Privacy policy

This policy covers creative-district.co and our local management of comments and direct messages for the Instagram account @tanja.fleger using the application “Kommentar-Inbox NAS”.

1. Controller and contact

For privacy questions and requests concerning your personal data: Show email address.

2. Visiting this website

When you visit this website, the connection data needed to deliver it is transmitted to our hosting provider, ISP One. This includes your IP address, the time of the request, the requested page and technical information sent by your browser. This information is used to deliver the website, investigate errors and protect against misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of this website. Technical logs are retained only for as long as needed to maintain security and investigate specific errors or incidents.

This website does not use analytics or advertising trackers. It does not embed external fonts, videos or social media plugins, and does not itself set cookies. External links are accessed only when you follow them.

3. Contacting us by email

If you email us, we process your contact details and the contents of your message to handle your enquiry. Enquiries concerning a contract or steps requested before entering into a contract are processed under Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f) GDPR, based on our legitimate interest in responding to incoming communications.

We retain correspondence for as long as needed to deal with the enquiry and relevant follow-up questions. Where legal retention obligations apply, or records are needed to establish, exercise or defend legal claims, the relevant information is retained for that purpose.

4. Instagram comments and direct messages

We use Meta’s official Instagram API to retrieve comments, comment replies and direct messages available to our account. The data comes from your communications on Instagram and the associated information Meta makes available to us.

This may include message or comment text, your Instagram username or display name, associated user, comment, message, post or conversation identifiers, timestamps and a link to the relevant post. Where available through the API, we also display profile pictures, profile links, post captions and post preview images so that communications can be understood in context. Preview and profile images are temporarily cached on our own system to reduce repeated downloads; they are not used for AI image analysis. Our inbox does not download image, video or audio attachments for AI analysis.

We use this information to keep track of questions and other enquiries, group similar topics, prepare human responses and analyse recurring questions and topic trends over time. Article 6(1)(b) GDPR may apply to specific contract and business enquiries. The general organisation of our communications relies on Article 6(1)(f) GDPR: our legitimate interest in managing incoming communications in an organised and reliable way, subject to consideration of your rights and opposing interests.

5. Local automated sorting

AI running locally on our own network storage system classifies texts by content and topic, for example as questions, praise, criticism or product enquiries. It also suggests whether a response might be useful. These classifications can be incorrect and are used only as an aid to our work.

Text analysis runs with Ollama on our own system. We do not send these texts to an external AI service for this analysis, and do not use them to train an AI model. The application does not send automatic replies or delete or hide Instagram content. We do not make solely automated decisions producing legal or similarly significant effects under Article 22 GDPR.

6. Storage and access

The inbox is access-protected and can also be reached remotely over an encrypted HTTPS connection. Its contents are accessible only to people responsible for handling our communications. The inbox uses an essential, access-protected session cookie for login, with a maximum duration of 12 hours. Logging out invalidates the session on our server. This cookie is used for authentication, not advertising or tracking. The local inbox also serves as an archive for handling communications and analysing recurring questions and topic trends over time. There is no automatic deletion after 30 days. We retain identifiable content only for as long as needed for these purposes or to meet applicable legal obligations; longer-term statistical analysis should use anonymous information where it is sufficient. Requests for access, objection or deletion can be made using the contact details below.

Deleting data from our local inbox does not delete content on Instagram. Meta’s rules and your account settings govern storage and deletion on the Instagram platform.

7. Service providers and Instagram

We use IT service providers to host this website and provide our communications infrastructure where necessary for the relevant service. The contents of the local inbox are not displayed on this public website.

Instagram is provided to users in the European Economic Area by Meta Platforms Ireland Limited. Meta processes information under its own terms and may process it outside the European Economic Area. Please see the Instagram Privacy Policy for information about recipients, international transfers and safeguards. Our local sorting does not require an additional transfer of the texts to an external AI provider.

8. Your rights and right to object

Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on your consent, you may withdraw that consent for the future.

Where processing is based on legitimate interests under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will assess your objection and stop the relevant processing unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.

You may also lodge a complaint with a data protection supervisory authority, particularly in the country where you normally live or work, or where the alleged infringement occurred. In Cyprus, this is the Office of the Commissioner for Personal Data Protection.

9. Requesting deletion of your data

Please write to Show email address, preferably using the subject “Delete Instagram data”. Include your Instagram username and identify the comments or messages concerned. Do not send us your password or an Instagram access token. Where necessary, we may request suitable information to identify the relevant records and verify your entitlement to make the request.

We handle requests within the applicable statutory time limits, normally within one month. If we cannot delete particular information immediately for legal reasons, we will explain why. Your request concerns data we process; you can also manage content in your Instagram account through Instagram itself.

Last updated: 17 September 2026