Privacy Policy

1. Introduction

This Privacy Policy explains how Statly collects, uses and protects personal data when you use the Statly web app (app.trystatly.com), the Statly Chrome extension, the Statly API and MCP connector, and our website (trystatly.com). It also explains what we hold about the creators whose public accounts our customers track. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

2. Who We Are

The controller of your personal data is Miltiadis Themelis, based in Greece, who operates Statly ("Statly", "we", "us"). You can contact us about anything in this policy at info@trystatly.com. We have not appointed a Data Protection Officer, as the law does not require one for our activities.

3. Information We Collect About Customers

When you use the web app, we collect:

• Account data: your email address, and records of your sign-ins (a one-way hash of each sign-in link, your session, browser type and a one-way hash of your IP address).
• Workspace data: the accounts you track, your niches, your Library (saved videos, folders and tags), your settings, and the names, email addresses and roles of the people you invite.
• Subscription data: your plan, its status, trial and renewal dates, and the customer and subscription identifiers and country we receive from Lemon Squeezy. We never receive your card details.
• Usage data: counts of which features each person uses, and the number of API calls per workspace.
• Connections you create: API keys and AI-assistant connections (stored only as one-way hashes), Slack, Discord or Telegram connections, and Chrome extensions linked to your account (with your name, email and a browser label such as "Chrome on Mac").
• Your answers and messages: your answer to "Where did you find Statly?", and anything you send us by email or through the bug-report form, including attachments and your browser and app version.

4. Information About Creators

When a customer asks the web app to track a public Instagram, TikTok, YouTube or X account, our servers collect, through third-party data providers, only what that account shows publicly to anyone without signing in: its handle and public identifier, follower count and profile picture, and for each public video or post its link, date, text, duration, media and public counts (views, likes, comments, shares, saves, reposts, replies, bookmarks and quotes). We keep a short history of those counts to show growth. We never collect private accounts, comments, followers lists or anything about the people who watch or interact with a post. Section 14 explains how a creator can object.

5. The Chrome Extension

The extension analyses public pages in your own browser and stores its results on your device. It sends us only:

• a random installation ID with usage events (such as install, open, scan and uninstall), and, on first run, whether the install came from one of our ads (including the ad's click ID);
• your IP address, processed briefly to enforce the daily free limit;
• for existing Pro subscribers, the licence key for verification and, while cloud sync is on, your watchlist, Trend Finder, Library and transcription key, so they are available on your other devices and to viewer keys you create;
• if you connect it to your web app account, the key that links it.

If you use transcription, video audio goes directly from your browser to Groq or OpenAI under your own API key and never passes through us. If you answer the survey shown after uninstalling, your answers are sent to us through Google Forms.

6. How We Use Your Information

We use personal data only to:

• provide the service you signed up for, including sign-in, scanning, teams and support;
• bill you and manage your subscription, including preventing repeat free trials;
• keep Statly secure and prevent abuse;
• understand how Statly is used and improve it;
• measure our own advertising, with your consent where required;
• send you service messages, such as sign-in links, invitations and notices about your account.

We do not sell personal data, and we do not use it for profiling or automated decisions that affect you.

7. Legal Basis

We rely on the following legal bases under Article 6 GDPR:

• Contract: to provide the web app, the extension and your subscription.
• Consent: for analytics and advertising cookies. You can withdraw consent at any time.
• Legal obligation: to keep billing and tax records.
• Legitimate interests: to keep the service secure, prevent abuse, understand and improve Statly, measure our advertising in aggregate, and provide our customers with research on public accounts. We have balanced these interests against your rights, and you may object at any time.

8. Cookies and Analytics

Our website and web app show a cookie banner. Google Analytics and Google Ads run only if you accept them. We also set a strictly necessary cookie, statly_consent, for six months, so that the website and the app respect the same choice.

We use our own analytics tool on the website and the web app. It records the pages you visit, how you arrived (including ad campaigns), your approximate location (country, region and city), your browser and device, and time on page. When you sign up or sign in, it records a one-way hash of your email address so that we can tell which visits led to an account. If you accept cookies, it sets a visitor cookie (_sv, up to 400 days) and a session cookie (_ss, 30 minutes); if you do not, it sets no cookies and recognises a visitor for one day only. It does not store IP addresses.

9. Who We Share Data With

We share personal data only with service providers who process it for us, under contract:

• Cloudflare, which hosts Statly and its databases;
• an email delivery provider, for sign-in links, invitations and support;
• public social media data providers, which receive only a public handle or account ID, never anything about our customers;
• Google, for analytics and advertising (with consent), the uninstall survey, website fonts and the website's free AI tools;
• Groq, for the website's free AI tools;
• a consent management provider, for the cookie banner;
• Telegram, for internal notices to our team about subscriptions and failed payments.

Lemon Squeezy is the Merchant of Record for all payments and processes your payment data as an independent controller under its own privacy policy. We may also disclose data where the law requires it. On request, we will tell you the name of any provider that has received your data.

10. Services You Connect

If you connect Slack, Discord or Telegram for alerts, an AI assistant through our MCP connector, or a transcription provider in the extension, we send the data you ask for to that service. That service then handles it under its own terms and privacy policy, and is not our processor.

11. Website Free Tools

The free AI tools on our website send the text or file you submit to Groq or Google to produce the result. We do not store your submission. To prevent abuse, we use Cloudflare Turnstile and keep a daily counter per IP address, deleted after two days.

12. International Transfers

Some of our providers process data outside the European Economic Area, including in the United States. Where they do, we rely on the safeguards the GDPR provides for, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

13. How Long We Keep Data

• Your account and workspace data: while your account exists. After you cancel, we keep it so that you can resume, unless you delete your account. We may delete accounts that have been inactive for a long period, after notice.
• When you delete your account: your account, workspace, usage and connection data are deleted at once. We keep only a one-way hash of your email address, to prevent repeat free trials, and records of our own data-provider costs that no longer identify you.
• Billing records: as long as tax law requires.
• Creator data: while at least one customer account tracks the account, or a customer has saved the video to their Library. Count history is limited to the most recent readings.
• Analytics records: up to 400 days.
• Rate-limiting data: a few days at most.
• Support emails and bug reports: as long as needed to resolve the matter.
• Extension data on your device: until you uninstall the extension. Synced Pro content is kept while the licence is active, or until you ask us to delete it.

14. Your Rights

You have the right to access, correct, delete, restrict, object to the processing of, and receive a copy of your personal data, and to withdraw consent at any time. In the web app you can export your tables to CSV and delete your account yourself under Settings → General → Danger zone. For anything else, email info@trystatly.com; we will reply within one month. You also have the right to complain to the Hellenic Data Protection Authority (dpa.gr) or your local authority.

If you are a creator whose public account is tracked, you have the same rights even though you are not our customer. Write to us from an address connected to the account, or tell us how to verify it. If you object or ask for erasure, we will delete what we hold about your account, except videos a customer had already saved to their Library, and record your handle and the date of your request so that our systems never collect it again. We will not tell you which customers tracked you.

15. Security

We protect data with encryption in transit, one-way hashing of sign-in links, keys and the IP addresses our sign-in system stores, revocable sessions and keys, and checks that every request only reaches the workspace it belongs to. No system is completely secure, but we collect as little as possible to limit the risk.

16. Children

Statly is not intended for anyone under 16, and we do not knowingly collect their personal data.

17. Changes to This Policy

We may update this policy as Statly changes. The date at the top shows the latest version, and we will email web app customers about material changes before they take effect.

18. Contact

Miltiadis Themelis, Greece. Email: info@trystatly.com