Instacart: Get Food Delivery

"If you choose to allow the Services to access location services through the permission system used by your device's operating system or browser, we may collect the precise location of your device. We use your location information to facilitate the prompt hand-off of pickup orders (where available), to improve the accuracy of deliveries, to assist you in finding nearby stores for which pickup or delivery are available, and for other similar purposes. We may also use such information for our analytics purposes and to better understand how we can improve the Services."

Instacart collects both IP-based approximate location and precise GPS geolocation, uses it for analytics beyond core delivery functionality, and shares geolocation data with advertising and analytics partners as shown in the summary table.

"We may disclose your Personal Information to our affiliates, subsidiaries, and other companies under common control and ownership for purposes consistent with this Privacy Policy and other business and operational purposes. We disclose your Personal Information to our service providers and vendors who provide services to us... We also share your Personal Information with Instacart partners whose services we have integrated into our own."

Instacart shares personal information with a broad range of third parties including affiliates, service providers, retailers, advertising partners, analytics providers, fraud prevention partners, co-branded product partners, and restaurant partners — creating an extensive data-sharing ecosystem.

"Some of our advertising partners may use cookies, SDKs, or other trackers to collect information about your online activity over time and across different websites or online services. This means that you may see advertisements while using the Services that are tailored to you, or you may see advertisements for Instacart on other online services, based on your use of the Services or your browsing behavior across other online services."

Instacart and its advertising partners track users across websites and services using cookies, SDKs, and device identifiers to build behavioral profiles for cross-context targeted advertising.

"We also may use third party services that employ software code to record users' interactions with the Services. Session replays include users' clicks, mouse movements, scrolls, and keystrokes/key touches during those sessions. These replays help us diagnose usability problems and identify areas for improvement."

Instacart uses third-party session replay tools that record detailed user interactions including keystrokes and mouse movements, which goes beyond standard analytics and captures granular behavioral data from users' devices.

"We may occasionally update this Privacy Policy to reflect changes in our practices with respect to the collection, use, and disclosure of Personal Information and/or changes in applicable law. If we make changes, we will revise the date at the top of this Privacy Policy and, in the case of material changes to this Privacy Policy, we may provide you with additional notice (such as a notice posted on the Services or a message delivered to the email address that we have on file for you)."

Instacart can change its privacy policy at any time, with notice being discretionary ('may provide') even for material changes, and continued use of the service constitutes acceptance.

"We keep Personal Information only for as long as necessary to fulfill the purposes for which we have collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information; the potential risk of harm from unauthorized use or disclosure of the Personal Information; the purposes for which we use the Personal Information; whether we can achieve those purposes through other means; and the applicable laws."

While Instacart claims purpose-based retention, no concrete timelines or maximum retention periods are specified, leaving the company broad discretion to retain data indefinitely under vague criteria.