Privacy policy

Last updated: November 12, 2026

RushPost helps content teams prepare, schedule and publish social media content and view the performance of their connected accounts. This policy explains the data processed through these features, including the Instagram integration.

Who is responsible for your data?

Igor Duca, located in Brazil, is responsible for the personal data processed by RushPost. Contact duccaigor@gmail.com for privacy questions or requests.

Information we process

  • RushPost account and workspace information, such as your name, email address, membership and role.
  • For social accounts you authorize: account identifiers, usernames, profile information, authorization scopes and access tokens needed to operate the integration.
  • Content you create, upload, select or import, including captions, images, videos, templates, drafts and publishing schedules.
  • Media identifiers, publication status and available performance metrics returned by your connected social network.
  • Technical information used to operate and troubleshoot the service, such as requests, errors and security-related logs.

Instagram permissions and their purposes

RushPost uses Instagram Login for professional accounts. We do not ask for or store your Instagram password.

  • instagram_business_basic: identify the professional account you connect, display its profile information and read its media for the publishing and performance workflow.
  • instagram_business_content_publish: publish content to the connected account when you confirm a publication, schedule it or configure an automated publishing workflow.
  • instagram_business_manage_insights: retrieve the connected account's available media and account metrics for its performance dashboard.

Connecting an account does not require granting comments or messaging access. Workspace members can use connected accounts according to their access to that workspace.

AI assistant connector

If you connect RushPost to an AI assistant such as Claude, you sign in with your RushPost account and the assistant receives an authorization issued by Clerk for your profile and email. RushPost receives only what the assistant sends in each request: the text of the request and the photo or video links included in it. RushPost does not read the assistant's conversation history, memory or files.

RushPost keeps the messages of the current draft and the draft itself until the post is published, discarded or reset, and keeps published posts as described below. The replies RushPost returns, such as previews and publication results, are sent to the assistant you connected and are handled under that provider's terms. Disconnect RushPost in the assistant's connector settings to end the access. See the connector guide.

Service providers and sharing

RushPost uses Clerk for authentication and workspace membership, Vercel for the website, Railway for backend services, and Supabase for database and media storage. These providers process information needed to deliver their services. Social networks receive the content and requests needed to perform the actions you authorize.

When you use optional AI features, the content included in your request may be sent to the configured AI service providers, including OpenRouter and the selected model provider. Avoid including sensitive information in these requests. Analytics and diagnostic services, when enabled for an environment, process usage information to help operate the product.

Providers may process data outside Brazil. The applicable locations and safeguards depend on the provider and the services used. We do not sell Instagram Platform Data.

Retention and access controls

We retain account, workspace and publishing information while it is needed to provide the features you use. Social authorization tokens remain on the server and are used for the permissions granted to the integration. RushPost uses authenticated workspace access and scoped database access to separate workspace data.

Removing a connected Instagram channel from RushPost marks the connection as revoked and replaces its stored token so it can no longer be used by that connection. This does not automatically erase drafts, published-post records or other workspace content. Backups and records required to handle legal obligations or security issues may remain for their applicable retention periods.

Your choices and deletion requests

You can disconnect a social channel in Canais (Channels) and revoke RushPost-IG access in Instagram's Apps and websites settings. To request deletion of associated RushPost data, correction, access or other privacy rights, follow the data deletion instructions or contact us. We may ask for information needed to verify your identity and authority over a shared workspace.

Disconnecting RushPost does not remove posts that have already been published on a social network. Those posts must be managed on the social network itself.

Updates

We may update this policy as RushPost's features and processing change. The date above identifies the current version. Contact us if you have questions about a change.