SocialAuditor Privacy Policy
1. Data controller and scope
Ailo sp. z o.o., os. Parkowe Wzgórze 100, 32-031 Mogilany, Poland, company registration number (KRS) 0000368886, tax identification number (NIP) 6762430848, is the data controller. For privacy matters, email support@socialauditor.io or write to the company's address.
This policy covers socialauditor.io, the dashboard at dashboard.socialauditor.io, payments, reports and sharing links. It applies to visitors, account users and people who contact us, as well as creators, commenters and followers whose data appears in material used for an audit.
See section 7 for technologies that may load when you visit the older SocialAuditor dashboard.
2. Data about visitors, customers and people who contact us
| What we do and what data we use | Legal basis |
|---|---|
| We create and manage accounts. We use your email address, account ID, password hash, verification status, language, session data and metadata for account verification and password reset emails. | Performance of a contract or steps at your request before entering into one (Article 6(1)(b) GDPR). When you act for an organisation that is our customer, we have a legitimate interest in administering that contract and providing access to authorised people (Article 6(1)(f)). |
| We fulfil orders. We use account and transaction data, the amount and currency, payment status, order and subscription IDs, and credit history. We process the details needed for sales documents and accounting. | Performance of a contract (Article 6(1)(b)), administration of a contract with an organisation (Article 6(1)(f)), and compliance with tax and accounting obligations (Article 6(1)(c)). |
| We prepare and deliver reports. We process details of the public profile or post you select, what you ordered and the results. If you use additional features, we also process information you enter in a brief, notes added to a sharing link, and the agency name and logo. | Performance of a contract with the user (Article 6(1)(b)) or administration of a contract with an organisation (Article 6(1)(f)). Section 3 describes the legal basis for processing data about people included in audits. |
| We respond to messages, complaints and other requests. We process your contact address, correspondence and information needed to deal with the matter. | Performance of a contract (Article 6(1)(b)), compliance with legal obligations including handling GDPR requests (Article 6(1)(c)), and our legitimate interests in responding and establishing, exercising or defending legal claims (Article 6(1)(f)). |
| We secure the service and troubleshoot problems. We use information including IP addresses, request dates and types, session data and technical logs. Some measures to prevent abuse use a hash of an IP or email address. | Our legitimate interests in securing the service, keeping it available and detecting abuse (Article 6(1)(f)). |
| We measure use of the audit form and whether people use the service after signing up. We count views. A signup event includes a hash of the internal account ID that we can match to email verification, credit purchases and requests for a first audit within seven days. | Our legitimate interest in assessing and improving the signup flow (Article 6(1)(f)). |
We need account details to set up your account and give you access to the dashboard. We need order and payment information to complete a purchase. To request an audit, you must provide the link or ID of the profile or post to be analysed. The other data you provide depends on the features you choose. If you used an earlier version of the service, we also process migrated account data, previously paid entitlements and report history to preserve access and ensure continuity in billing. Please only enter information needed for the analysis in briefs or notes.
3. Data about creators, commenters and followers
We prepare reports using publicly available material from supported platforms, including Instagram and, where the feature is available, TikTok. We also use results from data providers that analyse these materials. Depending on the report, we use:
- the public profile name, ID, biography and photo, as well as follower and post counts
- public posts or Reels, including their IDs, links, captions, dates, thumbnails and available metrics
- samples of public comments, including their text, dates, reactions and IDs, and author IDs in source data where available
- results from the analysis of a follower sample, such as aggregate estimates for age, gender, language and interests, and signals about audience quality
- later measurements and audit results for reports that include updates
We prepare reports so customers can research public profiles and make their own decisions about potential collaborations. We publish selected reports as examples of the service. The site may also show archived profile pages. We rely on our legitimate interest in providing reports and our customers’ interest in evaluating potential partnerships (Article 6(1)(f) GDPR). For public material, our interest is in documenting published measurements or demonstrating how our service works (Article 6(1)(f)). You can object to processing for a specific purpose using the contact details in section 8.
Where enough data is available, a report may include the SocialAuditor Score. The calculation uses engagement rate, signals from a follower sample and the diversity of comment text. The score and other estimates reflect analysis of the available samples. The score cannot establish that followers were purchased or that a particular interaction is authentic. We calculate metrics and estimates automatically. SocialAuditor provides the report, and the customer decides whether to collaborate. Our methodology explains how we calculate the metrics.
4. Who receives data
Authorised people and service providers use the data needed to deliver our services. These include providers of infrastructure and site protection (Railway and Cloudflare), transactional email (Resend), payments (Stripe), and collection of public data (Apify, depending on the analysis). We also obtain profile and audience analysis through the Display Purposes API.
When you make a payment, you go to Stripe's checkout form. We receive information needed to process your order, including payment status and IDs. You enter full card details directly in the payment provider's form. Stripe may also process data for its own purposes, described in its privacy policy.
The customer who requested an audit receives the results. If a customer creates a link to a report or comparison, anyone with that link can open the shared view without signing in to the customer's account. A report may contain public posts and a sample of comments. Links expire and can be revoked. We record details of link use, such as the number of views and the time of the last view. A recipient may keep a copy they downloaded or forwarded even after the link is revoked. Materials marked as examples and public catalogue pages may be visible to any visitor.
We may share data with authorised authorities as required by law and with people who help us with accounting or claims when necessary.
5. Transfers outside the EEA
We host the production SocialAuditor application, databases and file storage in Amsterdam, the Netherlands. Some services, including Resend transactional email and the Apify data collection platform, process data in the United States. Data relating to payments, website delivery and protection, and infrastructure operations may also be processed in the United States.
Providers’ public terms include the European Commission’s adequacy decision for organisations covered by the EU–US Data Privacy Framework and standard contractual clauses. Resend’s terms describe transfers to the United States under the DPF or standard contractual clauses. Apify’s DPA describes safeguards for onward transfers, including standard contractual clauses where required. Stripe and Cloudflare describe use of the DPF for transfers it covers and clauses for other transfers that require these safeguards.
To ask about a transfer or request a copy of the relevant safeguards, email support@socialauditor.io.
6. How long we keep data
| Type of data | Retention period or criteria |
|---|---|
| Account and service history | While the account is open. After account closure, we keep the data needed to settle purchased entitlements, finish dealing with requests, or establish and defend claims until settlement, closure of the case or the end of the applicable limitation period. Accounting records follow separate rules. |
| Payments and sales records | For the period required by tax and accounting law. We keep the data needed to establish, exercise or defend claims until the applicable limitation period expires, or until an ongoing dispute ends if necessary. |
| Reports, revisions, raw provider results, images and public materials | We remove copies of profile photos and thumbnails in a cleanup cycle after 180 days from capture. Profile audit reports covered by the current Terms can be accessed for 24 months from delivery of the relevant report, including one delivered as a paid update, while the account is open. Earlier purchases keep their original access terms. We remove new raw source copies in a cleanup cycle after 30 days from storage, unless the audit or related settlement is still pending. For claims, we retain only the evidence needed for the case separately. |
| Messages, requests, logs, analytics data, sharing-link records and backups | We keep correspondence while we deal with the request. Records necessary to document our response or defend claims may be kept until the applicable legal period expires. Access via a link ends at expiry or revocation. Standard Railway logs are available for 30 days. Backups are kept separately with restricted access for as long as needed to restore the system or to retain a specific record for a legal obligation or dispute. |
7. Cookies and browser storage
| Item | Purpose and duration |
|---|---|
sa_session |
Keeps you signed in to the dashboard for up to 7 days or until you log out. |
sa_csrf |
Protects forms and account actions for up to 1 hour. |
sa_locale |
Remembers your language preference for up to one year. |
| Browser local storage and session storage | Keep your selected profile, information needed to return from checkout and a payment attempt ID. We use the audit context for up to 2 hours. An entry in session storage can survive a page reload in the same tab session. |
ref_code and auditor-uid |
In the legacy referral flow, a code identifies the referral and an identifier helps connect the visit to a browser. The server for this flow also records the IP address and visit time. The code lasts for 180 days. The identifier set by the older service may remain for longer, subject to your browser settings and limits. |
| YouTube | We embed the YouTube player on selected interview pages. Your browser connects to Google's service when the player loads. Google may process browser information such as the IP address and playback data as described in its privacy policy. |
You can delete browser storage and manage it in your browser settings. Blocking storage required for signing in or using forms may prevent you from using the dashboard. The older dashboard may also load Google Tag Manager and Meta Pixel in connection with site and advertising measurements. You can clear stored information in your browser settings.
8. Your rights
You can access and obtain a copy of your data and request rectification, erasure or restriction of processing. Our support team receives requests and objections. You can also request portability of the data you provided if we process it by automated means based on a contract or your consent. If we rely on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before you withdrew consent.
You have the right to object to processing based on legitimate interests on grounds relating to your particular situation. We will stop processing unless we can demonstrate compelling overriding grounds or the processing is necessary to establish, exercise or defend legal claims. You can object to direct marketing at any time.
Email us at support@socialauditor.io. If your request concerns data from a social media platform, please provide the platform, profile name and what you are requesting. If we have reasonable doubts about your identity, we may ask for information needed to confirm it. We respond without undue delay and within one month at the latest. If we need more time, we will tell you why and give you a new deadline within that month, in accordance with the GDPR.
You can lodge a complaint with the President of the Polish Personal Data Protection Office or the relevant data protection authority.
9. Updates to this policy
The current version of this policy is available on the SocialAuditor website. We notify the people affected of material changes. Where required by law, we provide information about a new purpose before using personal data for that purpose.
Effective from 14 November 2026.