Skip to content
NewMCP server for AI agents — plan and launch campaigns from Claude
coboost

Legal · Updated November 3, 2026

Privacy Policy

This policy explains what personal data Coboost processes when you use our website, app, API and MCP server, why we process it, and the choices you have.

1. Scope

Coboost is the controller of personal data described here. Where we process data inside a workspace on behalf of a customer (for example, campaign briefs or team members' activity), we act as a processor under our data processing terms, and the customer's own privacy notice applies.

Coboost is an independent service. It is not affiliated with, endorsed or sponsored by Meta Platforms, Inc.; Instagram is a trademark of Meta Platforms, Inc. Data Coboost receives from Instagram is processed only as this policy describes.

2. Information we collect

You provide

  • Account details: name, email, password (stored as a salted hash), profile photo, timezone and two-factor settings.
  • Workspace details: business name, website, industry, country, team members and roles.
  • Marketplace content: ad policies, rate cards, campaigns, creatives, personas, messages and approval decisions.
  • Billing details: plan, invoices and billing contact. Card details are collected and stored by Stripe, not by Coboost.

From connected platforms

  • Instagram (via Meta's APIs, with your authorization): account ID and username; profile (name, photo, bio and account type); follower, following and post counts; your recent posts with their captions, thumbnails, links, likes and comments, and per-post insights such as reach, views, saves and shares; daily snapshots of followers and engagement (follower history); insights on sponsored posts published through Coboost; and publishing permissions. Access tokens are encrypted at rest.
  • Coboost does not currently receive audience demographics (countries, ages, gender) from Instagram. If such audience data is provided to Coboost, it is handled like the account data above.

We derive

  • For connected accounts: content categories and a short description (see AI processing), content stats (posting rate, format mix, average likes and comments, top hashtags) and suggested prices.

Automatically

  • Usage and device data: IP address, browser, pages viewed, API and MCP requests, and security events such as sign-ins.
  • Attribution data: referral code and UTM parameters from the link that brought you to Coboost.

3. How we use information

  • Provide the marketplace: matching campaigns to eligible accounts, approvals, publishing, reporting, escrow and payouts.
  • Show creators their own account stats, and list consenting creators' accounts to advertisers (see How we share information).
  • Categorize and describe creator accounts, suggest prices, and write per-creator ads that fit a creator's voice.
  • Run AI features you request, and meter AI credits and API usage.
  • Bill subscriptions and credit packs, apply promo codes, and pay referral rewards.
  • Secure the service: authentication, fraud prevention, rate limiting and audit logs.
  • Communicate with you about your account, and — if you subscribe — product updates. You can unsubscribe at any time.
  • Improve Coboost using aggregated and de-identified usage statistics.

Where the GDPR or similar laws apply, we rely on: performance of our contract with you; our legitimate interests in operating, securing and improving the service; your consent (for example, the newsletter and optional cookies), which you can withdraw at any time; and compliance with legal obligations such as tax and anti-fraud requirements.

5. How we share information

  • Advertisers on Coboost. Only for creator accounts listed in the marketplace, and only after the creator expressly agrees, when connecting or listing the account, to marketplace terms that name what is shared. Advertisers then see the account's profile and bio, follower count and growth, engagement rate, average reach, content stats and top hashtags, categories and description, rate card and policy summary, and its recent posts with their thumbnails, captions, likes and comments. Unlisting or disconnecting the account stops this sharing. Analytics-only accounts are never shown to advertisers.
  • Advertisers' API and MCP clients. Apps and AI agents that advertisers connect to Coboost's API or MCP server receive only aggregate stats of listed accounts (followers, engagement, average reach, posting rate and format mix, categories, description, rates and formats), never posts, captions or follower history. Our Terms forbid them from keeping it longer than evaluating and booking creators needs, or from selling or sharing it.
  • Creators see campaign briefs and advertiser profiles.
  • Service providers. Hosting, email delivery, payments (Stripe), AI model providers and model routing services (such as OpenRouter, Anthropic, OpenAI and Google) and error monitoring, under contracts that restrict their use of data.
  • Your integrations. Webhook endpoints, API clients and MCP agents you configure for your own workspace receive the data you direct to them.
  • Legal and safety. When required by law or to protect rights, safety and the integrity of the marketplace.
  • Business transfers. As part of a merger, acquisition or asset sale, subject to this policy.

We do not sell personal data or share it for cross-context behavioral advertising. We do not sell, license or rent data received from Instagram.

6. AI processing

  • AI features you use. The prompt, persona and relevant campaign context are sent to the selected AI provider to generate a response. If you connect your own provider key, requests you make for your own content run under your account with that provider and its terms apply.
  • Creator account analysis. When a creator connects an account, and periodically after that, its username, name, bio and recent captions are sent to an AI model provider under Coboost's own account to pick content categories and write a short description for the marketplace. We don't infer sensitive traits such as health, religion or political views. Creators can edit or replace the results.
  • Per-creator ads. When an advertiser's campaign writes a unique post for a creator, the creator's recent captions, description and categories are sent to an AI model provider under Coboost's own account, never through the advertiser's own provider key.

We do not allow providers to train models on this data under our agreements, and they may process it only to provide their service to Coboost.

7. Cookies

  • Essential: session cookie for sign-in, CSRF and security protections.
  • Attribution: a referral cookie (60 days) and a UTM cookie (30 days) to credit the person or campaign that referred you.
  • Preferences: theme and sidebar state, and your cookie choice (coboost_consent, 12 months).
  • Analytics: only if you choose “Accept all” in the cookie banner.

We do not use third-party advertising cookies on the Coboost website. To change your choice, clear the coboost_consent cookie (and site data) in your browser and pick again from the banner.

8. International transfers

We are based in the United States and process data there and wherever our providers operate. For transfers from the EEA, UK or Switzerland we rely on Standard Contractual Clauses or other approved mechanisms.

9. Retention

  • Account and workspace data: for as long as your account is active. When you delete your workspace or account, we delete or de-identify personal data within 30 days, except where we must keep it longer.
  • Instagram data of a connected account (profile, recent posts, insights, follower history and the analysis derived from them): while the account stays connected. Recent posts are replaced each time the account is analyzed.
  • After a disconnect or a removal in Meta: the access token is deleted at once and the account leaves the marketplace. The rest of its Instagram data is kept for 30 days so the creator can reconnect without losing their stats, then deleted automatically. A deletion request through Meta deletes it right away.
  • Placement records (the account's username with the deals it took part in, their prices, payouts and the results of sponsored posts): kept as financial and contractual records, as required by tax and accounting law (typically seven years), as are billing and payout records.
  • Logs: audit logs according to your plan; API, email and other operational logs for limited periods before automatic deletion.

10. Security

We use encryption in transit and at rest for sensitive data (including OAuth tokens and API provider keys), hashed passwords, optional two-factor authentication, role-based access, signed webhooks and audit logging. No system is perfectly secure; tell us about vulnerabilities at support@coboost.ai.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or port your personal data, to object to or restrict processing, and to withdraw consent. California residents have the right to know, delete and correct personal information and to not be discriminated against for exercising these rights. Email support@coboost.ai to make a request; we'll verify your identity and respond within the time required by law. You may also complain to your local data protection authority.

Anyone who connected an Instagram account can have its data deleted, wherever they live: disconnect the account in Coboost, remove Coboost from Meta's connected apps and request deletion, or email us. The Instagram data deletion page explains each route and shows the status of requests made through Meta.

12. Children

Coboost is not directed to children and we do not knowingly collect data from anyone under 18.

13. Changes

We will post updates here and, for material changes, notify account owners by email or in the app before they take effect. See also our Terms of Service.

14. Contact

Coboost — support@coboost.ai

Instagram and Reels are trademarks of Meta Platforms, Inc. Coboost is not affiliated with or endorsed by Meta.