Privacy Policy
Last updated: September 27, 2026
In short: we collect only what we need to run your account and produce audits. We never ask for social media passwords, never sell personal data, and analytics cookies load only if you allow them. Audits use only publicly available profile information.
1. Who is responsible
The controller of your personal data is Sixpack dizajn studio, CHANGE_ME street and number, 11000 Belgrade, Serbia. Privacy questions and requests: privacy@socialscan.net.
We process personal data in line with the EU General Data Protection Regulation (GDPR), the UK GDPR and the Serbian Law on Personal Data Protection, as applicable.
2. What we collect
Account data
Your email address; if you sign in with Google, also your name, Google account ID and profile picture URL. We record when you accepted our Terms (and which version), when your account was created and when you last signed in.
Audit data
The profiles you ask us to audit, the optional niche and goal you enter, and the resulting report (collected public data, calculated metrics and AI analysis). Whether a report has a public share link.
Billing data
Payments are handled by Paddle.com as Merchant of Record. Paddle collects your payment details; we never see or store card numbers. We receive and store the transaction ID, the pack purchased, the amount, currency and status, and keep a record of your credit balance changes.
Technical and security data
A session cookie to keep you signed in; a keyed one-way hash of your IP address (never the raw IP) for rate limiting, sign-in link security and consent records; your browser's user-agent string with consent records; and error logs that don't contain report contents. To prevent abuse of the free audit, we keep a keyed one-way hash of your normalized email address, even after account deletion.
Cookie consent
Your cookie choice, a random consent ID and the policy version, so we can prove and respect your choice. See the Cookie Policy.
Analytics (only with consent)
If you accept analytics cookies and analytics is enabled, Google Analytics 4 collects pseudonymous usage data (pages viewed, device and approximate location) on our behalf.
3. Data about the profiles being audited
When a user requests an audit, we collect information that the profile's owner has made publicly available: username, display name, bio, link in bio, follower/following/post counts, business category, and up to 20 recent public posts with their captions, hashtags, dates and like/comment/view counts. We don't collect private profiles, direct messages, stories, or information about followers.
We process this under our and our users' legitimate interest in analyzing public professional and marketing presence on social media (GDPR Art. 6(1)(f)). The data is stored only inside the requesting user's report. If you are the owner of an audited profile and want to object or request deletion, email privacy@socialscan.net with the username — we'll delete reports about your profile and can block future audits of it.
4. Why we use data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, sign-in, producing and storing your reports | Performance of our contract with you |
| Selling credits, keeping your balance, handling refunds | Contract; legal obligations (accounting, tax) |
| Security, fraud and abuse prevention (rate limits, free-credit abuse, logs) | Legitimate interests |
| Service emails (sign-in links, "report ready" notices) | Contract |
| Analytics cookies | Your consent, which you can withdraw anytime |
| Recording your cookie choice | Legal obligation (demonstrating consent) |
We don't use your data for automated decisions with legal or similarly significant effects, and we don't sell or rent personal data.
5. Who we share data with
| Recipient | Role | What |
|---|---|---|
| Our web hosting provider | Processor | All data stored by the Service |
| Apify Technologies s.r.o. (Czech Republic, with infrastructure in the US) | Processor | The username to audit; returns the public profile data |
| Anthropic, PBC (USA) | Processor | Public profile data, calculated metrics, niche and goal — to generate the analysis. Under Anthropic's commercial terms, API data isn't used to train models. |
| Paddle.com Market Ltd (UK) and affiliates | Independent controller (Merchant of Record) | Checkout and payment data; your email and user ID to link the purchase |
| Google LLC / Google Ireland | Sign-in provider; processor for analytics | Only if you use Google sign-in, or consent to analytics |
| Our email provider | Processor | Your email address and the messages we send you |
We may also disclose data where required by law or to protect our rights, or to a successor if the business is transferred (with notice to you).
6. International transfers
Some recipients are located outside the EEA, the UK and Serbia (notably in the United States). Where required, transfers are protected by an adequacy decision (such as the EU–US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses.
7. How long we keep data
- Account data and finished reports: until you delete them or your account.
- Failed audits: deleted automatically after 30 days.
- Sign-in links: expire after 20 minutes and are deleted within a day.
- Payment records: as long as accounting and tax law requires (typically up to 10 years), even after account deletion, without your report data.
- Consent records: for as long as needed to demonstrate consent, up to 3 years after your last choice.
- Free-audit abuse hash: indefinitely (it cannot be reversed into your email address).
- Error logs: rolling, typically a few weeks.
8. Your rights
You have the right to access, correct, delete, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time (without affecting prior processing). You can:
- download your data yourself in Account settings (Export my data);
- delete your account and reports yourself in Account settings;
- change cookie choices via "Cookie settings" in the footer;
- email privacy@socialscan.net for anything else — we reply within one month.
You also have the right to lodge a complaint with a supervisory authority — in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs), or the data protection authority in your EU/EEA country or the UK.
9. Security
We use HTTPS everywhere, store only hashes of sign-in tokens and IP addresses, keep secrets and logs outside the public web directory, and restrict administrative access. No system is perfectly secure; if a breach affects your data, we'll notify you and the authorities as required by law.
10. Children
The Service is not intended for anyone under 16, and we don't knowingly collect their personal data.
11. Changes
We'll post updates here and change the date at the top. For material changes we'll notify registered users by email or in the app.
12. Contact
Sixpack dizajn studio · CHANGE_ME street and number, 11000 Belgrade, Serbia · privacy@socialscan.net