Privacy Policy

Visitors to our sites. If you submit a contact form on undercutters.co or on a website we host, we collect what you type — typically your name, email address, phone number, and message. We deliver it to the business you contacted and store it so that business can see its inquiries; it stays stored until the business or you ask us to delete it. We use basic analytics (page views, referrers) on production customer sites via Google Analytics; demo sites and undercutters.co itself have no analytics tracking.

Cookies.Signing in to the customer dashboard sets an essential session cookie. Google Analytics sets its usual cookies on production customer sites. We don’t use advertising or cross-site tracking cookies.

Our customers. When a business signs up, we collect account details (name, email, business information) and billing details. Payments are processed by Stripe — card numbers never touch our servers.

Connected Instagram accounts. Described in full below.

Some customer websites display a live Instagram feed. This works only when the Instagram account’s owner explicitly authorizes our “Undercutters Feeds” app through Instagram’s own login and consent screen.

With that authorization, we access and store:

• the account’s Instagram user ID and username,
• recent public posts — images, captions, timestamps, and links back to the original posts — which we refresh periodically and cache (including copies of the images on our content delivery network) so the business’s website loads fast, and
• the access token Instagram issues us, stored in infrastructure encrypted at rest and never shared.

We use this data for exactly one purpose: showing the account’s own public posts on that business’s own website. We do not post, message, follow, read direct messages or follower lists, sell this data, or share it with anyone other than the business the account belongs to.

Data is processed in the United States by the service providers that run our platform — hosting, database, storage, email delivery, and login providers — encrypted in transit and at rest, with access limited to what operating the service requires. Payments are handled by Stripe, and analytics on production customer sites by Google Analytics.

Our services are for businesses and their customers, not children — we don’t knowingly collect data from anyone under 13, and we’ll delete it if we learn we have.

We share data only with the categories of service providers described above (to run the platform), with the business you contacted (your form submission), and when the law requires it. We do not sell personal data to anyone.

Instagram accounts:you can disconnect at any time from Instagram’s side under Settings → Security → Apps and websitesby removing “Undercutters Feeds” — we lose access immediately. To also have our stored copies removed (cached posts, mirrored images, and tokens), email admin@undercutters.co from the account owner and we’ll delete them within 30 days and confirm.

Everything else(contact submissions, customer accounts): email the same address and we’ll delete your data within 30 days, except records we’re legally required to keep (like invoices).

If this policy changes materially, we’ll update the effective date above. Questions about any of it: admin@undercutters.co.