Privacy Policy

This Privacy Policy explains how Secret Followers, based in Portugal ("we", "us"), acting as data controller under the General Data Protection Regulation (GDPR), collects, uses, and protects the personal data of users ("you") of the Secret Followers service available at secretfollowers.com (the "Service").

Depending on how you use the Service, we collect:

We never collect or store any card details; this information is handled directly by our payment processor, Stripe.

We never ask for your Instagram password and never request access to your Instagram account: the Service only reads publicly available data of Instagram accounts, through third-party technical providers.

We do not sell or rent your personal data. It may be shared with the following processors, strictly to the extent necessary to operate the Service:

• Supabase — database hosting and authentication;
• Stripe — payment processing, subscription and billing management;
• Bird (MessageBird) — sending transactional emails and notifications;
• Twilio — sending WhatsApp notifications (feature being rolled out);
• Instagram data providers — fetching the public Instagram data required by the Service. Only the username being searched or tracked is shared with them, no other personal data about you;
• Vercel — application hosting and running scheduled account checks.

Some of these providers are located outside the European Economic Area (notably in the United States). Where that is the case, the transfer relies on appropriate safeguards required by the GDPR (standard contractual clauses, an adequacy decision, or an equivalent mechanism offered by the provider).

Your data may also be disclosed to competent authorities where required by law.

The Service only uses cookies that are strictly necessary for it to function, in particular authentication session cookies set by our provider Supabase, which keep you signed in to your account. These cookies do not require prior consent under applicable law, as they are essential to deliver the Service you requested.

The Service does not currently use any advertising cookies or third-party analytics tools (such as Google Analytics). If this changes, we will let you know and, where required, obtain your consent through a dedicated banner.

• Account and subscription data: for the duration of the contractual relationship, then archived for the legal retention periods that apply (e.g. accounting/tax), then deleted or anonymized;
• Tracked Instagram accounts and their activity history: for as long as the account is actively tracked, then deleted if the tracked account is removed or the user account is closed;
• Notification history: kept for a limited period necessary for support and proof of delivery/opt-out, then deleted or anonymized;
• Hashed IP address linked to free searches: kept for a short technical period necessary for rate-limiting, then deleted;
• When you close your account, your personal data is deleted or anonymized within a reasonable timeframe, subject to legal retention obligations (e.g. invoices and accounting records).

We implement reasonable technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure, such as encryption in transit (HTTPS), database-level access controls (Row Level Security), and salted hashing of IP addresses used for rate-limiting. No system is completely secure, so we cannot guarantee absolute security.

Under the GDPR, you have the right to:

• access and rectify your personal data;
• request erasure ("right to be forgotten"), subject to our legal retention obligations;
• request restriction of processing;
• object to processing, in particular on legitimate grounds;
• receive, in a portable format, the data you provided to us;
• withdraw your consent at any time where processing relies on it (for example, WhatsApp notifications, which you can disable from your dashboard or via the unsubscribe link in our emails);
• lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt — or any other competent supervisory authority.

To exercise these rights, contact us at the address in Section 11 below. We will respond within one month, which may be extended by a further two months for complex requests.

The Service is not intended for anyone under 16 years old. If you believe a minor has provided us with personal data without the required consent, please contact us so we can delete it.

The Service displays public information about Instagram accounts, including accounts belonging to people who are not themselves users of the Service. This information (username, profile picture, verification status, follower/following counts) comes exclusively from data made public by its owners on Instagram, obtained through our third-party data providers.

Anyone who owns a public Instagram account displayed by the Service can contact us at the address in Section 11 to exercise their GDPR rights over the data about them shown by the Service, including a right to object.

We may update this Privacy Policy at any time to reflect changes to the Service, our providers, or applicable law. The last updated date appears at the top of this page. In case of a material change, Users will be notified by email.

For any question about this policy or to exercise your rights, contact us at contact@secretfollowers.com.

See also our Terms of Service.