Last updated: 21 October 2026
This policy explains what personal data Social Checkup collects, why, who it’s shared with and the choices you have. It covers people who use our website and Chrome extension, and the people whose public Instagram profiles our reports are about.
Contact us about anything in this policy at [email protected].
The short version
- We collect what we need to run your account and reports, take payments and keep the Service secure.
- We never ask for your Instagram password or access any Instagram account.
- Reports use only information that is public on Instagram.
- We don’t sell personal data or use it for advertising.
- Analytics cookies are only set if you accept them.
- You can ask for a copy of your data, a correction, or deletion at any time.
1. If you have an account
| What we collect | Why | Legal basis |
|---|---|---|
| Email address, password (stored only in scrambled, hashed form) and your name if you give one | To create and secure your account, let you log in and send receipts and important notices | Contract |
| Your plan, daily usage counts and the profiles you check while signed in (“Your Reports”), with the report data from your latest check | To provide reports, apply plan limits and keep your report history | Contract |
| Browsers connected to the extension (a label such as “Chrome on Windows”, when it was connected and last used, and a sign-in token stored only in hashed form) | To keep the extension signed in and let you sign browsers out | Contract |
| Purchases and subscription status: Stripe customer and subscription references, the profile a report was bought for, amount, date and your confirmation that you wanted immediate delivery | To provide what you bought, handle cancellations and refunds, and keep accounting records | Contract; legal obligation (tax records) |
| Emails you send us | To answer you | Legitimate interests (helping you); contract where it’s about your account |
Card details are entered on Stripe’s secure page and processed by Stripe. We never see or store your full card number.
2. When you visit the website or use the extension
- Security and fair use. We use your IP address to apply limits (for example, free audits per day and login attempts) and to block abuse. For limits, we store a scrambled (hashed) form of your IP address for no more than two days. Our hosting provider and Cloudflare, which protects the site, also process IP addresses and technical details such as your browser type in their logs. Legal basis: legitimate interests in keeping the Service secure and available.
- Bot checks. Log-in and sign-up forms use Cloudflare Turnstile, which looks at technical signals from your browser to tell people from bots. Legal basis: legitimate interests (security).
- Free audits. When you run a free audit without an account, we process the Instagram username you enter and your hashed IP address (for the daily limit).
- The Chrome extension stores your sign-in token, display settings and the card’s position in your browser. It reads the address of the Instagram page you’re on to recognise profiles, but only sends a profile’s username to us when you open the card, and, if we don’t have the profile’s picture, the address of the picture Instagram is showing. It does not collect your browsing history or anything from other websites.
3. Cookies and analytics
| Cookie | Purpose | Needs your consent? |
|---|---|---|
| WordPress login cookies (wordpress_logged_in_…, wordpress_sec_…) | Keep you logged in | No (essential) |
| sc_consent | Remembers your cookie choice (180 days) | No (essential) |
| igm_auth_challenge | Links the extension’s sign-in to your browser (15 minutes) | No (essential) |
| Cloudflare security cookies (such as __cf_bm) | Protect the site from bots and attacks | No (essential) |
| _ga, _ga_… (Google Analytics) | Measure how the site is used, so we can improve it | Yes |
Google Analytics only runs if you click Accept on our cookie banner. We use it with advertising features and Google signals switched off. If you’re logged in, we send Google a scrambled identifier instead of your account details, so your visits can be counted together; we never send your name, email address or the Instagram usernames you look up. You can change your choice at any time with “Cookie settings” at the bottom of every page.
If you decline, or haven’t chosen yet, no analytics cookies are set. We still count key actions such as sign-ups, reports and purchases, but anonymously: from our server, with an identifier that is scrambled and changes every day, so it can’t be used to follow you over time or identify you. Legal basis: legitimate interests in understanding, in aggregate, how the Service is used.
4. If our reports are about your Instagram account
If you have a public Instagram profile, someone may have checked it with Social Checkup. We want to be open about what that means.
- What we process: information that is public on your profile, namely your username, name, profile picture, bio, links, category and any contact details you’ve published there, your follower and following counts, and your recent public posts (the type of post, when it was posted, likes, comments, views, the start of the caption, hashtags, accounts you’ve tagged or mentioned and tagged locations). From this we calculate estimates such as an engagement grade, rate ranges and a bot-risk score.
- Where it comes from: your public Instagram profile, collected for us by our data provider, Apify, without logging in to Instagram. We don’t access anything that isn’t public.
- Why, and our legal basis: legitimate interests: ours in providing the Service, and our users’ in assessing public accounts before working with them (for example, before a brand partnership). We’ve weighed this against your interests: we use only information you’ve chosen to make public, mostly on accounts used for public or commercial purposes, we don’t contact you or act on your account, and you can object at any time.
- Automated estimates: grades, rates and bot-risk scores are calculated automatically. They’re estimates for our users to consider, not decisions about you with legal or similarly significant effects.
- How long we keep it: collected profile data is kept for up to 24 hours to avoid collecting it repeatedly. A copy is kept in the account of each user who checked your profile, as part of their report history, until they remove it or delete their account, and as a fixed snapshot if they bought a full report. A small copy of your profile picture is kept for 30 days, or for as long as a user’s report includes your profile.
- Your choices: you can ask us what we hold about your account, ask us to correct or delete it, or object to us processing it, by emailing [email protected] with your username. To make sure the request really comes from the account’s owner, we may ask you to send us a direct message from it. Making your account private stops us collecting your posts.
5. Who we share data with
We don’t sell personal data. We share it only with service providers who help us run Social Checkup, under contracts that require them to protect it and use it only on our instructions:
- Simply.com (Denmark): hosts our website and database.
- Cloudflare (United States): protects and speeds up the website, and provides the Turnstile bot check.
- Stripe (Ireland): processes payments, subscriptions, receipts and invoices.
- Apify (Czech Republic): collects public Instagram profile data for our reports.
- Google (Ireland/United States): Google Analytics, only if you accept analytics cookies.
- Our email provider, for emails you send us and our replies.
We may also disclose data if the law requires it, or to protect our rights or someone’s safety.
Transfers outside the EU. Some providers, such as Cloudflare and Google, may process data in the United States. Where that happens, transfers are protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
6. How long we keep data
- Your account and report history: until you delete reports or ask us to delete your account. Deleting your account removes your profile, report history, connected browsers and purchases from our systems.
- Payment and invoice records: 6 years, as Irish tax law requires (kept by Stripe and in our accounts), even after you delete your account.
- Usage counts and hashed IP addresses for limits: up to 2 days.
- Google Analytics data (only if you accepted): no more than 14 months.
- Emails to us: as long as needed to deal with your request, and then no longer than 2 years.
7. Your rights
Under the GDPR you can ask us to:
- give you a copy of your personal data;
- correct data that’s wrong;
- delete your data;
- restrict how we use it, or object to us using it (including when we rely on legitimate interests);
- give you your data in a portable format;
- withdraw your consent to analytics at any time (use “Cookie settings” in the footer).
Email [email protected]. We’ll reply within one month. We may need to confirm your identity first. You can correct your name and change your password yourself in your account, and remove reports from Your Reports at any time.
If you’re unhappy with how we’ve handled your data, please tell us so we can put it right. You also have the right to complain to the Data Protection Commission in Ireland (www.dataprotection.ie) or the data protection authority where you live.
8. Security
We protect data with encrypted connections (HTTPS), hashed passwords and sign-in tokens, limits on login attempts, bot checks, and access restricted to those who need it. No system is perfectly secure, but if a breach affects your data and puts you at risk, we’ll tell you and the authorities as the law requires.
9. Children
Social Checkup is for adults: you must be 18 or over to create an account. We don’t knowingly collect data from children. If you think a child has given us their details, contact us and we’ll delete them.
10. Changes to this policy
We’ll update this policy when the Service or the law changes, and show the date of the latest version at the top. For important changes, we’ll also email account holders.