Privacy Policy
1. Introduction
This Privacy Policy explains how Statly collects, uses and protects personal data when you use the Statly web app (app.trystatly.com), the Statly Chrome extension, the Statly API and MCP connector, and our website (trystatly.com). It also explains what we hold about the creators whose public accounts our customers track. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).
2. Who We Are
The controller of your personal data is Miltiadis Themelis, based in Greece, who operates Statly ("Statly", "we", "us"). You can contact us about anything in this policy at info@trystatly.com. We have not appointed a Data Protection Officer, as the law does not require one for our activities.
3. Information We Collect About Customers
When you use the web app, we collect:
- Account data: your email address, your name if you give it to us, and records of your sign-ins (a one-way hash of each sign-in link, your session, browser type and a one-way hash of your IP address).
- Email data: your email preferences, which emails we sent you, and whether they were delivered and opened and which of their links you clicked.
- Workspace data: the accounts you track, your niches, your Library (saved videos, folders and tags), your settings, and the names, email addresses and roles of the people you invite.
- Subscription data: your plan, its status, free preview and renewal dates, and the customer and subscription identifiers and country we receive from Lemon Squeezy. We never receive your card details.
- Usage data: counts of which features each person uses, and the number of API calls per workspace.
- Connections you create: API keys and AI-assistant connections (stored only as one-way hashes), Slack, Discord or Telegram connections, and Chrome extensions linked to your account (with your name, email and a browser label such as "Chrome on Mac").
- Sign-up details: your answers to the sign-up questions (such as your role and the platforms you follow) and to "Where did you find Statly?"; how you arrived (the ad campaign and the ad's click ID, the website that sent you, and the first page you read on our website); and the country your connection comes from, as our hosting provider, Cloudflare, sees it (if you use a VPN, it is the VPN's country). We use them only to understand where our customers come from and what they need.
- Your messages: anything you send us by email or through the bug-report form, including attachments and your browser and app version.
4. Information About Creators
When a customer asks the web app to track a public Instagram, TikTok, YouTube or X account, our servers collect, through third-party data providers, only what that account shows publicly to anyone without signing in: its handle and public identifier, follower count and profile picture, and for each public video or post its link, date, text, duration, media and public counts (views, likes, comments, shares, saves, reposts, replies, bookmarks and quotes). We keep a short history of those counts to show growth. We never collect private accounts, comments, followers lists or anything about the people who watch or interact with a post. Section 15 explains how a creator can object.
5. The Chrome Extension
The extension analyses public pages in your own browser and stores its results on your device. It sends us only:
- a random installation ID with usage events (such as install, open, scan and uninstall), and, on first run, whether the install came from one of our ads (including the ad's click ID);
- your IP address, processed briefly to enforce the daily free limit;
- for existing Pro subscribers, the licence key for verification and, while cloud sync is on, your watchlist, Trend Finder, Library and transcription key, so they are available on your other devices and to viewer keys you create;
- if you connect it to your web app account, the key that links it.
If you use transcription, video audio goes directly from your browser to Groq or OpenAI under your own API key and never passes through us. If you answer the survey shown after uninstalling, your answers are sent to us through Google Forms.
6. How We Use Your Information
We use personal data only to:
- provide the service you signed up for, including sign-in, scanning, teams and support;
- bill you and manage your subscription, including making sure each person gets only one free preview;
- keep Statly secure and prevent abuse;
- understand how Statly is used and improve it;
- measure our own advertising, with your consent where required;
- send you service emails and, unless you opt out, product and marketing emails (Section 7).
We do not sell personal data, and we do not use it for profiling or automated decisions that affect you.
7. Emails We Send You
We send two kinds of email to the address on your account:
- Service emails are part of running the account you signed up for, so everyone receives them: sign-in links, payment receipts and other billing notices (such as a payment failed or a change of plan), alerts you have set up yourself, and notice of important changes to the service or to our terms. We send them only when something happens.
- Product and marketing emails tell you about Statly: tips for getting more out of it, news about features, and offers, such as a discount on your first paid month. If you are on the free preview, they include up to four emails over about five days after you sign up, with your own results and a reminder when your preview ends. Otherwise, we send at most a few a month.
You can stop product and marketing emails at any time, free of charge: use the unsubscribe link in any of them, or write to info@trystatly.com. Unsubscribing stops all product and marketing emails to that address for good: we keep only a one-way hash (a scrambled code) of the address, so that it is never emailed again. Service emails, such as sign-in links and payment receipts, still come, and your account is not affected.
To send these emails, we use your email address and first name. For product and marketing emails, we also record whether each email was opened and which of its links were clicked, so that we can measure which emails are useful and stop writing to addresses that bounce.
8. Legal Basis
We rely on the following legal bases under Article 6 GDPR:
- Contract: to provide the web app, the extension and your subscription, including the service emails that are part of running your account.
- Consent: for analytics and advertising cookies, and for product and marketing emails where the law requires it. You can withdraw consent at any time.
- Legal obligation: to keep billing and tax records.
- Legitimate interests: to keep the service secure, prevent abuse, understand and improve Statly, measure our advertising in aggregate, tell customers and free preview users about Statly by product and marketing email, and provide our customers with research on public accounts. We have balanced these interests against your rights, and you may object at any time, including to product and marketing emails as described in Section 7.
9. Cookies and Analytics
Our website and web app show a cookie banner. Google Analytics and Google Ads run only if you accept them. We also set a strictly necessary cookie, statly_consent, for six months, so that the website and the app respect the same choice.
We use our own analytics tool on the website and the web app. It records the pages you visit, how you arrived (including ad campaigns), your approximate location (country, region and city), your browser and device, and time on page. When you sign up or sign in, it records a one-way hash of your email address so that we can tell which visits led to an account. If you accept cookies, it sets a visitor cookie (_sv, up to 400 days) and a session cookie (_ss, 30 minutes); if you do not, it sets no cookies and recognises a visitor for one day only. It does not store IP addresses.
10. Who We Share Data With
We share personal data only with service providers who process it for us, under contract:
- Cloudflare, which hosts Statly and its databases;
- an email delivery provider, which sends our emails on our behalf (Section 7);
- public social media data providers, which receive only a public handle or account ID, never anything about our customers;
- Google, for analytics and advertising (with consent), the uninstall survey, website fonts and the website's free AI tools;
- Groq, for the website's free AI tools;
- a consent management provider, for the cookie banner;
- Telegram, for internal notices to our team about subscriptions and failed payments.
We never sell email addresses or share them for anyone else's marketing. Lemon Squeezy is the Merchant of Record for all payments and processes your payment data as an independent controller under its own privacy policy. We may also disclose data where the law requires it. On request, we will tell you the name of any provider that has received your data.
11. Services You Connect
If you connect Slack, Discord or Telegram for alerts, an AI assistant through our MCP connector, or a transcription provider in the extension, we send the data you ask for to that service. That service then handles it under its own terms and privacy policy, and is not our processor.
12. Website Free Tools
The free AI tools on our website send the text or file you submit to Groq or Google to produce the result. We do not store your submission. To prevent abuse, we use Cloudflare Turnstile and keep a daily counter per IP address, deleted after two days.
13. International Transfers
Some of our providers process data outside the European Economic Area, including in the United States. Where they do, we rely on the safeguards the GDPR provides for, such as an adequacy decision or the European Commission's Standard Contractual Clauses.
14. How Long We Keep Data
- Your account and workspace data: while your account exists. After you cancel, we keep it so that you can resume, unless you delete your account. We may delete accounts that have been inactive for a long period, after notice.
- Email records (which emails we sent you, and whether they were opened and clicked): while your account exists.
- Opt-out records: if you unsubscribe from product and marketing emails or delete your account, we keep only a record of the opt-out (a one-way hash of your email address), so that we never send you marketing email again.
- When you delete your account: your account, sign-up, workspace, usage, connection and email data are deleted at once. We keep only a one-way hash of your email address, to make sure each person gets only one free preview and to record your opt-out, and records of our own data-provider costs that no longer identify you.
- Billing records: as long as tax law requires.
- Creator data: while at least one customer account tracks the account, or a customer has saved the video to their Library. Count history is limited to the most recent readings.
- Analytics records: up to 400 days.
- Rate-limiting data: a few days at most.
- Support emails and bug reports: as long as needed to resolve the matter.
- Extension data on your device: until you uninstall the extension. Synced Pro content is kept while the licence is active, or until you ask us to delete it.
15. Your Rights
You have the right to access, correct, delete, restrict, object to the processing of, and receive a copy of your personal data, and to withdraw consent at any time. In the web app you can export your tables to CSV and delete your account yourself under Settings → General → Danger zone. For anything else, email info@trystatly.com; we will reply within one month. You also have the right to complain to the Hellenic Data Protection Authority (dpa.gr) or your local authority.
If you are a creator whose public account is tracked, you have the same rights even though you are not our customer. Write to us from an address connected to the account, or tell us how to verify it. If you object or ask for erasure, we will delete what we hold about your account, except videos a customer had already saved to their Library, and record your handle and the date of your request so that our systems never collect it again. We will not tell you which customers tracked you.
16. Security
We protect data with encryption in transit, one-way hashing of sign-in links, keys and the IP addresses our sign-in system stores, revocable sessions and keys, and checks that every request only reaches the workspace it belongs to. No system is completely secure, but we collect as little as possible to limit the risk.
17. Children
Statly is not intended for anyone under 16, and we do not knowingly collect their personal data.
18. Changes to This Policy
We may update this policy as Statly changes. The date at the top shows the latest version, and we will email web app customers about material changes before they take effect.
19. Contact
Miltiadis Themelis, Greece. Email: info@trystatly.com