Creator data notice

vfrey's Research plan lets customers find and study public accounts ("creators") on TikTok, Instagram and YouTube. If you run one of those accounts, this page explains what we hold about you, why, and how to have it removed.

Controller: {{LEGAL_ENTITY}} (ABN {{ABN}}), {{POSTAL_ADDRESS}}. Contact: privacy@vfrey.ai.

Only information you made public on your own profile, obtained from licensed data providers and the YouTube Data API. We do not scrape the platforms ourselves.

• platform, account id and handle, display name, and whether the account is verified;
• follower and following counts, total likes and number of posts;
• your public bio text;
• for each recent public post: its link, caption, hashtags, sound name, posting time and public counts (views, likes, comments, shares);
• a business contact (an email address or link) only when your bio presents it as one, for example with words like "business", "collab", "contact" or "inquiries". Nothing else is extracted from the bio. We never store phone numbers.

We do not collect private messages, private accounts, follower lists or precise location. We do not collect or infer special-category data on purpose.

So that customers can discover creators in a niche and study what they publish: formats, posting rhythm and public performance. Our basis is legitimate interests (Article 6(1)(f) GDPR). The information is already public, and creators who publish for an audience can reasonably expect it to be analysed. The results of our balancing test are below.

[LAWYER: the legitimate-interest assessment (purpose, necessity, balancing against creators' interests, safeguards) is not yet complete. Insert its result and conclusion here.]

We do not use it to contact creators. Customers can use the Mail add-on to write to a business contact they find, and they, not vfrey, are responsible for the lawfulness of that message (see the Terms).

Customers of the Research plan, through search, profile and watchlist features. A customer can export one of their own watchlists (at most 500 creators, rate-limited). There is no bulk export of the index. CSV exports are escaped so a bio cannot run as a spreadsheet formula.

Our data providers (ScrapeCreators and EnsembleData) and Google (the YouTube Data API) supply the data and, for the queries we send, receive our requests. Their role under data protection law, as processor or as independent controller, is set out in our agreements with them. [LAWYER: confirm the role of each provider and whether our agreements with them permit the use of profile data and its resale to customers.]

Our hosting providers see the data as processors. See Subprocessors.

A creator profile that no customer watches and nobody has opened for 90 days is deleted automatically each day, with its posts and its history. For YouTube accounts, the limit is 30 days since the last refresh, as the YouTube API Services policies require.

Creators on a customer's watchlist are refreshed daily and kept while they stay on a watchlist. Profile history (follower counts over time) is deleted with the profile. Cached posts used for topic research are deleted after 30 days.

In Sydney, Australia, on our hosting and database (Vercel and Supabase). Providers outside Australia, the EEA and the UK that receive requests are listed on the Subprocessors page. We transfer personal data under the Standard Contractual Clauses and, for the UK, the UK addendum, as described in our Privacy Policy. The creator tables are reachable only through our server. Database access for the public API roles is revoked.

We got this information from public sources, not from you. Article 14 of the GDPR normally requires us to tell you directly. We rely on the exception for cases where doing so would be impossible or would take disproportionate effort, and we publish this notice instead. [LAWYER: confirm that the Article 14(5)(b) exemption applies, and for the UK and Australia, the equivalent position under the UK GDPR and APP 5.]

You can ask us to tell you what we hold about you, correct it, delete it, restrict it, or object to our using it. We answer within 30 days (45 days for California requests).

To have your profile removed and not collected again, use the removal form. Give your platform, your handle and an email address we can confirm from. We email a confirmation link to that address. When you open it and confirm, we delete everything stored about the account, and add it to a suppression list so no later collection, discovery or refresh includes it.

We keep the platform and handle on the suppression list for that purpose only. The email address is used only to confirm the request and is deleted afterwards.

You can also write to privacy@vfrey.ai. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner, your local EU data protection authority, the UK Information Commissioner's Office, or the California Attorney General. We do not sell or share creators' personal information.

• Every way of collecting a profile checks the suppression list before it calls a provider, and again before it writes a refresh.
• Only the fields listed above are stored. Everything else in a bio is dropped.
• The email address on a removal request is deleted when the request is done.

See also the Privacy Policy.