Instamall Consumer Privacy Policy

Last updated: September 25, 2025

I. Introduction

At Instamall, we connect consumers with the best of fashion and retail in their city by enabling retailers to fulfill orders for delivery or pickup and by coordinating with independent third‑party couriers.

This Privacy Policy (this “Policy”) describes how Instamall, LLC and its affiliates (“Instamall,” “we,” “our,” or “us”) collect, process, retain, and disclose your Personal Information when you use our consumer websites, mobile applications, any site or application that links to this Policy, and our communications channels (collectively, the “Services”).

This Policy does not apply to couriers/delivery partners, job applicants, employees, or to the personnel of retailers and other business partners; those are addressed in separate notices or agreements.

II. What Personal Information does Instamall collect or process?

Personal Information means information that can reasonably be used to identify you, whether alone or in combination with other information. Anonymous or de‑identified information that cannot reasonably be linked to you is not Personal Information.

We may process the following categories of Personal Information in connection with the Services:

• Contact Information: name, delivery and billing addresses, email address(es), phone number(s), and other contact details you provide.
• Account & Profile Information: username and credentials, preferences and notification settings, profile photo, saved sizes and brand/style preferences, and identifiers we may link to an account; information received from third‑party sign‑in/authentication services you connect.
• Communications with Instamall, Retailers, and Couriers: in‑app messages/chats, SMS/texts, calls, and emails related to the Services; timestamps; channels used; (where permitted) call recordings; outcomes/resolutions.
• Content You Create or Share: ratings/reviews, photos, videos, and any information you choose to include in such content.
• Payment Information: payment card details and other payment method information processed primarily by our payments providers; we may store limited payment metadata (e.g., last four digits, card type, billing ZIP).
• Activity & Transactions on/with our Services: items viewed and ordered (e.g., apparel, footwear, accessories, beauty/fragrance), cart contents, order history, delivery/pickup preferences, transaction amounts, promotional codes/discounts used, retailers ordered from, gift activity, features you use (including session‑replay analytics where applicable), survey responses, and participation in sweepstakes, promotions, or referral programs.
• Geolocation Information: precise or approximate location if you enable location access (e.g., to show nearby retailers, estimate delivery times, or route deliveries). You may use the Services without enabling precise location, but some features may be limited. You can disable location sharing at any time in your device settings.
• Device/Technical Information: IP address, device identifiers, operating system and version, language, hardware model, browser/app type and settings, app logs, crash data, and other technical data.
• Information from Co‑Branded or Third‑Party Offers (if any): information you provide to register for, or your activity with, third‑party programs we promote with partners (e.g., loyalty integrations), consistent with your choices.
• Marketing & Ad Data: campaign/attribution data, engagement with our emails/SMS/push notifications, and ad measurement data.
• Inferences: inferences drawn from the above (e.g., likely style affinities, preferred brands, delivery vs. pickup tendencies) to personalize your experience.
• Sensitive Personal Information (SPI). We may process precise geolocation (if enabled) and account log‑in credentials. We generally do not collect government‑issued IDs for consumer orders and do not use SPI to infer characteristics about you. Where legally required, we collect/process SPI only with consent and only as reasonably necessary to provide the Services, for security/fraud prevention, or to comply with law (e.g., age verification for certain age‑restricted products, if applicable).

When we process de‑identified information, we maintain and use it in de‑identified form and do not attempt to re‑identify it, except as permitted by law.

III. How does Instamall collect or receive Personal Information?

From users of our Services: during account/profile creation and updates, placing or managing orders, saving preferences, submitting content (photos/reviews), contacting Support, and enrolling in promotions, referrals, or gift programs. If you provide information about others (e.g., a gift recipient), you represent that you have authority to do so.

Automatically through our Services: when you use our apps or sites, certain data is collected automatically from your device and browser.

Through cookies and similar technologies: we (and providers) use cookies, pixels, SDKs, local storage, APIs, and similar technologies to operate, secure, measure, and improve the Services and to personalize content/ads subject to your choices. Some pages may use session‑replay tools to debug and enhance UX.

From our service providers: communications platforms (email/SMS/push), payments processors, cloud hosting, marketing/advertising tech, analytics, security/fraud prevention, mapping/address normalization, identity/authentication, customer support tools.

From partners: for co‑branded or third‑party offers you participate in, or loyalty integrations you choose to link.

From retailers and couriers: to prepare, deliver, and support your orders; to address fraud/safety; and to resolve service issues.

From legal claims, disputes, requests, and orders: including from law enforcement, courts, regulators, users/non‑users, or others involved in a matter.

IV. How does Instamall use Personal Information?

Depending on which Services you use and how you interact with us, Instamall may use Personal Information to:

• Provide and customize the Services: enable ordering and payment; route deliveries/pickups; recommend and rank retailers and products; enable participation in promotions, referrals, and gift programs; display public reviews/photos you post; and personalize your experience (e.g., by size/brand preferences and past activity).
• Provide customer support: exchange communications; investigate, analyze, and address support issues (including delivery matters); evaluate and improve our support.
• Develop, analyze, and improve: debug and troubleshoot; understand usage and preferences; improve existing features and build new ones.
• Advertise and promote Instamall and our Retailers: display and measure advertising on our Services and on third‑party platforms; analyze campaign effectiveness; and show offers likely to be relevant to you (see Section VI for opt‑out choices).
• Allow or facilitate communications with Instamall, retailers, and couriers about orders, accounts, policy changes, and the Services.
• Authentication, integrity, security, quality, and safety: verify accounts; provide secure shopping; detect, investigate, and prevent fraud, abuse, malware, illegal or unsafe experiences; and protect people, property, and our Services.
• Legal reasons and policy compliance: comply with law; respond to lawful requests; participate in litigation or investigations; enforce terms and policies; perform audits and assessments; and enable you to exercise your rights as required by law.

V. Instamall’s disclosure of Personal Information

Depending on how you use the Services, Instamall may disclose Personal Information as follows:

• To service providers (processors): to operate our business and perform the Services (e.g., identity/auth services, cloud hosting, payments, gift programs, security, marketing/advertising, promotions/sweepstakes, market research, communications, analytics, location/mapping, and customer support). These providers may access, store, or process your information in the U.S. and other countries.
• To couriers/delivery partners: limited information needed to deliver your orders (e.g., name or first name/initial, delivery address, masked phone contact, order information, and delivery instructions). We may ask for delivery verification (e.g., a PIN) where applicable.
• To retailers: to prepare and fulfill your orders; to facilitate delivery (by a courier or retailer); for fraud/safety; and to honor a retailer’s loyalty program if you choose to link it. If a retailer is responsible for delivery, the retailer may contact you about your order/delivery using your contact details. The retailer is solely responsible for communications it initiates to you.
• Publicly: we display content and information you share publicly (e.g., reviews/photos) so others can learn about your experiences.
• To marketing and advertising partners: to deliver and measure advertising for Instamall and participating retailers, including personalized ads based on your activity on our Services and third‑party services (see Section VI for opt‑out choices).
• For corporate transactions: during diligence and upon transfer in connection with a sale, merger, acquisition, financing, reorganization, bankruptcy, or similar event (subject to confidentiality).
• To government authorities or where legally required or permitted: to comply with law; respond to lawful requests; enforce agreements; prevent fraud; or protect the rights, property, and safety of Instamall, our employees, retailers, couriers, customers, or others.
• Instamall’s group of companies: to our parents, subsidiaries, and affiliates for the purposes described in this Policy.
• Other third parties or persons with your consent or at your direction: e.g., when you send a gift, link accounts, or participate in a joint promotion.

We do not sell Personal Information for money. We may share identifiers and internet/technical data with advertising partners for cross‑context behavioral advertising (targeted advertising) as defined by certain U.S. state laws.

VI. Your Privacy Rights and Choices

We provide tools and processes to help you manage your Personal Information. Depending on your U.S. state of residence and subject to exceptions, you (or your authorized agent) may exercise the following rights:

• Access / Know: request access to categories and specific pieces of Personal Information we have collected, and information about sources, purposes, and disclosures.
• Portability: receive certain information in a portable, machine‑readable format.
• Deletion: request that we delete Personal Information we collected from you (we may retain data as permitted/required by law).
• Correction: request that we correct inaccurate Personal Information.
• Opt‑Out of “Sale” / “Sharing” / Targeted Advertising: opt out of our disclosure of Personal Information to advertising partners for cross‑context behavioral advertising.
• Limit Use of Sensitive Personal Information (where applicable): restrict our use of SPI to permitted purposes (we already limit SPI as described in Section II).
• Appeal: appeal our decision if we deny your request.

Instamall will not discriminate against you for exercising your rights. We may deny requests we cannot reasonably verify or where an exemption applies.

Exercising Rights

If you have an Instamall account, you can access, correct, or delete certain information in your account settings.

You can also submit rights requests via our Privacy Center at instamall.co/privacy/requests or by emailing privacy@instamall.co. We will respond within the time required by applicable law.

Authorized agents may submit requests to privacy@instamall.co with: (i) the data subject’s and agent’s names and emails; (ii) proof of authorization (e.g., signed permission or power of attorney); (iii) the data subject’s relationship with Instamall (e.g., registered user/non‑user); (iv) the specific right(s) requested; and (v) “Authorized Agent Request” in the subject line. We may ask the consumer to verify identity directly.

Additional Choices

• Email marketing: use the Unsubscribe link in our marketing emails.
• SMS marketing: reply STOP to any Instamall marketing text (see SMS Terms).
• Transactional SMS: manage in account settings; some transactional messages are necessary to complete orders.
• Push notifications: manage in your device/app settings.
• Interest‑based advertising: in addition to our Do Not Sell/Share control, you can use platform/device settings and industry tools (e.g., DAA/NAI) to limit interest‑based ads. Links are provided for convenience; Instamall is not responsible for third‑party opt‑out programs.
• Global Privacy Control (GPC): where required by law, we honor GPC and similar recognized browser signals as a Do Not Sell/Share request for the browser that sends the signal.
• Do Not Sell or Share / Targeted Advertising Opt‑Out. Use our footer link “Do Not Sell or Share My Personal Information” or visit instamall.co/privacy/do-not-sell.

VII. Supplemental Jurisdiction‑Specific Disclosures

California (CCPA/CPRA) – Notice at Collection and Metrics.

Notice at Collection: For categories collected, see Section II; sources in Section III; purposes in Section IV; recipients in Section V; retention in Section VIII; and sale/sharing in Section VI.

Annual request metrics (Requests to Know/Access, Delete, and Opt‑Out): We will publish metrics for the prior calendar year at instamall.co/privacy/metrics as required by law.

Other U.S. States (e.g., CO, CT, VA, UT): Residents have substantially similar rights described in Section VI and may use the same request methods, including appeal.

Consumer Health Data: Instamall is a fashion/retail service and does not seek to collect "consumer health data." If you provide health‑related information in free‑text fields (e.g., allergy notes), we process it only as reasonably necessary to provide the Services, for safety/fraud prevention, or to comply with law.

VIII. Security and Retention

We use commercially reasonable administrative, organizational, technical, and physical safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, or destruction. However, no method of transmission or storage is 100% secure. Please consider this when deciding what information to share via the Services or when communicating by email/SMS/chat.

We retain Personal Information only as long as necessary to provide the Services and for the purposes in this Policy, unless a longer retention period is required or permitted by law. Criteria we consider include: the type and sensitivity of data; the purposes for which we process it; the duration/status of your relationship with us; legal, regulatory, tax, and accounting requirements; the periods for potential claims; and operational needs. As guidance, account data is typically retained while your account is active and up to 3 years after deletion; transactional records may be retained up to 7 years for tax/audit.

IX. Cross‑Border Transfers of Personal Information

We and our service providers may process Personal Information in the United States and other countries with different data protection laws than where you live. Where required by law, we implement appropriate safeguards for cross‑border transfers.

X. Personal Information from Children

Our Services are not intended for individuals under 18. We do not knowingly collect Personal Information from children under 18. If you believe a child has provided Personal Information to us, contact privacy@instamall.co and we will take appropriate action.

XI. Third‑Party Sites

Our Services may link to third‑party websites or services (e.g., retailer sites or loyalty programs). These third parties are not under our control and are responsible for their own privacy practices. If you provide Personal Information to any third party or through third‑party sites, their policies apply.

XII. How to Contact Us

For questions or concerns about this Policy or our privacy practices, contact us at privacy@instamall.co or:

Instamall, LLC — Privacy

38 NW 24th Street

Miami, FL 33127

Support: support@instamall.co

Phone: +1 (561) 699–9941

Privacy Center: instamall.co/privacy

XIII. Changes to this Privacy Policy

We may update this Policy periodically to reflect changes in our practices or applicable laws. If changes are material, we will provide notice and/or obtain consent where required. Updates apply to collection and processing after the “Last updated” date at the top.