Privacy Policy

GramScraper ("GramScraper", "we", "us" or "our"). This policy explains how we handle information about website visitors, customers, support contacts, and Instagram users or creators whose currently public information may be returned through the Service.

1. Scope and roles

This policy applies to gramscraper.com, the dashboard, the API and related support. For customer account and Service-operation data, GramScraper determines why and how information is handled. Customers independently determine the purpose and lawfulness of their downstream use of API results. Our role can depend on the use case and applicable law; this policy does not assign a legal role where the facts or law would require a different one.

2. Information we handle

Customer and visitor information

• Account details such as name, email address, authentication identifiers and optional Google sign-in information.
• Support messages, call-booking details and other information you choose to provide.
• Purchase, credit-allocation and transaction identifiers when paid purchases are available. Card details are handled by the payment provider shown at checkout and are not intended to be stored by GramScraper.
• Technical and usage records, including IP address, user agent, pages or endpoints used, query values, timestamps, response status and credit usage.
• Cookie and analytics information used to understand website and product use.

Public Instagram information

On a customer's request, the Service may return information from currently public Instagram pages and content: public profile identifiers and biography, profile and engagement metrics, posts, reels, captions, hashtags, locations, comments and related public content. Some of this information may relate to an identifiable person.

GramScraper does not offer private-account data, structured creator email or phone fields, contact enrichment, person-level follower/following lists, liker lists, similar-account lists or user-search lists. Customer account emails used for sign-in are separate from Instagram-data responses.

3. Sources

Customer information comes from you, your device, authentication providers, support interactions and transaction providers. Public Instagram information is requested through an authorized third-party API and corresponds to information made public on Instagram. See Data & Privacy for product-specific details.

4. Why we use information

• Provide authentication, API access, requested public-data responses, credit accounting, support and purchases.
• Secure the Service, detect fraud or abuse, enforce our Acceptable Use Policy, investigate errors and maintain reliability.
• Understand usage and improve product performance and documentation.
• Communicate service, security, support and transaction information; send optional promotional communications where permitted.
• Respond to data-subject requests, disputes and lawful requests, and protect rights and safety.

Depending on the context and applicable law, these activities may be necessary to provide a service requested by a customer, based on consent, needed to meet an obligation, or supported by a legitimate operational, security or public-content-analysis interest that must be balanced against individual rights. Public availability alone is not treated as unlimited permission for every downstream use.

5. Sharing and service providers

We share information only as needed to operate the Service, follow your direction, investigate misuse, complete a business transaction, protect rights and safety, or respond to a valid legal requirement. Current providers include Railway (hosting), Supabase (authentication and database), an authorized third-party API (public Instagram data delivery), Google (optional sign-in), PostHog and Google Analytics (product and website analytics), and the payment provider identified at checkout when payments are enabled. Providers operate under their own terms and roles.

Information may be processed in countries other than yours because these providers operate internationally. Laws and safeguards may differ by location. We do not claim a particular statutory transfer mechanism unless it actually applies to the relevant processing.

6. Retention, caching and refresh

Public Instagram responses are requested on demand and GramScraper does not currently maintain a separate application-level cache or standalone creator database for those responses. A new API request asks the upstream provider for the then-available public information. Restricted infrastructure logs may contain query details or short response previews created for troubleshooting.

Customer accounts, credit balances and transaction records remain while an account is active and afterward while needed for security, disputes and applicable recordkeeping. Search history remains until the customer clears it or requests deletion. Request and infrastructure logs currently have no fixed automatic deletion period and are retained while reasonably needed for operations, security, abuse prevention, support and usage accounting. This accurately describes the present system; we will update this policy before adopting a materially different schedule.

When a valid deletion or restriction request applies, we take reasonable steps in systems we control. We may retain limited records where needed for security, fraud prevention, disputes or legal obligations. Removing a GramScraper record does not remove the original public information from Instagram or an independent upstream provider.

7. Security

We use HTTPS in transit, authenticated accounts and API keys, access controls, database row-level controls, server-side credit enforcement, and monitoring intended to reduce unauthorized access and abuse. No service can guarantee absolute security. Report a suspected security issue to [email protected].

8. Your choices and requests

Depending on your location and circumstances, you may be able to request access, correction, deletion, restriction, objection or a portable copy of information relating to you. You may also opt out of promotional emails and revoke Google access from your Google Account.

These requests are available to customers, visitors and Instagram users or creators whose public information may be returned through GramScraper. Email [email protected] with the relevant account email or Instagram handle/URL, the information concerned, and whether you seek access, correction, deletion/removal, restriction or objection. We may use proportionate steps to verify identity or account control. We will assess the request under the circumstances, our technical role and applicable requirements. If we cannot fulfill it, we will explain why when appropriate.

9. Cookies and analytics

The Site uses necessary browser storage and may use PostHog and Google Analytics to measure website and product use. Google Analytics sets cookies on gramscraper.com; you can opt out with Google’s browser add-on at tools.google.com/dlpage/gaoptout. You can control cookies through your browser; blocking them may affect functionality. We do not claim that every analytics technology is strictly necessary.

10. Children

The Service is for users aged 18 or older and is not designed for children. Do not use GramScraper to identify, profile or target children.

11. Changes

We may update this policy as the Service or our practices change. We will update the date above and provide additional notice when reasonably appropriate.

12. Contact

GramScraper
[email protected]

Use this contact for privacy questions, data requests, complaints and abuse reports.