Legal
Last updated: July 30, 2026
This Privacy Policy explains how Secret Followers, based in Portugal ("we", "us"), acting as data controller under the General Data Protection Regulation (GDPR), collects, uses, and protects the personal data of users ("you") of the Secret Followers service available at secretfollowers.com (the "Service").
Depending on how you use the Service, we collect:
| Data | When | Why |
|---|---|---|
| IP address (as a salted, non-reversible hash) | Free preview search | Rate-limit searches per period, prevent abuse |
| Email address | Account creation, checkout, sign-in code | Authentication, billing, service communications |
| Stripe billing identifiers (customer, subscription, status, renewal date) | Subscribing to a plan | Managing your subscription and billing |
| Public Instagram handles searched or tracked | Searching for or adding a public account | Providing previews, story features, and tracking |
| Temporary active-story metadata and media CDN URLs | Loading story previews, viewing, or downloads | Caching and delivering the requested story feature |
| Analytics interaction data, including page views, custom events, and the searched public handle sent with story preview and paywall CTA events | Using the website and story viewer | Understanding feature use and improving the Service |
| Notification preferences (channel, override email or phone number) | Configuring notifications | Sending you the alerts you asked for |
| Phone number (international format) | If you opt in to WhatsApp notifications | Sending WhatsApp alerts (feature being rolled out) |
| Notification history (content, delivery status) | Sending notifications | Delivery tracking, support, abuse prevention |
| One-time report data (public Instagram profile lists) | Buying an instant report | Preparing and delivering the report by email and secure link |
We never collect or store any card details; this information is handled directly by our payment processor, Stripe.
We never ask for your Instagram password and never request access to your Instagram account: the Service only reads publicly available data of Instagram accounts, through third-party technical providers.
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service, account management, authentication | Performance of a contract (Art. 6.1.b) |
| Billing and subscription management | Performance of a contract / legal obligation (Art. 6.1.b and 6.1.c) |
| Sending notifications (email, WhatsApp) | Performance of a contract, and explicit consent for WhatsApp (Art. 6.1.b and 6.1.a) |
| Rate-limiting free searches, abuse prevention | Legitimate interest (Art. 6.1.f) |
| Providing free previews and paid story viewing or downloads | Performance of a contract for paid features and legitimate interest for free previews (Art. 6.1.b and 6.1.f) |
| Measuring usage through Vercel Analytics and custom events, and improving and securing the Service | Legitimate interest (Art. 6.1.f) |
| Complying with legal and accounting obligations | Legal obligation (Art. 6.1.c) |
We do not sell or rent your personal data. It may be shared with the following processors, strictly to the extent necessary to operate the Service:
Some of these providers are located outside the European Economic Area (notably in the United States). Where that is the case, the transfer relies on appropriate safeguards required by the GDPR (standard contractual clauses, an adequacy decision, or an equivalent mechanism offered by the provider).
Your data may also be disclosed to competent authorities where required by law.
We implement reasonable technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure, such as encryption in transit (HTTPS), database-level access controls (Row Level Security), and salted hashing of IP addresses used for rate-limiting. No system is completely secure, so we cannot guarantee absolute security.
Under the GDPR, you have the right to:
To exercise these rights, contact us at the address in Section 11 below. We will respond within one month, which may be extended by a further two months for complex requests.
The Service is not intended for anyone under 16 years old. If you believe a minor has provided us with personal data without the required consent, please contact us so we can delete it.
The Service displays public information about Instagram accounts, including accounts belonging to people who are not themselves users of the Service. This information (username, profile picture, verification status, follower/following counts) comes exclusively from data made public by its owners on Instagram, obtained through our third-party data providers.
Anyone who owns a public Instagram account displayed by the Service can contact us at the address in Section 11 to exercise their GDPR rights over the data about them shown by the Service, including a right to object.
We may update this Privacy Policy at any time to reflect changes to the Service, our providers, or applicable law. The last updated date appears at the top of this page. In case of a material change, Users will be notified by email.
For any question about this policy or to exercise your rights, contact us at contact@secretfollowers.com.
See also our Terms of Service.