Data processing addendum

Last updated: 2026-09-06.

This DPA forms part of the Terms of Service between you and Ounie. It applies when we process personal data on your behalf.

Subject matter

We process publicly accessible Instagram creator metadata — profile fields, follower counts, engagement figures, and any email address a creator has placed in their public bio or business contact card — at your direction. You are the data controller; we are a data processor acting on your documented instructions. Private accounts are never profiled: a private row is recorded as nothing more than the fact it was skipped.

Subprocessors

• A specialist Instagram public-data API provider — performs follower-list and profile reads on our behalf; it receives only the public username or ID being looked up. Identity available under NDA on request
• Stripe — payment processing for credit purchases (via ounie.com)
• Neon — application database, including scan results
• Vercel — application hosting
• Resend — transactional email (contact form and operational alerts)

Data security

Data at rest is encrypted (Neon’s encrypted volumes for Postgres). Data in transit uses TLS 1.2+. Access to production data is limited to operations engineers under role-based controls.

Deletion & return

On termination, or at your request, we delete the scan results we hold for your account within 30 days; you can export your data as CSV or JSON at any time before that through the dashboard.

Contact

For DPA requests, open a DPA ticket.