deletion.

1.3 Information collected automatically

• Device & session: IP address and user agent of each login session, so you can see and end your sessions in your settings.
• Usage: pages visited, features used, clicks, error logs, timestamps.
• Cookies: see our Cookie Policy for the full list.

2. How we use your information

• To operate the Service (authenticate you, process payments, deliver automation features, generate analytics).
• To detect keyword matches in Instagram comments and send Direct Messages + comment replies on your behalf, per your campaign configuration.
• To respond to your support requests and communicate about your account (billing, security alerts, service changes).
• To improve the Service (debugging, performance monitoring, product analytics).
• To prevent fraud, abuse, and violations of our Terms of Service or Meta’s platform policies.
• To comply with legal obligations (tax records, responding to subpoenas, enforcing rights).

We do not sell your personal information, nor do we use your Instagram data or content to train any machine-learning model that is not strictly necessary to operate the Service for you.

3. How we share your information

We share personal information only with the following categories of recipients:

• Meta Platforms, Inc.: we send API requests to Meta’s Instagram Graph API to fetch the data described above and to send DMs/comment replies on your behalf. Meta processes this data under their own privacy policy.
• Payment processor: Stripe Payments Europe, Ltd. (Ireland) collects and stores your payment details to process subscription billing.
• AI providers: if you enable the AI DM assistant, the messages of the conversation and your campaign instructions are sent to Anthropic, PBC (US) to generate replies. If you enable voice notes, the text of the note is sent to ElevenLabs, Inc. (US) to generate the audio. We use both providers under their commercial API terms.
• Email delivery: Resend, Inc. (US) sends transactional email on our behalf (verification links, password resets, trial reminders, invoices).
• Infrastructure & hosting: our servers are hosted by Hetzner Online GmbH in Germany. Cloudflare, Inc. (US) provides DNS, content delivery, and protection against attacks for our domains.
• Error tracking (optional): we may use Sentry (Functional Software, Inc.) to capture anonymized error telemetry for debugging. Personally identifying data in error reports is scrubbed where possible.
• Legal & safety: if required by law, subpoena, or to protect the rights, property, or safety of FrostChanger, our users, or others.
• Business transfers: if we merge with, are acquired by, or sell assets to another company, we may transfer your information as part of that transaction, subject to this Policy.

4. How long we retain your data

• Account data: for as long as your account is active, plus up to 30 days after deletion request (during which your account is reversibly deactivated).
• Instagram API tokens: deleted immediately on disconnect or account deletion.
• Campaign activity logs: retained up to 12 months, then deleted automatically.
• Billing records: retained for the periods required by German commercial and tax law (generally 8 to 10 years).
• Deleted accounts: we permanently delete personal data within 90 days of deletion, except where legally required to retain it.

5. Security

We protect your information with industry-standard safeguards: HTTPS (TLS 1.2+) for all traffic, Argon2id hashing for passwords, encrypted database at rest, strict access controls, HMAC-signed webhooks, rate limiting on sensitive endpoints, and security-hardened HTTP headers. No system is 100% secure; please use a strong unique password and report suspicious activity to [email protected].

6. Your privacy rights

6.1 Your rights under the GDPR

Under the GDPR you have the following rights regarding your personal data:

• Right of access to your personal data (Art. 15 GDPR).
• Right to rectification of inaccurate data (Art. 16 GDPR).
• Right to erasure (“right to be forgotten”, Art. 17 GDPR).
• Right to restrict processing (Art. 18 GDPR).
• Right to data portability: receive your data in a machine-readable format (Art. 20 GDPR).
• Right to object to processing based on legitimate interests (Art. 21 GDPR).
• Right to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR).
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI).

To exercise any of these rights, email [email protected] or visit our Data Deletion page. We respond within one month, which may be extended by two further months for complex requests (Art. 12 (3) GDPR).

Legal bases: we process your data (a) to perform our contract with you and to take steps before entering into it (Art. 6 (1) (b) GDPR), (b) based on your consent, for example for marketing emails and non-essential cookies (Art. 6 (1) (a) GDPR), (c) to comply with legal obligations such as tax retention duties (Art. 6 (1) (c) GDPR), and (d) based on our legitimate interests in preventing fraud and abuse and in improving the Service (Art. 6 (1) (f) GDPR).

International transfers: our servers are located in Germany. Some of our service providers (Meta, Anthropic, ElevenLabs, Resend, Cloudflare, Sentry) are based in the United States. For these transfers we rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the Standard Contractual Clauses approved by the European Commission (Art. 46 (2) (c) GDPR).

6.2 California residents (CCPA / CPRA)

If you are a California resident, you additionally have the right to know what personal information we collect, use, and disclose, to delete and correct it, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising. You can exercise these rights through the contact details above.

7. Meta Platform-specific disclosures

In accordance with Meta’s Developer Platform Terms and Instagram API policies, we make the following disclosures regarding data received from Meta Platforms, Inc.:

• We use Meta Platform Data solely to provide the keyword-DM automation, analytics, and Instagram account management features of the Service to you.
• We do not sell, license, lease, or otherwise transfer Meta Platform Data to any data broker, advertiser, or third party for their own use.
• We do not use Meta Platform Data to build user profiles, enable discriminatory practices, or for any purpose prohibited by Meta’s Platform Terms.
• We delete all Meta Platform Data upon request, upon your disconnection of the Instagram account from the Service, or upon the expiration or revocation of the applicable access token.
• You may revoke Elevion’s access at any time via Instagram Settings → Apps and Websites → Active → remove Elevion, or by disconnecting the account within the Service.

8. Children’s privacy

The Service is not directed to children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via email to the address on your account at least 30 days before taking effect. The “Last updated” date at the top reflects the most recent revision.

10. Contact us

Pelle Krukow, trading as FrostChanger
Attn: Privacy
Ballindamm 3
20095 Hamburg
Germany
Email: [email protected]
Phone: +49 176 41938054