Social-238 Privacy Notice

Last updated 2026-10-26 · Not legal advice: this notice explains, in plain words, what data we hold and what you can do about it.

1. Who we are and how to reach us

Social-238 is a service operated by the operator of the radar, an individual established in Argentina ("we", "us"), based in Argentina. We decide what data is collected and why, so we are the controller of that data.

• Privacy contact: hello@social238.com. Every request about your data goes there, or through the removal form.
• We have not appointed a data protection officer. The address above reaches the person in charge.
• We have no representative in the European Union yet (GDPR Article 27). We will appoint one before we list creators in the European Union on a regular basis or serve customers there.

This notice covers two groups of people: creators whose public accounts are in our list (sections 2 to 5), and the people who use Social-238 for a customer (section 6). Our contract with customers is in the terms of service.

2. Creators: where your data comes from

If you are a creator, we did not get your data from you. This section is the notice the law asks us to give you in that case (GDPR Article 14).

• Public TikTok and Instagram profile pages and public posts.
• Meta's official Business Discovery interface, which returns the public fields of Instagram business and creator accounts.
• Public web search results, used only to find signals of where an account is based.

We read these pages the way any visitor can see them, without logging in, and we never cross a login wall. Some public pages are read for us by data providers under the same rules (section 8). We stop reading when a platform blocks us. We never read private accounts, private messages or anything shown only to followers.

3. Creators: what we hold about you

• Your handle and display name.
• The address (URL) of your profile picture. We do not store the image.
• Your bio text and the links in it.
• Follower counts, posting dates and counts, and view counts, with their history by day.
• A place inferred from public signals: town, region, country and sometimes neighbourhood. It can be wrong, and it is marked as not known when we are unsure.
• An apparent-age band estimated from public video, such as "16 to 30" or "over 30". We keep the band only. We never create or store a face template, a face embedding or any other biometric code. It is not a verified age.
• Your account on the other network, when public signals show it is yours.
• Engagement scores that we compute from the public counts.
• Our judgment of whether the account is one real person, or a business, a page, a band or another kind of account.
• Contact details (such as an email or phone number) only when you published them in your profile yourself.

We do not collect sensitive data on purpose (health, religion, political opinion, sexual life, ethnic origin). If something like that appears in a bio, we do not use it as a filter or a score.

4. Creators: why we use your data

We use it for one purpose: to help businesses find creators to work with, for example a brand looking for creators in a city, or an app team tracking how creators' audiences respond. Businesses reach the list by subscription, through our web page, a CSV export or an API.

We do not use your data for advertising, we do not sell it to data brokers, and we do not make decisions about you that have legal or similarly serious effects.

5. Creators: the legal grounds we rely on

European Union and United Kingdom. We rely on legitimate interest (GDPR Article 6(1)(f)). That means we weighed our interest against yours. A summary of that balancing test:

You can object at any time (section 10). When you do, we stop and remove your account.

Argentina. Under Law 25.326, data taken from sources of unrestricted public access may be processed without consent (Article 5(2)(a)), and the same rule allows sharing it with customers without consent (Article 11(3)(b)). The registration of our database with the Agency for Access to Public Information (AAIP) is pending.

Brazil. Under the LGPD we rely on legitimate interest (Article 7, IX), with the same balancing test as above, and on the rules for data the person made publicly available (Article 7, paragraph 4). We do not use legitimate interest for sensitive data, and we do not use sensitive data.

California. Because we sell access to data about people who have no direct relationship with us, California law treats us as a data broker. We will register with the California Privacy Protection Agency before we sell data about people in California. That registration is pending. Once registered, we will also act on the deletion requests that reach us through the state's Delete Request and Opt-out Platform (DROP). Californians have the rights in section 9.

Other countries. We follow each country's rules on publicly available data, and we honour every removal request, wherever it comes from.

6. Customers: the people who use Social-238

For each person who uses Social-238 on behalf of a customer, we hold:

• Email address, name and organisation.
• Sign-in events (when and from which account).
• API key hashes. We never store the key itself.
• Usage logs: which key, which operation, how many results. We never log the answer.
• Invoices and payment records.

We use this data to provide the service, keep it secure and bill for it. The legal ground is our contract with you (GDPR Article 6(1)(b)), and for invoices our legal obligations (Article 6(1)(c)). We keep it while the account is open. Invoices are kept for as long as Argentine tax and commercial law requires.

7. How long we keep data

• Creator data: kept while the profile stays public and we keep reading the account.
• A profile that was deleted or made private on the platform, or that we have not been able to read for 12 months, is taken out of what we sell and then deleted.
• A removed handle stays on our suppression list indefinitely, holding only the handle and the network, so we never read it again.
• Records of privacy requests (what was asked, when, and what we did): 3 years.
• Customer data: as in section 6.

8. Who receives data

• Customers, under our terms of service. They must pass on every removal we send them.
• Hosting providers that store and run the service for us: Supabase, Cloudflare, Oracle Cloud, Google Cloud and Microsoft Azure. Their servers are in South America and the United States.
• Providers that read public pages, run web searches or run AI analysis for us: ScrapeCreators, Apify, Bright Data, Serper, Google (Gemini) and Anthropic (Claude). Most of their servers are in the United States.

We do not sell data to data brokers, and we show no ads. Argentina is recognised by the European Union as giving adequate protection. When data goes to the United States, we rely on our providers' standard contractual clauses (GDPR Article 46).

9. Your rights

Depending on where you live, you have these rights:

• European Union and United Kingdom (GDPR): access, rectification, erasure, restriction, objection and portability, and the right to complain to your supervisory authority.
• Argentina (Law 25.326, Articles 14 to 16): access, rectification, update and suppression. You may use the right of access free of charge at intervals of no less than six months, unless you show a legitimate interest in asking sooner (Article 14, paragraph 3). The AGENCY FOR ACCESS TO PUBLIC INFORMATION, as the Control Body of Law No. 25.326, has the power to handle the complaints and claims filed by anyone whose rights are affected by a breach of the rules in force on personal data protection.
• Brazil (LGPD, Article 18): confirmation that we hold your data, access, correction, anonymisation, blocking or deletion, portability, information on who receives it, and objection. You may complain to the National Data Protection Authority (ANPD).
• California (CCPA as amended by the CPRA): to know what we hold, to delete, to correct, and to opt out of the sale of your data. We will not treat you differently for using these rights.

10. How to use your rights

• Use the removal form, or write to removals@social238.com.
• A removal hides your account within a day everywhere: in the list, in the recent-changes layer, in the API and in every export. We pass it on to customers, and your handle goes on the suppression list.
• We check that the request comes from you: a reply sent from the account in question, or another simple proof that it is yours. We ask for no more than we need.
• There is no fee.

How fast we answer:

• GDPR: within 1 month.
• Argentina: 10 calendar days for access; 5 business days for rectification, update or suppression.
• Brazil: within 15 days.
• California: within 45 days.

If you are not happy with our answer, you can complain to the data protection authority where you live or work: in Argentina the AAIP, in Brazil the ANPD, in the European Union your national authority, in California the California Privacy Protection Agency.

11. Cookies and browser storage

Our page keeps only your sign-in session and a few page settings in your browser's local storage. We use no analytics and no third-party cookies. Cloudflare serves the page, and like any web host it processes technical data such as your IP address to deliver it.

12. Children

• No one who may look under 16 is listed in anything we sell.
• A creator under 18 may be listed when they keep a public account.
• A parent or guardian can ask us to remove a child's account through the removal form or at removals@social238.com.

13. Changes to this notice

Every version is dated at the top. We tell customers about a material change 30 days before it applies.