Trust centre

Data collected

Ojea account (email), public Instagram profiles you choose to watch, snapshots, derived events, notification preferences, Stripe billing data, consent logs.

Private accounts

A private profile is refused at analysis. Ojea does not bypass any Instagram restriction, does not ask for credentials, and does not promise “read-only” access to a closed account.

Data not collected

No Instagram password. No Instagram session. No bypassing of CAPTCHA or account restrictions.

Encryption

HTTPS in transit. Secrets kept off the frontend. Supabase service role key on the server only.

Retention

Snapshots follow the plan’s history length, then are aggregated or deleted.

Payments

Stripe. Ojea does not store card numbers.

Analytics

PostHog EU, after consent. Watched usernames are not sent.

Certifications

No ISO 27001 or SOC 2 certification is claimed until a real audit exists.