Privacy Policy

1. Controller and contact details

The controller is Alessandro Bortoluzzi, Via Castello 35, Alpago, Belluno.

• Privacy questions and data subject requests: privacy@supersnitch.app
• General support: support@supersnitch.app

We have not designated a data protection officer (DPO), as none of the cases where one is mandatory apply. For any question you can use the contacts above.

2. User data we process

• Searches and preview: the Instagram username you enter for the free preview. No account is needed for the preview.
• Account: email address and password (kept by our authentication provider only in hashed form), creation date, sign-in session data.
• Subscription: from Stripe/Link notifications we receive customer, subscription and checkout session identifiers, the email used for the purchase, plan, subscription status and renewal date. We do not receive your full card or other payment method details.
• Use of the service: the profiles you choose to monitor (up to 3 per subscription) and related settings.
• Technical data: IP address, browser type and language, date and time of requests, recorded in the technical logs of our hosting and authentication providers. We use the country derived from your IP address and your browser language only to show you the site in Italian or English.
• Communications: messages you send us and our replies.

3. Purposes and legal bases (users)

• Showing you the free preview you request, creating and managing your account, linking it to your subscription and providing the service: performance of a contract or of pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Answering your support requests: performance of the contract or our legitimate interest in answering (Art. 6(1)(b) and (f)).
• Complying with legal obligations, such as tax and accounting rules, or requests from authorities: legal obligation (Art. 6(1)(c)).
• Protecting the service, preventing abuse and prohibited uses (such as stalking), and establishing or defending our rights: our legitimate interest (Art. 6(1)(f)).

Providing account data is necessary to use the paid service: without it we cannot provide it. We don’t use your data for advertising, we don’t sell it, and we don’t make decisions based solely on automated processing that produce legal or similarly significant effects on you.

4. Data about Instagram profile owners (Art. 14 GDPR)

What data. We only process data that is publicly visible on Instagram:

• for profiles looked up or monitored: username, numeric profile ID, display name, profile picture (or its address), bio, follower and following counts, whether the profile is private or verified, and the history of those counts;
• for monitored public profiles, also the list of accounts they follow and follow/unfollow events, with the time we detected them;
• for accounts appearing in those lists: username, ID, display name, profile picture address, whether the account is private or verified.

For private profiles we only collect the public profile data, never the lists. We don’t collect posts, stories, messages, private content or special categories of data, and we don’t try to infer sensitive information from the lists.

Where it comes from. From publicly accessible Instagram pages, through our data-collection provider (section 8). We don’t use Instagram accounts, don’t log in and don’t interact with profiles.

Why and on what legal basis. To provide users with the preview and the tracking of public changes described in the Terms, based on our and our users’ legitimate interest (Art. 6(1)(f) GDPR) in offering and using a tool to analyze public information, for example for creators, brands, fans and market or competitor research.

Balancing test. We have assessed that this interest does not override your rights and freedoms, thanks to these safeguards:

• we only process data you have made visible to anyone by choosing a public profile, and only a limited set of it;
• we don’t process sensitive data, private content or data of private profiles beyond their public counts;
• we don’t contact you, don’t interact with your profile and don’t publish the data: it is only visible to the users who look up or monitor the profile;
• each subscription can monitor at most 3 profiles, and the Terms prohibit stalking or harassment, monitoring minors and sharing or reselling the data, with suspension of accounts that break these rules;
• we keep data for limited periods (section 10);
• you can object at any time, easily, and have your profile excluded (section 6).

Recipients. The users who look up or monitor the profile, our providers (section 8) and, where required by law, public authorities.

Notice. We don’t notify you individually, because to do so we would have to contact you through Instagram or collect more of your data: that would involve disproportionate effort and be more intrusive (Art. 14(5)(b) GDPR). That is why we make this policy publicly available.

5. What we don’t do

• We don’t ask for or use Instagram credentials and we don’t log in to Instagram with an account.
• We don’t access private profiles, messages, stories or other non-public content.
• We don’t sell personal data or use it for advertising.
• We don’t use profiling, advertising or analytics cookies.

6. Excluding your profile (opt-out)

If you own a public Instagram profile and don’t want it to be looked up or monitored through supersnitch, write to privacy@supersnitch.app with the username. To prevent requests from third parties, we may ask you to show that the profile is yours, for example by temporarily adding a code to your bio or by writing to us from a contact linked to the profile.

Once the request is verified, free of charge:

• we stop monitoring the profile for all users;
• we delete the data we hold about the profile (profile data, lists, events and count history);
• we add the username to an exclusion list, so that it can no longer be looked up or monitored in the future. We keep only the username on this list, until you ask us to remove it, because it is the only way to keep honoring your request over time.

If you only appear in the list of accounts followed by a monitored profile, you can still object: we will delete or anonymize the data about you in the lists and events we keep, as far as technically possible.

We reply within one month of your request (extendable by two months for complex cases, in which case we will let you know).

7. Payments: Stripe and Link

Payments are made through Stripe Managed Payments. The merchant of record for subscriptions is Sold through Link, LLC, a Stripe group company operating under the Link brand. Stripe and Link collect payment and billing data directly (for example name, email, billing address, payment method details) and process it as independent controllers to handle payments, taxes, receipts, refunds, disputes, fraud prevention and legal obligations, under their own privacy policies (stripe.com/privacy and link.com/privacy).

Stripe only shares with us the data needed to link the subscription to your account (section 2). Requests about data processed by Stripe and Link, including deletion of your Link account, should be sent to them directly; we can help you route them.

8. Providers and recipients

We use the following providers, which process data on our behalf as processors (Art. 28 GDPR) under data processing agreements:

• Supabase, Inc. (United States): database, authentication and account management, with data hosted in the EU region;
• Cloudflare, Inc. (United States): website hosting, content delivery network (CDN) and security;
• Apify Technologies s.r.o. (Czech Republic): collection of public Instagram profile data.

Data may also be shared with Stripe and Link as independent controllers (section 7), with professional advisers bound by confidentiality, and with public or judicial authorities where required by law.

9. Transfers outside the European Economic Area

Some providers or their sub-processors may process data outside the European Economic Area, in particular in the United States (for example for CDN infrastructure or for the cloud infrastructure used for data collection). In those cases transfers rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified companies, or on the standard contractual clauses approved by the European Commission (Art. 46 GDPR), with any supplementary measures needed. You can ask us for more information about the safeguards in place using the contacts in section 1.

10. How long we keep data

• Account data: for as long as the account exists; we delete it within 30 days of a request to delete the account.
• Subscription and billing data: for as long as tax and accounting laws require, up to 10 years (article 2220 of the Italian Civil Code). Most billing records are kept by Stripe/Link as independent controllers.
• Data about monitored profiles (profile data, lists, events, count history): for as long as at least one active subscription monitors the profile; we delete it within 30 days after monitoring ends.
• Data about profiles only looked up in a preview: results are cached for about 24 hours and the data is deleted within 30 days, if the profile is not monitored.
• Exclusion list: only the username, until the owner asks us to remove it (section 6).
• Technical logs: for a short period, unless they are needed for longer to investigate abuse or a security incident.
• Support communications: for as long as needed to handle the request and any later dispute.

We may keep some data longer only where necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

11. Cookies

We only use strictly necessary technical cookies, which under the applicable rules (article 122 of the Italian Privacy Code and the Italian Data Protection Authority’s cookie guidelines) do not require your consent:

• Supabase authentication cookies: keep you signed in after you log in; they are removed when you log out or when the session expires;
• ss_pending: a technical (httpOnly) cookie holding the Stripe Checkout Session ID, so that the purchase can be linked to your account; it lasts at most 7 days and is deleted once the purchase is linked.

We don’t use analytics, profiling or advertising cookies or third-party tracking tools. The site language is chosen from your IP address country and browser language, without a cookie. Checkout and subscription management pages are provided by Stripe and Link on their own domains and use their own cookies, under their own policies.

12. Security

We take appropriate technical and organizational measures to protect data, including encrypted connections (HTTPS), database access controls, access to data limited to those who need it, and passwords stored only in hashed form. No system is 100% secure: if a personal data breach poses a risk, we will notify the authority and, where required, the people affected.

13. Your rights

Whether you are a user or a profile owner, within the limits set by the GDPR you have the right to:

• access your data and receive a copy (Art. 15);
• have it rectified (Art. 16);
• have it erased (Art. 17);
• restrict processing (Art. 18);
• object at any time to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21): for profile owners, an objection leads to the exclusion described in section 6;
• receive the data you provided to us, processed on the basis of the contract, in a structured, machine-readable format (portability, Art. 20; applies to users).

To exercise them, write to privacy@supersnitch.app. We reply within one month, extendable by two months for complex cases. We may ask for information to verify your identity. To delete your account, write to support@supersnitch.app or privacy@supersnitch.app from the email address linked to it.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of the EU country where you live or work or where the alleged infringement took place.

14. Minors

The service is for adults only, and the Terms prohibit monitoring profiles of minors. We don’t knowingly collect data from minors as users. If you believe a minor’s profile is being monitored through supersnitch, write to privacy@supersnitch.app: we will exclude it and delete the related data.

15. Changes to this policy

We may update this policy, for example if the service, our providers or the law change. We will publish the new version on this page with the update date and, for material changes, notify users by email or in the service. This policy is available in Italian and English; in case of discrepancy the Italian version prevails.