Derive Growth Lab · In force from 6 September 2026 · Version 1.1, updated 12 September 2026 to cover the Instagram comment → DM feature
This policy explains exactly what Derive Growth Lab collects, why, who else ever sees it, how long we keep it, and how you get rid of it.
This policy covers Derive Growth Lab only — the social publishing tool at derivegrowthlab.com. It is a separate product from the Derive study app, which has its own policy at derivenotes.com/privacy. The two products do not share accounts and do not share data.
Derive Growth Lab is operated by Derive Notes Pty Ltd (ACN 696 859 597), an Australian company registered in Queensland.
| Entity | Derive Notes Pty Ltd (ACN 696 859 597) |
|---|---|
| Postal address | 2/290 Boundary Street, Spring Hill QLD 4000, Australia |
| Privacy contact | matt@derivenotes.com |
We are the data controller for everything described below. We are bound by the Australian Privacy Principles under the Privacy Act 1988 (Cth).
Growth Lab is a tool for one person to run their own social accounts. It does two things.
Publishing. You upload a video, write a caption, tick which of your connected accounts should receive it, choose the settings each platform requires, and press Post. There is no feed, no other users' content, and nothing is published without you pressing Post.
Answering comments on Instagram. You can set up an automation that watches your own
posts for a keyword — say derive — and, when someone comments it, replies publicly under
their comment and sends that person a private reply in Instagram Direct with the link they asked for.
That feature is described in full in section 5, and it is the only part of
Growth Lab that handles information about people other than you. There is no messaging between Growth
Lab users, and Growth Lab never starts a conversation with somebody who has not contacted your account
first.
| Data | Why we have it | Where it comes from |
|---|---|---|
| Your Growth Lab login — an account identifier, a display label, a role, and the access token we issue you | To let you in and to scope you to your own connected accounts | Created by us when we set your account up |
Platform access credentials — for each account you connect: an access token, a refresh token, and the platform's own identifier for you (for TikTok, your open_id) |
So we can publish on your instruction without asking you to log in again every time | Returned by the platform's OAuth flow after you authorise us |
| The video and caption you upload, plus the publishing settings you chose (audience, comment/duet/stitch, commercial-content disclosure) | It is the thing being published | You |
| Publishing records — which video went to which account, when, the platform's post ID, and the resulting URL | So you can see what you have posted, and so a failed post can be diagnosed | Generated by us, plus the platform's response |
| Public performance figures for posts made through Growth Lab (views, likes, comment counts) | To show you how your own posts performed | The platform's own analytics API, for accounts you connected |
| Comments and messages sent to your connected Instagram account, where you have turned the comment → DM feature on — the comment or message text, its id, the post it was left on, and the sender's Instagram-scoped id and username | To decide whether it matches your keyword, to reply to that person, and to avoid answering the same person twice. This is information about them, not about you — section 5 sets out exactly what happens to it | Instagram's comments and messages webhooks, for your own posts only |
| Server logs — timestamps, request paths, error messages | Security and debugging | Automatic |
We do not ask you for a password, a date of birth, a phone number, a payment method or a physical address to use Growth Lab, and we do not collect them.
When you connect a TikTok account, we use TikTok's Login Kit and the Content Posting API. Here is every piece of TikTok data that touches our system.
Every time you open the composer, we call TikTok's creator_info endpoint and show you
what it returns — your nickname, your profile picture, the audience options your account allows, which
of comment / duet / stitch your account permits, and your maximum video length. None of it is
written to disk. It exists only in the memory of that one request and in your browser, so that
the screen you approve is showing you TikTok's current truth rather than a stale copy of it.
You can revoke our access at any time from inside TikTok — Settings and privacy → Security and permissions → Manage app permissions — or by disconnecting the account in Growth Lab. Either way we delete the stored tokens and the open ID. Revoking in TikTok takes effect immediately and does not depend on us. Posts already published stay on TikTok and are managed from TikTok, as they belong to your account, not to us.
Our use of TikTok data is additionally governed by the TikTok Developer Terms of Service. Where this policy would allow something those terms forbid, those terms win.
When you connect an Instagram professional account, we use Instagram Login and the Instagram Graph API. There are two halves to it: publishing, which works like TikTok above, and answering comments, which is the only place in Growth Lab where we handle information about somebody who is not a Growth Lab user. Both are set out here in full.
If you turn the comment → DM feature on, Instagram sends us a notification each time someone comments on one of your posts or sends your account a direct message. For each one we keep:
That is the whole of it. We keep it because a reply is impossible without it, because it is what stops the same person being messaged twice, and because you need to be able to see what your own automation did in your name.
You do not need a Growth Lab account to ask. Email matt@derivenotes.com from any address, telling us the Instagram username you commented from, and we will delete everything we hold about you within 30 days and confirm by reply. Full instructions, including what to do if you no longer have access to that account, are at derivegrowthlab.com/data-deletion.
You can revoke our access at any time from inside Instagram — Settings and activity → Apps and websites — or by disconnecting the account in Growth Lab. Either way we delete the stored token and the account stops answering immediately. Posts already published stay on Instagram and belong to your account, not to us.
Our use of Instagram data is additionally governed by the Meta Platform Terms and the Meta Developer Policies. Where this policy would allow something those terms forbid, those terms win.
The same publishing model applies to any YouTube account you connect: we hold the OAuth tokens and the platform's identifier for you, we upload only what you tell us to upload, and we read back only the public performance figures for videos posted through Growth Lab. Disconnect an account and the tokens are deleted. Growth Lab does not read or answer YouTube comments.
We do not sell, rent or trade personal information, and we run no advertising. Your data is disclosed only to:
That is the complete list. There are no analytics trackers, advertising pixels, session recorders or third-party scripts on Growth Lab.
No system is perfectly secure. If a breach ever occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
| Data | Kept |
|---|---|
| Platform access and refresh tokens | Until you disconnect the account or revoke access at the platform — then deleted |
| Uploaded videos | Until you delete them, or 90 days after publishing, whichever comes first |
| Publishing records and performance figures | While your account is open, so your posting history stays intact — deleted on request or on account closure |
| Comments and messages received on a connected Instagram account, and the replies sent to them | While the account stays connected, so a repeat commenter is not messaged twice and an operator can see what was sent in their name — erased on request within 30 days (data deletion), and with the account when it is disconnected |
TikTok creator_info | Never stored |
| Server logs | 30 days |
When you close your Growth Lab account we delete everything above within 30 days, except where we are legally required to keep a record.
You can ask us at any time to:
Email matt@derivenotes.com and we will answer within 30 days. There is no charge, and you do not need a Growth Lab account to ask — step-by-step instructions, including for people who only ever commented on one of our posts, are at derivegrowthlab.com/data-deletion. If you are unhappy with our answer you can complain to the Office of the Australian Information Commissioner. If you are in the EU or UK, you also hold the rights the GDPR gives you, including the right to complain to your local supervisory authority; our lawful basis for the processing above is performing the contract you entered into with us, and our legitimate interest in keeping the service secure.
Growth Lab is for people running their own social accounts and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, email us and we will delete it.
Your data is stored in Australia. Publishing your video necessarily sends it to the platform you chose, whose servers are overseas and whose handling is governed by that platform's own privacy policy. Cloudflare R2 may store archived media outside Australia. We take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles.
If we change this policy we will update the version and date at the top of this page. If a change materially reduces your privacy we will tell you before it takes effect.
Privacy questions, access requests, deletion requests and complaints: matt@derivenotes.com, or by post to Derive Notes Pty Ltd, 2/290 Boundary Street, Spring Hill QLD 4000, Australia.
Derive Growth Lab