AtlasCore Market

Instagram Shopping Legal addendum · Legal version v1 · Last updated: July 13, 2026

Instagram Shopping Data Protection Policy (DPP) Compliance

Last updated: August 24, 2026

This addendum describes AtlasCore controls that apply only to Instagram Shopping / Meta Commerce data. AtlasCore is an independent application and is not sponsored, endorsed, or affiliated with Meta Platforms, Inc.

Retention clocks (Instagram-owned worker)

AtlasCore runs an Instagram-owned retention worker (`purge_expired_instagram_pii`). It does not share clocks or status machines with any other marketplace integration.

- 30-day post-delivery / terminal clock: Encrypted Instagram order payloads are redacted 30 days after `order_date` when status is `DELIVERED`, `COMPLETED`, or `CANCELLED` (including `CANCELED` / `CANCEL`).

  • 90-day open-order ceiling: `SHIPPED`, `IN_PROGRESS`, and other unfulfilled statuses are redacted 90 days after first persist (`created_at`). The `created_at` fallback is not applied to terminal statuses.
  • `SHIPPED` is not terminal. In-transit Instagram orders stay on the 90-day open ceiling until Meta reports delivery, completion, or cancel.

Redaction overwrites `encrypted_order_payload` (and the linked Instagram `ChannelOrder` blob, when present) with a DPP marker. Events are written to the Instagram retention audit action `instagram.pii.retention_purge`.

Stored order and webhook blobs

- Order rows store an allowlisted operational dictionary only: `meta_order_id`, `order_status`, `order_date`, line-item counts, and operational totals. Buyer, shipping, and contact fields are not persisted.

  • Webhook ledger rows store an allowlisted envelope only: `event_id`, `field`, `page_id`, `order_id`, and `status`. The raw Meta notification is not retained.
  • Anti-rehydration: If a stored Instagram order payload is already DPP-redacted, later syncs and webhook deliveries do not overwrite it with a fresh blob.

Seller-facing order APIs

`GET /api/v1/instagram/orders/` and `GET /api/v1/instagram/orders/cache/` return the same minimized cache row contract (`order_id`, date, status, operational totals / item count). Live Graph JSON is not returned to the browser.

Catalog writes and OAuth scopes

Requested Meta scopes include `catalog_management`. AtlasCore persists the granted scope string on the Instagram account row. Catalog mutations use Meta `POST /{catalog_id}/items_batch` and fail closed when `catalog_management` is absent from the stored grant.

Inventory quantity PUTs are not performed under the current Instagram grant. Catalog batch payloads may include availability derived from seller quantity for listings the merchant chooses to push.

Isolation and seller control

Instagram Shopping is a B2C seller connection. `tenant_id` may be null (personal / base seller) or bound to an optional enterprise workspace (`X-Tenant`). Meta data-deletion and deauthorize callbacks persist an Instagram compliance receipt, then purge every matching Page / Meta user account in its own tenant scope.

Disconnect Instagram Shopping in AtlasCore, revoke AtlasCore in Meta Business Settings, or use Instagram Data Deletion Status.

See Instagram Shopping Data Handling and the Privacy Policy §7.