Privacy Policy
Effective date: September 4, 2026 · Only24 is operated by EkoMade Labs LLC.
This Privacy Policy explains how EkoMade Labs LLC ("Only24", "we", "us") collects, uses, shares, and protects information when a business ("Shop") or an individual uses the Only24 loyalty and rewards platform, including our website, app, and related services (the "Service").
1. Who we are
Only24 is a subscription-based loyalty and rewards platform for local retail shops. When a customer posts an Instagram story that tags a participating Shop, Only24 detects the tag and credits a reward the Shop has configured. EkoMade Labs LLC is the data controller for information processed through the Service. You can reach us at eko@only24.co.
2. Information we collect
- Account information you provide when a Shop signs up: name, email address, business name, business category, location, and a password.
- Instagram data, obtained only with your authorization through Instagram Login (the Instagram API with Instagram Login): your Instagram professional account ID and username, your profile picture, and the access token needed to receive story mentions and to reply to them. No Facebook account or Facebook Page is involved. We use these to detect story mentions of your Shop, to send the reward reply described below, and to show your profile picture on your reward cards.
- Mention and reward data: when a customer tags a participating Shop in a public Instagram story or post, we process the public username of the tagging account, the media identifier, and the timestamp in order to credit the correct reward. We also store the tagging account's public Instagram follower count as it was at the time of the tag; this number is used only to show the Shop its aggregate reach (the combined follower count of the customers who tagged it) and is never used for advertising or shared with anyone else. We do not collect private messages.
- Billing information: subscription payments are processed by our payment provider, Stripe. We receive limited billing details (such as subscription status and the last four digits and brand of a card). We do not store full card numbers.
- Usage and device data: basic log information such as IP address, browser type, and pages viewed, used for security and to operate the Service.
3. How we use information
- To detect Instagram story mentions and tags of a Shop and credit the corresponding rewards.
- To operate, maintain, and secure the Service and each Shop's account.
- To process subscription billing and provide receipts and support.
- To communicate with Shops about their account, service updates, and support requests.
- To comply with legal obligations and enforce our Terms of Service.
4. How we use Instagram and Meta data
Access to Instagram data is used solely to operate the rewards program you signed up for. Specifically, we receive story mentions of your Shop so we can credit rewards, and we send one automated direct-message reply from your Instagram account to the customer who mentioned you, confirming the credit and linking to their reward — this is the only message Only24 ever sends on your behalf. Only24 does not post to your account, read your other conversations, or use this data for advertising. Our use of information received from Meta APIs follows Meta's Platform Terms and Developer Policies.
5. How we share information
We do not sell your personal information. We share information only with:
- Service providers that help us run the Service, including Meta Platforms (Instagram APIs), Stripe (payments), and our hosting and database provider. These providers may process data only on our instructions.
- Legal and safety recipients, where required by law, to protect our rights, or to prevent fraud or abuse.
- Business transfers, if Only24 is involved in a merger, acquisition, or sale of assets, subject to this Policy.
6. Data retention
We retain account and mention data for as long as a Shop's account is active and as needed to provide the Service. Instagram access tokens are stored securely and refreshed or removed as they expire. When an account is closed, or on request, we delete associated personal data as described below, except where we must retain limited records to meet legal, tax, or accounting obligations.
7. How to delete your data
You can request deletion of your data at any time by disconnecting your Instagram account in the app or by emailing eko@only24.co. For full details, see our Data Deletion Instructions.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, or to object to or restrict certain processing. To exercise these rights, contact us at eko@only24.co. We will respond within the time required by applicable law.
9. Security
We use technical and organizational measures to protect information, including access controls and encryption in transit. Access tokens and secrets are stored in restricted, service-role-only storage. No method of transmission or storage is completely secure, but we work to protect your information and to promptly address any issues.
10. Children
The Service is intended for businesses and adults. It is not directed to children under 18, and we do not knowingly collect personal information from children.
11. Changes to this Policy
We may update this Policy from time to time. When we do, we will revise the effective date above and, where appropriate, notify Shops. Continued use of the Service after changes means you accept the updated Policy.
12. Contact us
EkoMade Labs LLC (Only24)
Email: eko@only24.co
Web: only24.co