Privacy Policy
OwlScran Ltd (company number 15305650)
Last updated: 17 September 2026
1. Introduction
This privacy policy explains how OwlScran Ltd ("we", "us", or "our") collects, uses, stores, and shares your personal information when you use our website at owlscran.com and the services we provide through it (together, the "Services").
We are the data controller for the personal information described in this policy. Our details are:
- Company: OwlScran Ltd, registered in England and Wales (company number 15305650)
- Registered address: 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF
- Contact: contact@owlscran.com
If you have any questions about this policy or wish to exercise your data protection rights, please contact us at the email address above.
2. What personal data we collect
2.1 Information you provide to us
- Account data: your name, email address, and password (stored as a cryptographic hash). If you sign up via a social media platform (such as Google, Facebook, or TikTok), we receive the profile information that platform makes available, typically your name, email address, and profile picture.
- Billing data: OwlScran media kits are free. Where we hold records of an earlier transaction, payment methods, billing addresses and invoice details are processed by Stripe. We do not store your full card number or security code.
- Campaign and deal data: information you voluntarily contribute about your brand deals, sponsorship campaigns, pricing, and commercial activity on the platform. This may include the brand you worked with, the deal value, content format, niche, and campaign outcomes.
- Communications: any messages you send us via email or through the Services, including support requests and feedback.
2.2 Creator data you ask us to process
When you connect a social media account to the Services, we access and process data from that platform on your behalf to generate your media kit. The platforms we currently support are TikTok, Instagram, Facebook, and YouTube. The data we retrieve includes:
- Profile information: username, display name, bio, profile picture URL, verification status, and profile URL.
- Audience metrics: follower count, following count, total likes or subscribers, and (where available via the platform's API) audience demographic breakdowns by age, gender, and country.
- Content performance: post and video metadata including titles, descriptions, thumbnails, view counts, like counts, comment counts, share counts, and engagement rates.
This data is retrieved directly from each platform's official API using the OAuth access tokens you grant when connecting your account. We store this data in our database to power your media kit and to track changes over time.
Link-in-bio pages
When you publish a link-in-bio page, its name, bio, photo and visible sections are public. Drafts and hidden sections are not shown to visitors. You can take your page offline from its editor.
2.3 Information we collect automatically
When you visit or use the Services, we automatically collect certain technical and usage data:
- Device and technical data: your IP address, browser type and version, operating system, device type, and referring URL.
- Usage data (client-side analytics): page views, feature interactions, browser errors, and navigation patterns. Cookie Preferences control PostHog browser product analytics and diagnostics. Cookie-free aggregate Plausible measurement remains enabled. See section 5 for details.
- Authenticated product usage data (server-side): when you are signed in, our servers record route pathnames and product events against your internal OwlScran user ID. Events may include request context such as referring domain, IP address, browser user agent and country. We exclude names, email addresses and URL query strings from analytics payloads.
- Performance data: Core Web Vitals and page load metrics collected through PostHog. Cookie Preferences control this browser measurement alongside product analytics.
- Session recordings: if you have given your explicit consent via our cookie banner, we may record your browsing session (mouse movements, clicks, scrolling, and page content) using PostHog's session replay feature. Session recordings are not enabled unless you opt in. See section 5.
- Server-side logs: API request logs, error traces, and performance telemetry collected by our observability provider HyperDX. These logs may include your user ID and request context to help us diagnose errors and monitor service health.
Link-in-bio visitor analytics
For link-in-bio pages, we count page loads and link selections for the creator. Summaries show traffic sources, referring website hostnames, device categories, approximate country, region and city, and standard UTM campaign tags from the page address. Location comes from our hosting provider and may be unavailable or inaccurate. We do not store full referring URLs, arbitrary query parameters, raw IP addresses or raw browser user agents in these analytics.
This feature does not use cookies or persistent visitor identifiers. Random event and page-load IDs prevent duplicate counts; they do not identify unique people. Raw events are eligible for deletion after 14 days, once their daily summaries have been processed. Processing delays can extend this period. Aggregate counts remain until the creator account is deleted. Browser Do Not Track and Global Privacy Control signals suppress these feature analytics requests. Website-wide measurement is separate.
3. How and why we use your data
Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for each type of processing we carry out. The table below sets out our purposes and the corresponding legal basis.
| Purpose | Lawful basis | Details |
|---|---|---|
| Account creation and authentication | Contract (Art. 6(1)(b)) | Necessary to provide the Services you have signed up for. Processed via Supabase Auth. |
| Providing the media kit service | Contract (Art. 6(1)(b)) | Retrieving and displaying your creator data from connected social media platforms. |
| Payment processing | Contract (Art. 6(1)(b)) | Managing records and enquiries relating to earlier transactions via Stripe. Note: Stripe also processes certain data as an independent controller for its own fraud prevention and regulatory compliance purposes. |
| Sending transactional emails | Contract (Art. 6(1)(b)) | Account confirmations, password resets, transaction enquiries, and service updates via Resend. |
| Client-side product analytics and diagnostics (PostHog) | PECR statistical purposes exception; Legitimate interest (Art. 6(1)(f)) | Understanding how users interact with the Services so we can improve them. This processing qualifies for the statistical purposes exception under PECR regulation 6A, which permits certain analytics without prior consent. We offer an opt-out via our cookie settings. Our legitimate interest is improving the functionality and user experience of the Services. See section 5 for details. |
| Authenticated server-side product analytics | Legitimate interest (Art. 6(1)(f)) | Understanding whether signed-in users receive and use the product so we can improve it. This processing uses the internal OwlScran user ID and limited request context, not names or email addresses. Cookie Preferences control browser analytics and do not stop this server-side processing. You may object under section 8. |
| Cookie-free aggregate analytics (Plausible) | Legitimate interest (Art. 6(1)(f)) | Measuring aggregate visits using a tool that does not set or read visitor cookies. Plausible remains enabled when browser product analytics is switched off. |
| Session recording | Consent (Art. 6(1)(a)) | Recording browsing sessions for product improvement. Only activated if you opt in via our cookie banner. You may withdraw consent at any time. |
| Server-side error monitoring and observability | Legitimate interest (Art. 6(1)(f)) | Diagnosing errors, monitoring service health, and maintaining platform stability via HyperDX. Our legitimate interest is ensuring the Services operate reliably and securely. |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) | Retaining billing and invoice data for HMRC record-keeping requirements. |
| Anonymisation and aggregation for statistical analysis and AI model training | Legitimate interest (Art. 6(1)(f)) | We anonymise and aggregate creator statistics across the platform to produce insights, benchmarks, and predictive models. See section 3.1 for full details. |
Where we rely on legitimate interest, we have conducted a Legitimate Interest Assessment to ensure our interests do not override your rights and freedoms. You may request a copy of our assessments by contacting us.
3.1 Anonymisation, benchmarking, and AI model training
We use anonymised, aggregated data derived from creator activity across the platform to build statistical models and benchmarks. These may be used to provide features such as brand deal pricing predictions, audience benchmarking, and performance insights.
What data feeds into this process: the primary inputs are data that creators voluntarily contribute to the platform, such as brand deal pricing, campaign outcomes, content formats, niche categories, and commercial terms. We may also use aggregate statistical patterns derived from creator profiles across the platform.
How we anonymise data: before any data is used for model training or benchmarking, we remove all direct identifiers (such as names, email addresses, usernames, and social media profile URLs) and aggregate the data so that it relates to statistical patterns across many users rather than to any individual. The anonymisation is irreversible — we do not retain any key or mapping that could link the anonymised data back to you.
Important points:
- Truly anonymised data is not personal data under UK GDPR (Recital 26). Once data has been anonymised, data protection law no longer applies to it.
- We may retain anonymised aggregate data indefinitely, including after you delete your account, because it is no longer personal data and cannot be used to identify you.
- We may use anonymised aggregate data commercially, including to train models that we make available to other users, brands, and third parties (for example, a model that predicts what a creator should charge for a brand deal based on aggregated statistics from across the platform).
- The models we train are our intellectual property. They are statistical models derived from aggregate patterns — they do not contain or reveal any individual's personal data.
- You may object to the processing of your personal data that occurs before anonymisation (i.e., the act of including your data in the anonymisation pipeline) under your right to object (see section 8). If you object, we will exclude your data from future anonymisation and model training, though this will not affect models already trained on previously anonymised data.
4. Who we share your data with
We do not sell your personal data. We share your data only with the third-party service providers ("processors") we need to operate the Services, and only to the extent necessary for them to perform their function. Each processor is bound by a Data Processing Agreement (DPA) that requires them to process your data only on our instructions and to implement appropriate security measures.
4.1 Our processors
| Service | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase (Supabase, Inc.) | Database hosting, authentication, file storage | All account data, auth tokens, creator data, application data | United States (AWS) |
| Vercel (Vercel, Inc.) | Website hosting, CDN and server functions | IP addresses and request headers | United States |
| Stripe (Stripe, Inc.) | Records and enquiries relating to earlier transactions | Name, email, payment method, billing address, invoice data | United States (with UK entity Stripe Payments Europe Ltd) |
| Statsig (Statsig, Inc.) | Server-side feature flags, A/B testing and product analytics | Internal user ID, stable identifier, analytics events and experiment exposures | United States |
| PostHog, Inc. | Browser and authenticated server-side product analytics, errors, page performance and opt-in session replay | Internal user ID, product events, limited request context, sanitised errors, performance metrics and recordings (if consented) | European Union (EU cloud) |
| OwlScran-hosted Plausible | Aggregate browser website analytics | Aggregate page-view and referral data | United Kingdom |
| HyperDX (DeploySentinel, Inc.) | Server observability, error monitoring and logs | Internal user ID (where relevant), sanitised error context and request metadata | United States |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | Name, email address | United States |
We also use Brandfetch for brand logo lookups. No personal data is sent to Brandfetch; it receives only brand names and returns logo assets.
4.2 Social media platforms
When you connect a social media account, we access that platform's API to retrieve your creator data. We act on your instructions when doing so. The platforms (TikTok, Instagram, Facebook, YouTube) are not our processors — they are independent controllers of their own services. Please refer to each platform's privacy policy for information on how they handle your data.
4.3 AI models and anonymised data
We may make AI models trained on anonymised, aggregated data available to other users, brands, and third parties as part of our commercial offerings. Because this data is truly anonymised (see section 3.1), it is no longer personal data and its use does not constitute sharing your personal information.
4.4 Other disclosures
We may also share your personal data where required by law, regulation, or legal process, or in connection with a merger, acquisition, or sale of all or part of our business. In the event of a business transfer, we will notify you before your data is transferred and becomes subject to a different privacy policy.
5. Cookies and tracking technologies
We use cookies and similar technologies on the Services. Under the Privacy and Electronic Communications Regulations 2003 (PECR), we categorise these as follows.
5.1 Strictly necessary
These are essential for the Services to function and cannot be disabled.
| Cookie | Purpose | Duration |
|---|---|---|
| Supabase auth cookies (sb-*) | Authentication and session management | Session / as set by Supabase Auth |
| owlscran_consent | Stores your cookie consent preferences (which categories you have accepted or declined) | 180 days |
| statsig_stable_id | Keeps feature-gate assignment stable. It is not used for browser analytics after opt-out | 400 days |
5.2 Campaign tags
These first-party cookies store the campaign or UTM from the landing URL so we know how you found OwlScran. They are not a user ID. Cookie Preferences do not turn them off.
| Cookie | Purpose | Duration |
|---|---|---|
| owlscran_attr_ft / owlscran_attr_lt | First-touch and latest campaign tags from the landing URL. Page scripts cannot read these cookies. | 90 days |
| owlscran_attr_state | Readable marker set to captured after we store campaign tags. Stops repeat attribution requests. | 90 days |
5.3 Statistical purposes (opt-out)
The following browser product tracking falls within the PECR statistical purposes exception. This means we may deploy it without prior consent, but we provide an opt-out mechanism via our cookie settings. Switching browser product analytics off stops new PostHog browser product analytics and performance events.
| Technology | Purpose | Duration / notes |
|---|---|---|
| PostHog browser product analytics | Browser page views, product use, errors and page performance. Query strings and email-like text are removed before sending. | Current PostHog retention settings |
5.4 Cookie-free aggregate measurement
Plausible remains enabled regardless of Cookie Preferences because it does not set or read visitor cookies. It provides aggregate website measurement.
| Technology | Purpose | Duration / notes |
|---|---|---|
| OwlScran-hosted Plausible | Aggregate browser page-view and referral analytics | Aggregate statistics only |
Public link-in-bio pages
Fresh visits to public /bio/ pages use Plausible and our aggregate page-view and
link-click counts. These visits do not load PostHog, identify an account, record
sessions or capture form content.
Existing consented product tracking may continue when you navigate here from another OwlScran page, and an existing account session stays connected so sign-out and account changes also update tracking identity. Fresh public bio visits do not create campaign-attribution cookies or initialise an account session.
Use Turn off anonymous analytics below to object. We store only your opt-out choice in this browser (plausible_ignore), not
a visitor identifier. The preference stops new anonymous measurements and applies
to Plausible too. Our native bio measurements also honour Do Not
Track and Global Privacy Control. You can clear site data to reset this preference.
5.5 Consent-based (opt-in)
The following tracking technologies are only activated if you give your explicit consent via our cookie banner. You may withdraw your consent at any time through the cookie settings link in the footer of our website.
| Technology | Purpose | Duration / notes |
|---|---|---|
| PostHog session replay | Records browsing sessions for product improvement when you opt in. Recording stays off on admin pages and private share pages. | Current PostHog retention settings |
5.6 Authenticated server-side product measurement
When a signed-in user makes an ordinary page request or completes a product action, our servers record a product event against the internal OwlScran user ID. The event may include the route pathname, referring domain, IP address, browser user agent and country. We strip URL query strings and do not send names or email addresses in these analytics payloads.
Cookie Preferences control browser analytics only. Server-side product measurement continues when browser analytics is switched off. We rely on legitimate interest for this processing, as explained in section 3, and you may object under section 8.
We read UTM parameters and click identifiers (such as gclid and fbclid) from your URL when you arrive at the Services. We store them in the campaign-tag cookies in section 5.2. They are not a user ID. We do not set these third-party identifiers ourselves.
6. International data transfers
Some of our processors are based outside the United Kingdom. When your personal data is transferred outside the United Kingdom, we ensure it is protected by appropriate safeguards as required by UK GDPR Article 46. The specific transfer mechanisms for each processor are as follows.
| Processor | Transfer mechanism |
|---|---|
| Supabase | UK International Data Transfer Addendum ("UK Addendum") to the EU Standard Contractual Clauses (SCCs), incorporated into their DPA |
| Vercel | UK GDPR provisions in DPA; EU-US Data Privacy Framework (including UK Extension) |
| Stripe | UK Data Transfer Addendum; EU-US Data Privacy Framework (including UK Extension) |
| Statsig | UK SCCs (ICO International Data Transfer Addendum) incorporated into their DPA |
| PostHog | EU cloud hosting; UK adequacy regulations cover transfers to the EEA |
| Plausible | Self-hosted by OwlScran in the United Kingdom; no international transfer for this processing |
| HyperDX | UK Addendum to EU SCCs (Schedule II of their DPA) |
| Resend | UK SCCs (EU SCCs as amended by the UK Addendum), incorporated into their DPA |
You may request a copy of the relevant safeguard documentation by contacting us.
7. How long we keep your data
We retain your personal data only for as long as necessary for the purposes set out in this policy, unless a longer retention period is required by law.
Account deletion disables access and cancels subscriptions. Necessary financial records and the reference linking your account to your Stripe customer remain available for accounting, refunds and disputes. They are not used to restore your account or for model training. We tell you which records are retained when completing your deletion request.
| Data category | Retention period | Reason |
|---|---|---|
| Account data | Duration of your account, then erased through our deletion process; a restricted deletion audit remains | To provide the Services and document and enforce account deletion |
| Billing and invoice data, including account UUID/customer references and subscription history | 6 years from the end of the financial year the records relate to; longer where legally required | HMRC record-keeping requirements |
| Creator data (social media) | Duration of your account. Deleted when you disconnect a platform or delete your account | To provide the media kit service |
| Campaign and deal data you contribute | Duration of your account. Deleted on account deletion, except where already anonymised | To provide benchmarking and predictive features |
| Historical client-side analytics events (Statsig) | 1 year | Statsig's retention period on the current plan |
| Current browser analytics and session recordings (PostHog) | According to the current PostHog retention settings | Product improvement and performance measurement; recording requires opt-in |
| Authenticated server-side product analytics (PostHog and Statsig) | According to the current provider retention settings | Product improvement, activation and retention measurement |
| Historical session recordings (Statsig) | 30 days | Statsig's default retention period |
| Server-side logs (HyperDX) | 30 days | HyperDX's retention period on the current plan |
| Anonymised aggregate data (including data used for statistical models) | Retained indefinitely | Truly anonymised data is not personal data under UK GDPR. It cannot be used to identify you and is used for aggregate analysis, benchmarking, and model training. |
8. Your data protection rights
Under the UK GDPR, you have the following rights in relation to your personal data:
- Right of access: you may request a copy of the personal data we hold about you.
- Right to rectification: you may ask us to correct inaccurate or incomplete data.
- Right to erasure: you may ask us to delete your personal data in certain circumstances. Please note that this right applies to personal data only. Anonymised aggregate data (including data already incorporated into statistical models) is not personal data and is not subject to erasure requests.
- Right to restrict processing: you may ask us to limit how we use your data in certain circumstances.
- Right to data portability: where our processing is based on consent or contract and is carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.
- Right to object: you may object to processing based on legitimate interest, including the processing of your data for anonymisation and model training (see section 3.1). We will stop unless we can demonstrate compelling legitimate grounds that override your interests. If you object to model training, we will exclude your data from future anonymisation pipelines, though this will not affect models already trained on previously anonymised data.
- Right to withdraw consent: where we rely on consent (for example, session recording), you may withdraw it at any time via the cookie settings on our website or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
How to exercise your rights: email us at contact@owlscran.com. We will respond within 30 days. If your request is complex or we receive a large number of requests, we may extend this by a further 60 days, in which case we will notify you.
Right to complain: if you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.
9. How we keep your data safe
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption in transit: all data transmitted between your browser and our servers is encrypted using TLS.
- Encryption at rest: data stored in our database (Supabase/AWS) is encrypted using AES-256.
- Authentication: passwords are stored as cryptographic hashes via Supabase Auth. We never store plaintext passwords.
- Payment security: payment data relating to earlier transactions is handled by Stripe, which is PCI DSS Level 1 certified. We do not store card numbers or security codes.
- Access controls: access to production data is restricted to authorised personnel only.
No method of transmission over the internet or electronic storage is completely secure. While we take reasonable steps to protect your personal data, we cannot guarantee absolute security.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and will notify affected individuals without undue delay where the breach is likely to result in a high risk.
10. Children
The Services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from anyone under 18. By using the Services, you confirm that you are at least 18 years old. If we become aware that we have collected personal data from a person under 18, we will delete that data and close the associated account. If you believe we may have collected data from someone under 18, please contact us at contact@owlscran.com.
11. Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. The "Last updated" date at the top of this policy indicates when it was most recently revised. If we make material changes, we will notify you by email or by posting a prominent notice on the Services before the changes take effect. We encourage you to review this policy periodically.
12. Contact us
If you have any questions about this privacy policy, wish to exercise your data protection rights, or want to make a complaint, please contact us:
- Email: contact@owlscran.com
- Post: OwlScran Ltd, 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF
Anonymous analytics
We use visit and click counts to improve these pages. You can turn off anonymous measurement in this browser.
Questions or concerns? Contact us at contact@owlscran.com