Privacy Policy
Last updated: 20 September 2026
InstaCognito is operated by Orydelis Technologies Ltd, a company registered in Malta (“we”, “us”). We are the data controller under the EU General Data Protection Regulation (GDPR) for the processing described on this page. Our full company details are at the end of this page. Contact: [email protected].
We provide analytics and viewing/downloading tools for publicly accessible Instagram information. We do not use Google Analytics or other visitor-tracking analytics, and we do not sell personal data. The account and payment sections apply where those features are available.
One account across our services. Your InstaCognito account is part of an account system shared with InstaShadow, a sister service operated by the same company. Where account features are available on InstaShadow, the same sign-in works there, and account information, preferences, analysis history and related security records are used across both services to provide sign-in, analytics and account security. This is internal use by a single data controller, not disclosure to another company. The purposes and retention periods below apply across both services.
1. What we process and how long we keep it
| Data and purpose | Retention |
|---|---|
| Visitors not signed in | Your IP address and browser information are processed to serve requests, apply usage limits and prevent abuse; they may be held briefly in memory and may appear in the security and diagnostic logs described below. Instagram data you request is retrieved on demand and cached in memory only as long as needed to serve related requests and avoid repeated retrieval; it expires automatically and is not written to permanent storage. |
| Early-access email list | Your email address is used for the early-access updates you requested. We keep it until you unsubscribe or ask us to remove it, or until you delete an account created with the same email address. Creating an account alone does not remove the subscription. |
| Profile-blocking requests | We keep the Instagram username to enforce the block, with no automatic expiry, until you ask us to lift it. Contact details and supporting request records are kept only as long as needed to validate and manage the request or meet legal obligations. |
| Registered accounts | Email address, password hash if you set a password, Google or Apple sign-in identifier if used, and preferences such as timezone and currency if set. Kept until you delete your account, with no automatic expiry. They support sign-in, account services and preferences. We never store plaintext passwords. |
| Analysis history (signed-in users) | Recently analysed profiles and the associated report data are stored for 30 days from the analysis, or until account deletion if earlier. |
| Security and diagnostic logs | Records of requests and security events, which may include IP address, browser information and request metadata, are kept for up to 30 days to detect and investigate abuse, diagnose problems and protect the service. |
If you contact us, we process your contact details and message to resolve the request and keep the correspondence only as long as needed to resolve it or to meet legal obligations. When payments launch, we will also process subscription status, billing details and payment references. Required accounting and tax records may be kept after account deletion for the applicable statutory retention period.
2. Public Instagram data and legal bases
We retrieve publicly accessible Instagram information: usernames, profile details, public content, follower/following information and engagement metrics. We use it to return the views you request and to generate analytics, including AI-generated estimates such as estimated audience demographics (for example gender distribution), engagement quality and similar indicators. Estimates may be inaccurate. We do not attempt to infer special categories of personal data such as ethnicity, religious beliefs, health or sexual orientation. Results are shown to the person who requested them. Public information can still be personal data; we do not access private profiles or content.
We rely on our legitimate interests in providing requested public-profile analysis, preventing abuse, responding to support requests and maintaining profile blocks, balanced against the rights of the people concerned. You may object to this processing. Account services and requested purchases rely on performance of our contract with you; early-access emails rely on your consent; mandatory financial records rely on legal obligations. Account sign-in information is needed to provide an account; timezone, currency and early-access signup are optional.
3. Cookies, local storage and service providers
We do not set our own cookies for visitors who are not signed in. Free-tool usage limits are counted in your browser’s local storage; that counter stays on your device and is not sent to us. It remains until updated or cleared in your browser. Cloudflare and Turnstile may set security cookies when a security check is needed, and they process technical signals such as IP address and browser information to detect abuse. See Cloudflare’s Privacy Policy and Turnstile’s Privacy Policy. Account features use essential sign-in and security cookies.
If you choose Google or Apple sign-in, we receive your email address and a sign-in identifier from that provider to create or authenticate your shared InstaCognito/InstaShadow account. Apple may provide a private relay email address. We do not receive your Google or Apple password. The provider processes the sign-in under its own privacy policy.
We use hosting/security, email-delivery and AI report-generation providers. They receive only the data needed for those functions, including public-profile data used to generate reports, under appropriate data-protection terms. Providers may also retain service data for the time needed to deliver and secure those services or meet legal obligations. Cloudflare and payment providers also process some data independently under their own privacy notices. We may disclose information where legally required.
Payments will be processed by a third-party payment provider; we currently plan to use Stripe. Once enabled, the provider will process your payment details under its own privacy notice and may also process data for its own compliance and fraud-prevention purposes. The provider will be identified at checkout.
Providers may process data outside the European Economic Area, including in the United States. Where required, we rely on an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Contact us for details or a copy of the relevant safeguards.
4. Your choices and rights
You can delete your account from your dashboard. Deletion removes the account from our shared account system, including any InstaShadow access linked to it, and removes the matching early-access email address. You can also unsubscribe from early-access emails, or ask us to remove your email, at any time. To block an Instagram profile from being viewed or analysed through our services, email us with its username and the subject “Profile removal request”; we may ask for proportionate verification. Lifting a block later allows the profile to appear again.
Where applicable, you may request access, correction, deletion, restriction or portability, object to processing, and withdraw consent without affecting earlier lawful processing. Email [email protected]; we normally respond within one month. You may complain to Malta’s Information and Data Protection Commissioner or your local data-protection authority.
We will post updates here and notify you of material changes where required.
5. Company details
Orydelis Technologies Ltd
Company registration number C 116358 (Malta)
Registered office: 170, Pater House, Psaila Street, Birkirkara BKR 9077, Malta
Email: [email protected]