1. Data controller
The data controller responsible for your personal data under this policy is:
Andrei Călugăr
Cluj-Napoca, Romania
Email: andrei.nicolae.calugar@gmail.com
Social Growth is operated as a sole proprietorship by the data controller named above. All questions about your data should be sent to that email.
2. Data we collect
We collect only the data we need to run the service:
- Account data: your email address, your name (optional), and a hashed password. We never store your password in plaintext.
- Instagram public data: public information about the Instagram profiles you ask us to analyze — posts, captions, like counts, comment counts, posting timestamps, and the public profile metadata. We do not access DMs, stories, or any authenticated-only data.
- Product analytics: anonymized usage data (pages visited, actions taken) used to understand and improve the product.
We do not ask for your Instagram password. We do not access your Instagram account on your behalf.
3. How we use it
We use your data only for the purposes you would expect:
- To create and run your Social Growth account.
- To scrape and analyze the Instagram profiles you add to your workspace, and to generate content recommendations.
- To send service emails (e.g. password resets, important changes).
- To understand product usage and fix bugs.
We do not sell your data. We do not share it with advertisers.
4. Third-party processors
We use a small number of third-party processors to run the service. Each one only receives the minimum data it needs to do its job:
- Supabase — PostgreSQL database hosting (EU region). Stores your account data and the scraped Instagram data.
- Vercel — application hosting (EU region). Serves the web app and handles request logs.
- Apify — Instagram public-data scraping. Receives the usernames you ask us to analyze.
- Anthropic (Claude API) — AI analysis of the scraped posts. Receives caption text and aggregate metrics, never your account credentials.
- Google Analytics (GA4) — anonymized website analytics. Only loads if you accept analytics cookies.
5. Data retention
We keep your data for as long as your account is active. If you delete your account, we permanently delete your personal data (account record, profiles you added, scraped posts, generated insights) within 30 days.
Some data may be retained beyond that period only where required by law (for example, to comply with tax record-keeping).
6. Your GDPR rights
Because we're an EU operator, every user — wherever you live — gets the full set of GDPR rights:
- Access — request a copy of the personal data we hold about you.
- Rectification— ask us to correct anything that's wrong.
- Erasure— ask us to delete your data (the "right to be forgotten").
- Portability — get a machine-readable copy of your data to take elsewhere.
- Restriction — ask us to stop processing your data in certain situations.
- Objection — object to processing based on our legitimate interests.
You can also lodge a complaint with your local data protection authority. In Romania that's the ANSPDCP.
7. Exercising your rights
You can exercise any of these rights in two ways:
- Email andrei.nicolae.calugar@gmail.com from the address on your account.
- Delete your account directly from Settings — this triggers full erasure within 30 days.
We'll respond to all requests within 30 days. There's no fee for reasonable requests.
9. Changes to this policy
If we change this policy in a way that materially affects you, we'll email you and update the "Last updated" date above. Minor clarifications won't trigger a notification.