Platform Security & Transparency Documentation

Last Updated: March 2026

Executive Summary

This document explains what data access we have when creators connect their social media accounts, what we cannot access, and how we maintain trust for both brands and creators.

1. What Happens When Creator Connects Instagram

1.1 The Connection Process

Creator logs into platform
        ↓
Clicks "Connect Instagram"
        ↓
Redirected to Meta's official login page
        ↓
Creator sees permission request screen:
  • "Access your Instagram insights"
  • "Access your profile information"
        ↓
Creator approves → We receive access token
        ↓
Token stored securely in our database

1.2 What Permissions Are Requested

Permission	Purpose	What It Allows
`instagram_business_manage_insights`	Read metrics	View performance data for posts you submit
`instagram_business_basic`	Profile info	Read username, account type

What we DO NOT request:

❌ Read DMs or messages
❌ Post on your behalf
❌ Access your followers list
❌ See your saved content
❌ Access Stories
❌ Modify your account

2. What We CAN Access

2.1 After Creator Connects - What Works

Data Type	Accessible?	How We Get It
Insights for submitted reel URL	✅ YES	Direct API call with creator's token
Views/Plays	✅ YES	From Instagram Graph API
Likes, Comments	✅ YES	From Instagram Graph API
Saves, Shares	✅ YES	From Instagram Graph API
Reach	✅ YES	From Instagram Graph API
Average Watch Time	✅ YES	From Instagram Graph API

2.2 Technical Implementation

Our System                          Instagram API
     │                                      │
     │  1. Creator submits reel URL         │
     │     (e.g., instagram.com/p/xyz)     │
     │                                      │
     │  2. Our cron job runs               │
     │     (hourly)                        │
     │                                      │
     │  3. Call Instagram API:             │
     │     GET /{media-id}/insights        │
     │     ?metric=plays,reach,likes...    │
     │     + creator's access token        │
     │                                      │
     │  4. API returns ONLY that           │
     │     specific post's metrics         │
     │                                      │
     │  5. We store in our database        │

2.3 What We Store

When creator submits a reel for a campaign, we store:

Field	Stored?	Purpose
Post URL	✅ Yes	To identify which content
View Count	✅ Yes	Campaign performance
Like Count	✅ Yes	Engagement metrics
Comment Count	✅ Yes	Engagement metrics
Share Count	✅ Yes	Viral potential
Save Count	✅ Yes	Content value
Reach	✅ Yes	Audience size
Avg Watch Time	✅ Yes	Content quality
Timestamp	✅ Yes	When metrics fetched

3. What We CANNOT Access

3.1 Even After Connection - What Doesn't Work

Data Type	Accessible?	Why Not
Historical data (before connection)	❌ NO	API limitation - tokens only work forward
Reels NOT submitted to us	❌ NO	We don't know these URLs exist
Direct Messages	❌ NO	Not in our permissions
Private Account Content	❌ NO	Only public content accessible
Follower List	❌ NO	Not in our permissions
Following List	❌ NO	Not in our permissions
Account Settings	❌ NO	Not in our permissions
Other Apps Connected	❌ NO	Not in our permissions
Payment Information	❌ NO	Completely separate system

3.2 Important Limitations

Limitation 1: Historical Data

Reel posted: Jan 1, 2026
Creator connects: Jan 15, 2026
Result: CANNOT fetch Jan 1 reel's insights
Solution: Creator must submit screenshot OR re-post after connecting

Limitation 2: Only Submitted Content

Creator has 500 reels on their profile
Creator submits 1 reel for campaign
Result: We can only access insights for that 1 submitted reel
We cannot see the other 499 reels

Limitation 3: Real-Time Data

Insights data may be delayed by 15 minutes to 48 hours
according to Instagram's API documentation

4. What Is Technically In Our Hands vs NOT

4.1 ✅ IN OUR HANDS (We Control)

Area	What We Do
Data Collection	We only fetch metrics for URLs explicitly submitted
Data Storage	Encrypted database, access logged
Who Sees What	Role-based access (Brand sees own campaign, Admin sees all)
Data Retention	As long as campaign is active + 2 years for analytics
API Rate Limits	We track and handle 200 requests/hour limit
Token Management	Auto-refresh tokens before expiry

4.2 ❌ NOT IN OUR HANDS (Meta/Platform Controls)

Area	What They Control
Token Validity	Meta can invalidate tokens anytime
API Availability	Instagram API can go down
Data Accuracy	Meta's numbers are final
Feature Changes	Meta can change API without notice
Account Suspension	Meta can suspend creator's IG
Privacy Settings	Creator controls account privacy

4.3 🔒 Security Measures We Have

Measure	Description
Token Encryption	Access tokens stored encrypted in DB
No Bulk Export	Cannot download all creator data
URL-Bound Only	Can only fetch data for specific URLs
Audit Logs	All API calls logged
Rate Limiting	We respect 200/hour limit per token
No Third-Party Sharing	Data never sold or shared

5. Brand Transparency

5.1 What Brands Can See

Data	Visible To
Campaign-specific metrics	Brand who owns campaign
All creators' performance	Admin
Individual creator details	Brand (for their campaign only)

5.2 What Brands CANNOT See

Data	Why Not
Creator's other brand campaigns	Privacy - creator may work with competitors
Creator's follower count	Not fetched from API
Creator's other content	Only campaign-submitted content
Creator's personal information	Not stored/shared

5.3 Brand Guarantee

We guarantee that:
✓ Metrics shown are directly from Instagram's official API
✓ We do not manipulate or inflate numbers
✓ Fraud detection is automated but not definitive
✓ Final disputes are handled manually by admin

6. Creator Transparency

6.1 What Creators Can See

Data	Visible To
Their own campaign performance	Creator
Payment status	Creator
Brand feedback	Creator

6.2 Creator Data Rights

Right	Description
Access	Creator can export their own data
Deletion	Creator can request account deletion
Portability	Data provided in standard format
Correction	Can dispute inaccurate metrics

6.3 Creator Guarantee

We guarantee that:
✓ Your data is only used for your campaigns
✓ We cannot post content without your permission
✓ We cannot access your DMs or private messages
✓ Your brand partnerships are confidential
✓ You can disconnect Instagram anytime

7. Fraud Detection & Limitations

7.1 What We Detect

Fraud Type	How We Detect
View Spike	Sudden abnormal increase in views
Bot Traffic	Suspicious view patterns
Engagement Mismatch	Low saves/shares despite high views

7.2 What We Cannot Detect

Fraud Type	Limitation
Bought Views	Hard to distinguish from viral
Pod Comments	Looks legitimate
Screen Recording Views	Can't detect
VPNs	Hard to identify

7.3 Disclaimer

Fraud detection is an automated system that flags suspicious activity.
Final decisions are made by human administrators.
We are not responsible for false positives or negatives.

8. Compliance & Legal

8.1 Data Protection

Regulation	Compliance
GDPR (EU)	✅ Compliant
DPDP Act (India)	✅ Compliant
CCPA (California)	✅ Compliant

8.2 Data Storage

Aspect	Detail
Location	India (primary), EU (backup)
Encryption	AES-256 at rest
Retention	Campaign duration + 2 years
Deletion	On creator request

9. Technical Flow Diagram

┌─────────────────────────────────────────────────────────────────────┐
│                    PLATFORM SECURITY FLOW                           │
└─────────────────────────────────────────────────────────────────────┘

CREATOR SIDE
─────────────
┌─────────┐     ┌──────────────┐     ┌─────────────┐     ┌─────────┐
│ Creator │────▶│ Meta Login   │────▶│ Get Token   │────▶│ Store   │
│         │     │ (Instagram)  │     │ (encrypted) │     │ in DB   │
└─────────┘     └──────────────┘     └─────────────┘     └─────────┘
                                                                  │
                                                                  ▼
BRAND SIDE                                                          │
─────────                                                    ┌─────────┐
┌─────────┐     ┌──────────────┐     ┌─────────────┐         │ Token   │
│ Brand   │────▶│ Submit       │────▶│ Content     │         │ used    │
│         │     │ Campaign     │     │ URL stored  │         │ only    │
└─────────┘     └──────────────┘     └─────────────┘         │ for    │
                                                                  │ that   │
                                                                  │ URL    │
                                                                  └─────────┘
                                                                        │
                          ┌─────────────────────────────────────────────┘
                          │
                          ▼
                 ┌─────────────────┐
                 │   CRON JOB      │
                 │   (hourly)      │
                 └────────┬────────┘
                          │
          ┌───────────────┼───────────────┐
          ▼               ▼               ▼
    ┌──────────┐    ┌──────────┐    ┌──────────┐
    │ Fetch    │    │ Store in │    │ Fraud    │
    │ Insights │    │ DB       │    │ Check    │
    └────┬─────┘    └────┬─────┘    └────┬─────┘
         │               │               │
         ▼               ▼               ▼
    ┌──────────┐    ┌──────────┐    ┌──────────┐
    │ Instagram │    │ ViewSnap-│    │ Flag if  │
    │ API       │    │ shot     │    │ suspicious
    └──────────┘    └──────────┘    └──────────┘

┌─────────────────────────────────────────────────────────────────────┐
│                    DATA ACCESS SUMMARY                               │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  Instagram Account                                                  │
│  ├── Followers ────────────────── ❌ CANNOT ACCESS                 │
│  ├── Following ────────────────── ❌ CANNOT ACCESS                │
│  ├── DMs ─────────────────────── ❌ CANNOT ACCESS                 │
│  ├── Private Content ──────────── ❌ CANNOT ACCESS                 │
│  │                                                                   │
│  └── Specific Post (by URL) ────── ✅ CAN ACCESS                   │
│      ├── Views ──────────────── ✅                                  │
│      ├── Likes ──────────────── ✅                                  │
│      ├── Comments ───────────── ✅                                  │
│      ├── Saves ───────────────── ✅                                  │
│      ├── Shares ──────────────── ✅                                  │
│      ├── Reach ───────────────── ✅                                  │
│      └── Watch Time ──────────── ✅                                  │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

10. Frequently Asked Questions

Q: Can you see my followers?

No. We do not request this permission and cannot see your follower count.

Q: Can you post on my behalf?

No. We only have "read" permissions, not "write" permissions.

Q: What if I disconnect my Instagram?

Answer: You can disconnect anytime. We will no longer fetch new metrics, but historical data remains.

Q: Can brands see my other brand partnerships?

No. Each brand only sees data for their own campaigns.

Q: Is my data shared with other creators or brands?

No. Your data is completely isolated.

Q: What happens if Instagram API is down?

Answer: We show last cached data until API recovers.

Q: Can you access my DMs?

No. This is technically impossible with our permission scope.

11. Contact

For security concerns or data questions:

Email: security@krrio.com
Data Officer: dpo@krrio.com

This document is part of our commitment to transparency and trust.

Untitled