Privacy Policy

Last updated 22 September 2026

1. Who we are

Aureus Management Ltd, trading as Melossom, is a company registered in England and Wales with its registered office at 10 Corporation Road, Newport NP19 0AR. We are the data controller for the personal data described in this policy. You can contact us about privacy at mgmt@melossom.com.

2. What this policy covers

This policy covers the melossommgmt.com website and the Melossom Analytics application, including the Instagram account connection it offers. Melossom Analytics is a performance analytics tool for Instagram professional accounts that are managed by, or working with, Melossom.

3. Information we collect

Website. When you apply to work with us or request our guide, we collect the details you enter, such as your name, email address and Instagram username. The site uses Google Tag Manager for analytics.

Melossom Analytics and Instagram. When you connect an Instagram professional account, you authorise our app through Meta and we receive the following through the Instagram API:

• Your Instagram user ID, username, account type and follower count.
• Your published media: post identifier, caption, permalink, thumbnail, timestamp and media type.
• Performance metrics for your account and media: views, reach, likes, comments, saves, shares, reposts, average watch time, skip rate, profile views and the split of views between followers and non-followers.
• An access token that allows us to retrieve the above on your behalf.

The permissions used are instagram_business_basic and instagram_business_manage_insights. We never receive your Instagram password, your direct messages or any private or unpublished content, and we cannot post, comment or message from your account.

4. How we use it and our lawful basis

• To show you the performance of your own content and account inside Melossom Analytics, and to make the same figures available to the Melossom team that supports your account. Basis: your consent, given when you connect the account, and performance of our contract with you where you are a Melossom client.
• To identify content that performs above your account's usual level and plan future content around it. Basis: performance of our contract, and our legitimate interest in delivering the service you have engaged us for.
• To produce reports for you. Basis: performance of our contract.
• To keep the service secure and to improve it. Basis: our legitimate interests.

We do not use Instagram data for advertising, we do not sell it, and we do not use it to build profiles of anyone other than the connected account for the purposes above.

5. Where your data is held

We use trusted service providers to store and process data on our behalf: Airtable (database), Make (automation), Vercel (application hosting), Google (Sheets and analytics) and Slack (internal notifications). Some of these providers process data outside the United Kingdom. Where that happens, transfers are protected by the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK addendum, or an adequacy decision.

6. Who we share it with

Your data is available to Melossom staff and contractors who need it to provide our services, and to the providers listed above. We share it with authorities or professional advisers where the law requires. We never share one creator's Instagram data with another creator, and we never sell personal data.

7. How long we keep it

Instagram access tokens are deleted as soon as you disconnect your account or ask us to delete your data. Instagram profile, media and performance data is kept while your account is connected and for up to 12 months afterwards for historical reporting, unless you ask us to delete it sooner. Website form submissions are kept for up to 24 months. We may keep minimal records for longer where the law requires, for example invoices.

8. Your rights

Under the UK GDPR you can ask us to access, correct, delete or restrict your personal data, object to our processing, ask for a copy in a portable format, and withdraw consent at any time. To exercise any of these rights, email mgmt@melossom.com. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

9. Disconnecting Instagram and deleting your data

You can remove our access at any time from Instagram: Settings, Website permissions, Apps and websites, then remove Melossom Analytics. You can also manage this on the web at instagram.com/accounts/manage_access. Removing the app revokes our access token immediately. To have the data we already hold deleted, follow the steps on our Data Deletion Instructions page. We complete deletion requests within 30 days.

10. Security

Access to Instagram data and tokens is restricted to the people and systems that need it, data is encrypted in transit, and access tokens are stored in a restricted database rather than in code or documents.

11. Age

Our services are for adults only. We do not knowingly collect data from anyone under 18.

12. Meta Platform

Our use of data received from Instagram complies with the Meta Platform Terms and Developer Policies.

13. Changes

We will post any changes to this policy on this page and update the date at the top.