Skip to content
Spinveri
Start free

Privacy Policy

Effective October 2, 2026

Last updated October 2, 2026

Spinveri (“Spinveri,” “we,” “us”) is operated by Lumen Limitless LLC, a Wyoming limited liability company. This policy describes what data we collect when you use our website at spinveri.com and the associated Spinveri service (collectively, the “Service”), how we use it, with whom we share it, how long we keep it, and the choices you have. If you have questions, email privacy@spinveri.com.

The short version

  • We collect: your email, Instagram account info, giveaway comments (snapshots), and payment details via Stripe.
  • We don't sell it: your data is shared only with service providers who run the platform.
  • You control it: you can disconnect Instagram, delete your account, or request your data anytime.
  • Giveaway entrants: a public verification page shows the winner and lets anyone check whether a username entered, for 90 days. Then entries are deleted.
  • No cookies needed: we use only session cookies and no analytics or advertising trackers.

What we collect

Account data

When you create a Spinveri account, we collect your email address and (if you authenticate via Google) the unique identifier and display name your identity provider returns. We never see your password.

Instagram connection data

When you connect an Instagram Business or Creator Account:

  • Your Instagram Business Account ID and username
  • The app-scoped user ID Meta assigns to your account for Spinveri (used to match data deletion requests from Meta to your account)
  • A long-lived Instagram access token, encrypted at rest. The encryption key is held in Supabase Vault in the same database. The token is decrypted only when an Instagram API call is made on your behalf. Instagram Login offers no server-side revoke capability, so you fully revoke access by removing Spinveri at instagram.com → Settings → Apps and websites.

Giveaway and draw data

When you run a draw, we fetch the public comments on the Instagram post you selected. We store a snapshot of those comments, the entry filters you configured, a cryptographic seed for fair selection, and the chosen winner. The comment snapshot is retained for 90 days to support the public audit page, then permanently deleted.

Payment data

If you purchase a paid feature, our payment processor (Stripe) collects your payment details directly. We receive only a Stripe customer ID and the subscription/charge status — we do not see or store full card numbers.

Operational data

Standard server logs (timestamps, IP, user agent, request paths) and error reports for diagnostics. We do not use analytics trackers or collect usage events.

What we don't collect

  • Instagram direct messages
  • Your follower or following list
  • Stories, Reels, or posts you didn't select
  • Data from any Instagram account you haven't personally connected
  • Data from posts on your connected account that you haven't explicitly chosen in the Spinveri interface

How we use it

  • To operate the Service: fetching comments, running draws, publishing audit pages
  • To bill you and keep your subscription current
  • To respond to support requests and notify you of account events (draw completions, token expirations, deletion confirmations)
  • To diagnose bugs and keep the Service secure

We do not: use your Instagram data, comment snapshots, or draw history for advertising, analytics, or machine learning. We do not share your data with third parties except the service providers listed below.

Who we share it with

We do not sell your data. We share data only with the following service providers (“subprocessors”), each strictly to operate the Service:

  • Supabase — database, authentication, and encryption of your Instagram tokens (US-hosted)
  • Vercel — application hosting (US-hosted)
  • Stripe — payment processing
  • Resend — transactional email delivery
  • Meta (Instagram) — when you create or execute a draw, we fetch comments and post metadata via Meta's Graph API using the access token you authorized

We may also disclose data when required by law or to protect the rights and safety of Spinveri, our users, or the public.

How long we keep it

  • Account and draw metadata: for as long as your account is active
  • Comment snapshots: 90 days from the date of the draw, then permanently deleted
  • Instagram tokens: until disconnected
  • Server logs and error diagnostics: typically 30–90 days
  • Database backups: encrypted nightly copies are kept for 14 days, then deleted automatically, so anything deleted from Spinveri is gone from backups within 14 days
  • Tax and billing records: as required by applicable law (typically seven years)

If you entered a giveaway

If you commented on an Instagram post that ran a Spinveri draw, here's what happens to your data:

What we collect

When a host picks their giveaway post on Spinveri, we fetch the comments from that post using Meta's Instagram API. We collect your Instagram username and the text of your comment.

What's public

If your comment qualifies for the draw based on the entry rules (e.g., you tagged a friend or used the required hashtag), it becomes an entry. Each draw has a public verification page, marked as not indexable by search engines, that shows:

  • The host's username
  • The winner's username and comment
  • The entry rules the host set (how someone qualifies)
  • How many comments there were and how many qualified
  • Cryptographic proof of fairness

The page doesn't list entrants. Anyone who types a username into its “Did your entry count?” box learns whether that username was in the draw. The host who ran the giveaway can see the full list of qualifying usernames.

How long it's kept

Your username and comment text are deleted 90 days after the draw. The sealed cryptographic result (winner username and proof values) remains on the verification page indefinitely.

Your rights

You can request that a host remove you from a giveaway's verification page by contacting them directly (they control which posts they run draws on). You can also email privacy@spinveri.com to request removal, and we will work with the host to comply.

Under GDPR and other data-subject rights regimes, you have the right to access, correct, or request deletion of your data. Email privacy@spinveri.com with your request.

Host responsibilities

The host who ran the giveaway is the data controller for entrant data (your comment and username). Spinveri is a processor acting on the host's behalf. Before entering a giveaway, check the host's privacy policy or giveaway rules to understand how they use your data.

Your rights and choices

Disconnect Instagram

Go to Settings → Instagram account → Disconnect. This deletes the stored access token, so Spinveri can no longer read anything from your Instagram account. Your giveaways and their verification pages stay in your Spinveri account until you delete it.

Delete your account

You can delete your account and all associated data in three ways:

  1. In-app: Settings → Account → Delete account
  2. Through Instagram: instagram.com → Settings → Apps and websites → Remove Spinveri, and ask for your data to be deleted (Meta then sends us a deletion request)
  3. Email: privacy@spinveri.com requesting account deletion

See our Data Deletion page for details.

Data subject rights

Depending on your jurisdiction (e.g., the EU/UK under GDPR, California under CCPA), you may have rights to access, correct, export, or restrict processing of your data. Email privacy@spinveri.com to exercise these rights — we will respond within 30 days.

Meta data deletion callback

In accordance with Meta's Platform Terms, we operate a data deletion callback at https://www.spinveri.com/api/meta/data-deletion. Removing Spinveri at instagram.com → Settings → Apps and websites disconnects it straight away: Meta tells us, and we delete the stored access token. If you also ask for your data to be deleted, Meta sends a deletion request to this endpoint and we delete your Spinveri account and its data. You can check the status of a deletion request using the confirmation code provided.

Security

Instagram access tokens are encrypted at rest using pgcrypto with a 256-bit key held in Supabase Vault. Service-role database credentials are never exposed to the browser. Payments are handled by Stripe, which is PCI-DSS Level 1 certified. We use HTTPS for all traffic. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you in accordance with applicable law.

Children

Spinveri is not directed to children under 13, and we do not knowingly collect personal data from anyone under 13. By using this service, you represent that you are at least 18 years old. If you believe a child has provided us data, contact us immediately and we will delete it.

International users

Spinveri is operated from the United States, and data is stored on US infrastructure (Supabase and Vercel US regions). If you use the Service from outside the United States, you understand and consent to the transfer of your data to and processing in the United States under Standard Contractual Clauses (SCCs) where applicable.

Changes to this policy

We may update this policy from time to time. Material changes will be announced via email or in-app notice at least 14 days before they take effect. The effective date at the top of this page always reflects the current version.

Contact

Lumen Limitless LLC

30 N Gould St Ste RSheridan, WY 82801

Email: privacy@spinveri.com

EU GDPR Art. 27 Representative: [TO BE APPOINTED — operator to supply name, address, email]