Last updated: 9 October 2026
This explains what information Kerchiff collects about you, why, how long it is kept, and what you can ask us to do with it. It is written to be readable. If anything here is unclear, ask and we will explain it.
Kerchiff is a service of Kerchiff Inc., a Canadian company based in Ontario. It has a privacy officer: one person accountable for your information, who answers the address below. If you want to know who that is, ask and we will tell you.
To ask a question, or to make any of the requests below:
We collect different things depending on how you interact with us.
When you comment on one of our Instagram posts with a keyword
A keyword is a word we ask for in a post, like "LINK". When your comment has one, we keep:
We use this to reply to you, and to understand which posts bring people to us. Knowing which post someone came from is the main thing this system is for.
We do not keep the rest of what you wrote in your record. Instagram sends us your whole comment, and that original message is deleted after 60 days (see below). If your comment has no keyword, we keep no record about you at all — only that original message, for those 60 days.
When you comment on one of our Facebook posts with a keyword
The same as Instagram, except that Facebook gives us:
We treat your Facebook and Instagram accounts as separate. We do not guess that they belong to the same person.
When you send us a direct message on Instagram
If your message has a keyword, or replies to one of our stories, we keep:
We use this the same way we use comments: to reply, and to understand which posts and stories bring people to us. Instagram does not tell us your username for messages, so we only see an ID. As with comments, the rest of what you wrote stays only in the original message, for 60 days. The one exception is an answer to a question we asked you, below.
We do not keep a copy of the story itself.
When you answer a question we ask you in a message
Sometimes a message from us asks you something, like your level or your email address. While we are waiting for your answer, we treat your next message as the answer, and we keep:
If we ask for your email address, we add it to your record as your email, beside any you gave us before, so we can send you what you asked for and know it was you if you later buy something with it. If someone else in our records already has that address, we still add it to yours and note that the two of you might be the same person, but we do not join your records.
If your answer is not the kind we asked for, like words where we asked for a number, we ask once more and keep nothing from the reply that did not fit. Every question has a Skip button; if you tap it, we keep only that you skipped. You can ask us to correct or delete an answer, like any other detail.
When you tap a button in a message we sent you
If a message from us has buttons and you tap one, we keep which button you tapped and when. We use it to send you what that button offers, and to understand which messages people respond to.
A button that opens a web page goes through kerchiff.com first, which sends you straight on. That is how we know you tapped it: we keep which link it was and when you tapped it, each time you do. We never keep your IP address or anything about your phone or browser. If you ask us to delete your record, the link still works, and we still count that it was tapped, but nothing says it was you.
If you send us a message asking to stop hearing from us, we record that you asked and we stop. We send one message back to confirm it, with a Subscribe button, and nothing else after that. If you change your mind, tap Subscribe or send us START, and we will message you again. If you later send us or comment one of the keywords we ask for, we take that as asking to hear from us again, and answer it.
The messages we send you
We keep what we sent you and when. The law asks us to be able to show what we sent, and it lets you see it too.
When you join our email list
When you buy something
We do not collect or store your card number. Our payment processor handles that; we never see it.
When we add you ourselves
Sometimes we add people who did not come through Instagram or Facebook — for example, people who were already on our list before we used Kerchiff. Then your details come from us, not from you, and may include:
Labels, notes, and details
We may add labels to your record (like "bought the guide"), write short notes, and keep details you tell us or that we record (like a goal you mentioned). Each detail says who recorded it.
What we work out from the above
We keep a history of what happened and when, so we can see the path from someone finding a post to buying something. If we hold more than one email address for you, we keep each one and where it came from, and use them in this order: the one you bought with, then the one on our email list, then one we imported or added, then one you typed in a message to us. We also record which country we think you are in, because different countries have different rules about contacting people. If we are only guessing at your country, we mark it as a guess.
| What | How long |
|---|---|
| The original message from Instagram, Stripe, or our email tool | 60 days, then deleted automatically |
| Your record, your history, and the messages we sent you | For as long as you are a contact, or until you ask us to delete it |
| Proof that you agreed to be contacted | At least 3 years after we last did business, because the law requires us to be able to show it |
| A record that you asked us to stop | Kept indefinitely — see below |
| If we close this Kerchiff account: only your ID, and that you said stop | Until you ask us to delete it — see below |
| A backup copy, in case something goes wrong | Up to 30 days, then deleted automatically |
| A receipt that a message our system sent actually went out | 7 days, then deleted automatically |
Why we keep opt-outs forever. If you tell us to stop contacting you, we keep a permanent note of that. It sounds backwards, but it is the only way to honour it. If we deleted the record, and you contacted us again a year later, nothing would tell us you had said stop — and we would message you again. The note is what protects you.
The only thing that removes it is if you ask us to delete everything about you. That is your choice, not our policy. If we delete your record ourselves, we still keep your Instagram or Facebook ID and the fact that you said stop.
If we close this Kerchiff account. Everything we hold about our audience is deleted within 30 days of the account closing — except, for anyone who told us to stop, their Instagram or Facebook ID and the fact that they said stop. No name, no history, no messages. If the same Instagram account is ever connected to Kerchiff again, that is how we know not to message you. You can still ask us to delete even that, including during those 30 days.
You can ask for any of these at any time, free, by emailing privacy@kerchiff.com. We will respond within 30 days.
We will check it is really you first. We cannot tell who sent an email, and handing your history to someone pretending to be you — or deleting it because they asked — would be worse than being slow. So we will send you a short code and ask you to send it back to us in an Instagram direct message from the account in question. Only you can send from your account, which is what makes it proof.
We ask for a direct message rather than a public comment on purpose: a comment would tell your followers that you are making a privacy request. We check whether the code came from your account, and nothing else.
If you only know us through Facebook, or we only have your email, we will agree another way to confirm it is you before we act.
If we cannot confirm it is you, we will say so and take no action. You are welcome to try again.
See everything we have about you. We will send you a complete copy — your record, every event in your history, the identifiers we have linked to you, the labels, notes and details on your record, and every message we sent or planned to send you.
Get it in a portable format. The copy above is machine-readable, so you can take it elsewhere.
Correct something wrong. How we do this depends on what it is:
Delete everything. We remove your record, your history, and the identifiers linked to you from our live system straight away — including any original messages from Instagram or Facebook that mention you, and the note that you said stop if we kept one after closing an account. This is permanent and cannot be undone.
Two honest details about that:
Stop being contacted. You can opt out at any time, in any message we send, or by replying STOP. This takes effect everywhere, permanently. We do not need a reason. Once you have opted out, the only way to start again is for you to sign up again — we cannot undo it on our own, and neither can anyone else.
Object to how we use your information. If you are in a place whose laws give you this right, you can object to us using your information to work out what to show or send you. If you object to it being used for marketing, we will stop.
We share only what is needed to run the service:
We do not sell your information. We do not share it for anyone else's advertising.
Your information is stored in Canada.
If you are in the European Economic Area or the United Kingdom, Canada is recognised as providing an adequate level of data protection, so your information can be transferred here without extra safeguards.
We use plain calculations — not artificial intelligence — to work out which of our posts led to sales, and to sort contacts into simple groups. These decisions affect what we show or send you. They do not have legal effects and are not used to deny you anything.
If your information is ever exposed in a way that puts you at real risk, we will tell you and the relevant authority, as quickly as we can. We keep a record of every incident, whether or not it reaches that threshold.
Everything above is about people in our audience. This part is for people who sign in to Kerchiff: the owner of an account and anyone invited to help run it.
What we keep, and why
| What | Why | How long |
|---|---|---|
| Your email address | So you can sign in, and so we can reach you | While you have an account |
| Your password, scrambled so nobody can read it back | So only you can sign in | While you have an account |
| That you are signed in, on a device | So you stay signed in | Ends after 30 days; deleted a day after it ends |
| Failed attempts to sign in as your email, scrambled | To stop people guessing your password | 1 day, then deleted automatically |
| An invitation sent to your email | So you can join an account | Deleted 30 days after it is used or expires |
| Which accounts you belong to, and your role in each | So we know what you are allowed to do | While you belong to them |
| Which version of our terms you agreed to, and when | To show what you agreed to | While you have an account |
We never store your password as you typed it. We do not use any of this for advertising, and only our database hosting provider stores it, in Canada.
To see or delete your account details, email privacy@kerchiff.com. An account owner can also remove you from their account at any time.
This service is not intended for children. We do not knowingly collect information about anyone under 13. If you believe we have, contact us and we will delete it.
If we change how we handle your information, we will update this page and change the date at the top. If the change is significant, we will tell you directly where we can.
If you are unhappy with how we have handled your information, please email privacy@kerchiff.com first — we would rather fix it.
You can also complain to a regulator: