On this page
Privacy Policy
Last updated: August 12, 2026
1. Data controller
StatiProof operates the platform accessible at statiproof.com. As data controller under the General Data Protection Regulation (GDPR, EU Regulation 2016/679), StatiProof determines the purposes and means of the personal data processing described in this policy.
Contact: privacy@statiproof.com
2. Data processed and purposes
2.1 Data provided by the creator
When a creator generates a media kit, we collect: username, platform (Instagram or TikTok), declared audience statistics, country, content category and, optionally, an email address.
Legal basis:
Performance of a contract / consent (Art. 6(1)(a) and (b) GDPR). The creator who submits the form explicitly consents to the publication of their profile in the StatiProof public directory.
2.2 Data collected by scraping
StatiProof automatically collects, via third-party tools (Apify), publicly accessible data on Instagram and TikTok: follower counts and engagement statistics visible without authentication. This data is used exclusively to verify and certify the statistics declared by creators.
Legal basis:
Legitimate interest (Art. 6(1)(f) GDPR). Collecting public data for verification purposes constitutes a recognised legitimate interest, practiced by established market players such as Modash, HypeAuditor, Kolsquare and Lefty, all operating in the European Union without GDPR infringement.
2.3 Navigation data
We collect standard technical data (IP address, browser type, pages visited) for security and aggregated audience analysis purposes. No third-party advertising tracking cookies are placed.
Legal basis:
Legitimate interest (Art. 6(1)(f) GDPR).
3. Data recipients
Data of creators whose profile is public is accessible to brands subscribing to StatiProof through the directory. No data is sold to third parties.
Our technical processors: Supabase Inc. (database hosting (EU servers, Frankfurt)), Vercel Inc. (application hosting (global CDN with possible EU processing)), Apify Technologies s.r.o. (automated collection of public data (Czech Republic, EU)).
4. Retention periods
5. Your rights
Under Articles 15 to 22 of the GDPR, you have the following rights:
Right of access
obtain a copy of the data concerning you.
Right to rectification
correct inaccurate data.
Right to erasure
request the deletion of your profile from the directory. We process any request within 72 hours.
Right to object
object to processing based on legitimate interest. If you object to scraping, your profile will be removed from the directory and your account will be added to our permanent exclusion list.
Right to data portability
receive your data in a structured format.
Right to restriction
restrict processing that is being contested.
6. Security
StatiProof implements appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure: data encryption in transit (TLS 1.3), access isolation via Row Level Security, hashed edit tokens (SHA-256), no passwords are stored.
7. Complaints
If you believe your rights are not being respected, you may lodge a complaint with the competent supervisory authority. In France: the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80751, 75334 Paris Cedex 07, www.cnil.fr.
8. Amendments
Any material changes to this policy will be notified to creators who have provided an email address, with 30 days' notice. The date of the last update appears at the top of this page.