Privacy Policy — JustTapMate (test app)

This policy covers a technical test of the JustTapMate Meta app. During the test, the app only processes data from Instagram accounts that were explicitly invited to the app as testers. It will be replaced by the full JustTapMate privacy policy before the service is offered to the public.

Last updated: 21 October 2026

Who we are

JustTapMate is a loyalty product in development, operated by Rodrigo Leite trading as Martyns Studio (Perth, Western Australia). Contact: [email protected].

What we collect

When an Instagram account mentions a connected business account in a Story, Instagram notifies our app. From that notification we receive and record:

• the Instagram-scoped user ID of the person who mentioned the business account;
• the ID of the business account that was mentioned;
• the time of the event and the message ID;
• a temporary link to the Story provided by Instagram. We do not download or keep the Story media.

We may also read the public username of that account through the Instagram API to identify the tester.

Why we use it

Only to test whether a Story mention can be detected automatically and linked to the right person, so that a future loyalty program can award points for it. We do not use the data for advertising, profiling or any other purpose.

Who receives the data

We do not sell the data or use it for advertising. Only the service providers needed for the test handle it, each for the purpose described here:

• Meta (Instagram): creates and delivers the Story mention notification, under Meta's own terms and privacy policy.
• localtunnel (loca.lt): during the test, notifications pass through this relay service on their way to the operator's computer.
• Cloudflare: hosts these policy pages and receives the technical data of visits to them (IP address, browser, time).

We may also disclose data when the law, a court order or a competent authority requires it.

Overseas processing

Meta, localtunnel and Cloudflare operate servers in several countries, so the data may be processed outside Australia while it is in transit or hosted by them.

How long we keep it

Test data is deleted when the test ends, and no later than 30 days after it was received.

Security

Notifications are accepted only over HTTPS and only when their Meta signature is valid. Test records are kept on the operator's own computer, outside any public storage, and are not copied into the project's code repository.

Children

The test is limited to invited adult testers. The app is not directed at people under 18.

Changes

This page will be replaced by the full JustTapMate privacy policy before the service is offered to the public. The date at the top shows the latest version.

Your choices

You can ask to see or delete your data at any time by emailing [email protected]. You can also remove the app from your Instagram account under Settings → Apps and websites. See the data deletion instructions.

Australian privacy law

We aim to handle personal information consistently with the Australian Privacy Principles. If you are not satisfied with our response to a privacy concern, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).