This Privacy Policy (“Privacy Notice”) explains how Vetfluence, Inc. (“Vetfluence,” “we,” “us,” or “our”) collects, uses, stores, and shares information when you visit vetfluence.com, run a creator report, or subscribe to a paid plan.
Vetfluence is a tool for evaluating the engagement quality of public Instagram and TikTok creator accounts. Customers use Vetfluence to vet creators before paying them; creators themselves can also generate a report on their own profile to share with brands. If you do not agree with this Privacy Notice, please do not use Vetfluence. For questions, contact us at support@grzybj.fyi.
Summary of key points
- What information do we process?
- Two kinds. Customer data you give us (email, billing, watchlists, reports you save). And public creator data we read from Instagram and TikTok to generate reports — only what the platforms make available without authentication.
- Do we process sensitive personal information?
- No. We do not collect government IDs, health data, biometric data, race, religion, sexual orientation, or financial account credentials.
- Do we sell personal information?
- No. We do not sell or rent personal information to anyone.
- Do we train AI on your data?
- No. Customer accounts, billing data, and saved reports are not used to train any machine-learning model. Our scoring is rule-based and weighted (see What we check).
- Are creators notified when checked?
- No. Reports are generated from public data and creators are not notified. Creators may, however, request removal of their cached profile data from our systems — see Section 10.
- What rights do you have?
- Depending on your jurisdiction: access, correction, deletion, portability, and the right to withdraw consent. Contact support@grzybj.fyi.
01What information we collect
What we collect — from customers and from public sources.
Information you give us as a customer
When you create an account, subscribe, or contact support, we collect:
- Account details: email address, password hash, display name (Free tier requires no account).
- Billing information: billing address and the last four digits of your payment method. Full card numbers are handled directly by our payment processor (Stripe) and never touch our servers.
- Plan and usage: tier (Free, Pro, Business), report count, login times, feature interactions.
- Saved content: watchlists, project labels, exported PDFs, and any notes you attach to a report.
- Support correspondence: emails and chat transcripts you send us.
Information we collect automatically
- IP address (truncated for storage), browser type, operating system, device class.
- Referring URL and pages viewed within Vetfluence.
- Approximate location (country and region) derived from IP.
- Anonymous usage metrics — which features are used and how often.
Public creator data we read
To generate a report, Vetfluence reads publicly available information about the creator account you ask us to check — the same information any logged-out user could see by visiting the profile. See Section 2 for the full breakdown.
02How we handle creator data
The data behind every report — what we read, what we keep, and what we don’t.
Public data only. Vetfluence never requests Instagram or TikTok login credentials, never uses authenticated APIs to read private data, and never scrapes content that requires being logged in to view.
What we read from public profiles
When you (or anyone) generates a report for an Instagram or TikTok handle, we read:
What we do not read
- Anything behind a private account.
- Direct messages, story content, or any non-public material.
- Identities of commenters — comment text is scored as text. We do not store commenter handles in user-facing reports, and never build profiles of individual commenters.
- Email addresses, phone numbers, or any contact information that might appear inside a bio is never extracted, indexed, or used.
How we store creator data
- Report cache. When a report is generated, we cache the computed metrics and a snapshot of the public fields above for up to 30 days, so repeat lookups are fast and consistent.
- Watchlists. If a Pro or Business customer adds a creator to a watchlist, we re-read the public profile on a schedule (typically weekly) and keep a rolling 12-month history of public metrics for that handle, scoped to that customer’s account.
- Aggregate baselines. Anonymized, aggregated statistics (e.g. the median engagement rate at a given follower band) are kept indefinitely. These contain no identifying information about any individual creator.
Creator-controlled report exposure
Reports are private to the customer who generated them. We do not publish a directory, listing, or marketplace of creators. A creator’s name does not appear on a public Vetfluence page as a result of being checked.
Creators have the right to claim, view, correct, or request deletion of their cached profile data — see Section 10.
03How we process your information
Why we use the data we collect.
We process information to:
- Create and manage customer accounts and authenticate logins.
- Generate reports, compute scores, and produce deal recommendations.
- Process subscription payments and issue invoices.
- Send service-related communications (receipts, security alerts, watchlist changes).
- Send product updates and marketing emails — only with your consent, with one-click unsubscribe in every message.
- Detect abuse, prevent fraud, and rate-limit automated misuse of the search endpoint.
- Improve our scoring model by analyzing anonymized, aggregated patterns in report data.
- Comply with legal obligations and respond to lawful requests.
04Legal bases for processing
What gives us the right to process this data.
Where the GDPR, UK GDPR, or similar law applies, we process personal information on one or more of these bases:
- Performance of a contract — to provide the service you signed up for.
- Legitimate interests — to operate, secure, and improve Vetfluence. Reading publicly available creator information to score engagement quality is a legitimate-interest basis weighed against the rights of the creator; creators may object at any time (Section 10).
- Consent — for marketing emails, optional analytics cookies, and any processing we ask you to opt into specifically.
- Legal obligation — tax records, fraud prevention, lawful requests.
You may withdraw consent at any time where processing is consent-based; this does not affect processing already carried out.
05Who we share information with
The short list of third parties we rely on.
We share personal information only with vendors who help us run the service, and only the minimum they need to do their job. Current sub-processors:
- Stripe, Inc. — payment processing and subscription billing.
- Amazon Web Services — hosting and storage (US-East and EU-West regions).
- Postmark — transactional email (receipts, password resets, watchlist alerts).
- Plausible Analytics — cookie-less, privacy-respecting product analytics.
- Sentry — error monitoring (IP-truncated, no request bodies retained).
Other circumstances in which we may share information:
- Business transfers. If Vetfluence is acquired, merges, or transfers substantially all its assets, customer information may transfer as part of that deal. You will be notified.
- Legal compliance. When required to comply with a valid subpoena, court order, or similar legal process — reviewed by counsel.
- To protect rights. Where necessary to investigate fraud, protect our customers, or enforce our Terms.
We do not sell personal information, and we have not sold personal information in the preceding twelve months.
06Cookies and analytics
What we set, and what we don’t.
We use a minimal set of cookies:
- Strictly necessary: session cookies that keep you logged in.
- Preferences: remembers your theme and platform-tab selection.
We use Plausible Analytics for aggregate page-view stats. Plausible does not set tracking cookies and does not collect any personal data. We do not use Google Analytics, Facebook Pixel, or any ad-tech tracker on Vetfluence.
07How long we keep information
Retention windows for every category of data.
When you close your account, we delete or anonymize associated personal data within 30 days, except where retention is required by law (e.g. invoices) or necessary for legitimate dispute resolution.
08How we keep information safe
The controls we apply — technical, organizational, and contractual.
- TLS 1.2+ in transit; AES-256 at rest.
- Passwords are stored using bcrypt with a per-user salt.
- Least-privilege access controls; production access requires hardware-key 2FA.
- Access logs are reviewed monthly. Sub-processors are reviewed annually.
- Annual third-party penetration testing.
- Incident-response plan: in the event of a confirmed breach affecting personal information, we notify affected users within 72 hours of confirmation.
No system is ever 100% secure. If you believe you’ve found a vulnerability, please report it to support@grzybj.fyi.
09Your privacy rights
Access, correction, deletion, portability.
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct information that is inaccurate.
- Delete your account and the personal information associated with it.
- Export your data in a machine-readable format.
- Object to processing based on legitimate interests.
- Withdraw consent at any time.
- Lodge a complaint with your local data-protection authority (for EEA/UK residents).
California residents have additional rights under the CCPA / CPRA, including the right to know the categories of personal information collected and the right to non-discrimination. We do not sell or share personal information for cross-context behavioral advertising.
To exercise any of these rights, email support@grzybj.fyi. We respond to verified requests within 30 days.
10Creator claims and removal requests
If you’re a creator, here’s how to take control of your data.
Vetfluence reads public information about creator accounts — you do not need a Vetfluence account for us to process information about your public profile. We honor the following rights for any creator, regardless of jurisdiction:
- See what we have. Request a copy of every field we’ve cached about your handle.
- Correct it. If you can demonstrate a field is wrong (e.g. a metric clearly out of date), we will refresh or correct it.
- Remove it. Request deletion of your cached profile and exclusion from future reports. Once granted, we add your handle to a suppression list and any future search for that handle will return a “removed at the creator’s request” message instead of a report.
- Limit watchlist tracking. Even before opting out entirely, you can request that customers not be able to add your handle to a watchlist.
To verify a request, we ask you to send the email from the address listed in your public profile or post a short verification code from a story or comment on the public account. Once verified, we action the request within 14 days.
Send requests to support@grzybj.fyi. We do not charge for verification or removal.
11Minors
Vetfluence is not for users under 18.
Our service is intended for businesses and adult creators. We do not knowingly collect personal information from anyone under 18 as a Vetfluence customer. If you believe a minor has provided us with personal information, contact support@grzybj.fyi and we will delete it.
If a creator account being checked appears to belong to a minor, we will treat removal requests submitted on the minor’s behalf by a parent or guardian as a priority.
12International transfers
Where the data lives.
Vetfluence is operated from the United States. Personal information is stored in AWS US-East by default; EEA/UK customer data is stored in AWS EU-West (Ireland). Cross-border transfers, where they happen, are covered by Standard Contractual Clauses approved by the European Commission and the UK ICO.
13Do-Not-Track signals
We respect them where we can.
We do not run cross-site tracking, so “Do Not Track” is the default state of Vetfluence regardless of your browser setting. We also honor the Global Privacy Control (GPC) signal as a valid opt-out under applicable law.
14Updates to this notice
What happens when this policy changes.
We update this Privacy Notice when our practices change or when the law requires. Material changes are announced by email to all account holders at least 30 days before they take effect; minor edits (typos, clarifications) are reflected by an updated “Last updated” date at the top of this page.
15Contact us
People, not a ticketing queue.
Questions, requests, or anything else related to this Privacy Notice:
- General privacy: support@grzybj.fyi
- Creator removal & claims: support@grzybj.fyi
- Security disclosures: support@grzybj.fyi