Who is responsible
Unflaggable.bio is controller for account administration, billing, service security, support and the public creator research catalogue. For a creator’s page content and visitor analytics handled on their instructions, the creator is controller and we act as processor. Our separate Visitor privacy notice explains visits to creator pages.
Use the legal request form to reach us about personal data, including if you do not have an account. It provides a receipt and a private status link. Do not send passwords, complete payment-card details or identity documents through the form. We may request proportionate additional verification where necessary.
What we collect and why
Waitlist: we use your email address and optional plan interest or referral code to record your access request, send a confirmation and contact you about an invitation. This does not create an account or subscribe you to a newsletter. You can leave the list by replying to our email or contacting the legal email above.
Account and service delivery: email, authentication identifiers, profile name, connected public Instagram handle, page configurations, links, prompts, design versions, optional campaign revenue and subscriber figures entered by you, and uploaded media are used to provide the service you request. Contract performance is the basis where necessary for your contract; legitimate interests in administering a business customer relationship apply to representatives who are not personally contracting.
Billing and domains: subscription and payment identifiers, invoice amounts and status, domain orders and registrant contact details are used to fulfil orders, handle refunds, prevent abuse and meet applicable accounting or registration obligations. Our payment processor handles checkout card data; we do not store full card numbers or CVCs. Registrant contact details are shared with domain-registration providers to fulfil your order.
Security and support: service providers receive network and request information such as IP addresses, user agents and timestamps to deliver, secure and troubleshoot the service. Application abuse-prevention records use pseudonymous identifiers. Optional button experiments compare daily pseudonymous network and device groups, without storing raw IP addresses in experiment records. These experiment records are scheduled for deletion after 90 days. Reported revenue is customer-entered data, not a verified statement of destination-platform payments. Request correspondence and audit records are used to handle rights, reports and disputes. We rely on legitimate interests in running a secure service and legal obligations where applicable.
Optional email alerts use your requested preference and email to send virality updates. You can withdraw that preference in the studio or through an alert’s unsubscribe link. Essential authentication, purchase and security messages are separate from optional alerts.
Support conversations and editorial content
Website chat stores the messages you send, an optional contact email, your account identifier if signed in, and a private conversation reference in a necessary browser cookie. Our support team can read and reply to your conversation. We use this information to answer your request and maintain the service. Do not send passwords, payment-card details or sensitive identity documents through chat.
The Creator Journal uses AI-assisted research and editorial checks. Its articles provide general education, not individualized legal, financial or guaranteed growth advice. Contact us to suggest a correction. Support conversations are scheduled for deletion after 180 days without activity; the browser chat cookie expires after 30 days.
Referral rewards
If you use an invitation link or submit an invite code, we associate the referrer with your account to administer the requested referral programme. We record attribution time, qualifying payment status and subscription credits. The referrer can see a numbered invitation and reward status, not your email, name, card details or payment amount.
We use these records to deliver the programme and for legitimate interests in preventing duplicate or fraudulent rewards. No referral tracking cookie is used. Attribution is carried in the invite URL and stored with the account. Reward billing records are retained as needed for the account, accounting and disputes, subject to applicable retention duties.
Social-profile imports and AI design
Profile import and creator research use public names, usernames, profile images, bios, public links, post media, follower and engagement counts, and measured changes. Sources include publicly accessible social profiles and posts, obtained through social-data service providers. We do not request your Instagram password. Research rankings are statistical comparisons and estimates, not verified judgments about a person.
For imports you request, we process public material to provide that feature. For the shared research catalogue, the intended basis is our legitimate interest in creator research, subject to an assessment of necessity, proportionality, provider permissions and your rights. You may object, request correction or request removal using the form, whether or not you use Unflaggable. Public information is still personal data. We do not use research scores to make legal or similarly significant decisions about you.
When you request an AI design, an AI processing provider receives your instructions, relevant profile text, link labels and design context. Information you include in a prompt is part of that request. The configured service does not use these API submissions for model training by default. Provider security monitoring may retain request data for up to 30 days, subject to legal or security exceptions; we do not promise zero retention.
Sharing and international processing
See Sharing & international processing for the categories of service providers involved. Customers can access the named provider register in their account; anyone can request recipient and transfer details through the privacy request form. Providers receive data necessary for their role; some, including payment and registrar providers, may also act as independent controllers. Authorized staff can access data for support, security, administration and legal requests. We may disclose information when legally required, to defend legal claims, or in a business transfer subject to appropriate safeguards and notice.
Unflaggable’s own marketing website and workspace do not operate advertising pixels, and we do not sell personal data. A creator may separately enable their own Meta Pixel on a published creator page. That optional integration shares the page URL and browser information with Meta. The creator is responsible for their advertising account, permitted use and page-specific disclosures. Provider processing may take place outside your country. Where applicable, transfers require an adequacy decision or appropriate safeguards such as standard contractual clauses and supplementary measures. Contact us for the applicable transfer information; information on the relevant recipients and safeguards is available through the privacy request form.
Retention
Account content and saved designs remain while your account or the relevant content is active, unless removed sooner or subject to a necessary hold. Media can be deleted from the library. Uploaded media is accessible to anyone who has its file link, including before a page is published. Cached copies held by third parties may persist outside our control.
Recorded visitor events are scheduled for deletion after 90 days on Creator, 365 days on Pro, and 730 days on Scale and Agency. Personal Instagram metric snapshots and alert delivery records are scheduled for deletion after 90 days. Cached paid IP-location results expire within 24 hours. These jobs run periodically, so deletion can occur after the next scheduled run.
Historical visitor-choice records from the withdrawn preference feature can remain for up to two years after their recorded expiry. The current creator pages do not create new preference records. Closed legal requests are retained for three years, unless a documented legal hold requires longer; open requests remain while handled. Application abuse-rate records are pruned after two days.
We may retain limited accounting, domain-registration, security or dispute information where required or justified. Invoices covered by Slovenian VAT recordkeeping rules are retained for ten years after the end of the relevant year. Longer retention may apply where legally required for a dispute, investigation or another specific obligation. Provider backup and security-log retention is governed by their service settings and terms; deleting an active record does not promise immediate deletion from every backup.
Your rights and choices
Depending on the applicable law and processing basis, you may request access, correction, erasure, restriction, portability, object to legitimate-interest processing, or withdraw consent. Withdrawal does not make earlier lawful processing unlawful. Export your account data in Settings or use the request form for assistance or additional records. We may need to protect another person’s rights or retain information required by law.
For GDPR requests we normally respond within one calendar month. Where the law permits more time due to complexity or volume, we explain the extension and reasons within that first month. You may complain to the Slovenian Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, Slovenia, at www.ip-rs.si, or another competent data-protection supervisory authority, and seek a judicial remedy. Exercising privacy rights does not result in unlawful discrimination.
Use the request form to raise objections or exercise applicable opt-out rights. Browser privacy signals do not automatically change the creator’s configured analytics or personalization. You can contact the creator or submit a privacy request about this processing. If US state privacy laws apply, use the same form for applicable access, correction, deletion, opt-out or appeal rights, including authorized-agent requests. We assess the law’s scope rather than claiming every jurisdiction’s rules apply identically.
Children and changes
Accounts are for adults aged 18 or older. Do not intentionally collect children’s personal data through the service. An 18+ label is not age verification and does not replace any legally required age-assurance process. Report suspected misuse through the legal form.
We update this notice as processing changes. Material changes will be highlighted where required. A new purpose requiring consent will not be authorized solely by changing this notice.