Privacy Policy

1. Data controller

Byebud is operated by Origin Collective Limited (company no. 16566341), 124-128 City Road, London, England, EC1V 2NX, a private limited company registered in England and Wales.

For the purposes of this Privacy Policy, references to "Byebud", "we", "us" and "our" refer to Origin Collective Limited where legally appropriate.

You can reach us for privacy questions via our Contact page. For data protection requests (access, deletion, or export of your personal data), please email us at privacy@origincollective.group.

If you are in the European Economic Area, you also have the right to lodge a complaint with your local data protection supervisory authority.

2. What ByeBud does

ByeBud is a web-based tool that helps you analyse your Instagram followers and unfollowers using Instagram's official data export feature. We do not request your Instagram password and we do not log in to your Instagram account on your behalf.

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18.

3. Information we collect and why

We process the following categories of information on the legal bases listed below.

3.1 Instagram export data you provide

When you upload your Instagram data export file (for example the JSON or ZIP you download from Instagram), we process it to calculate followers, unfollowers, and "not following back" lists.

How we handle it: Your Instagram export file is processed 100% in your browser. The file itself is never uploaded to our servers, never stored by us, and never leaves your device. The only exception is described in section 3.7: if you are a signed-in ByeBud Track subscriber, we save a short list of usernames and counts from each scan, never the file itself.

Legal basis: Performance of the contract with you (Article 6(1)(b) GDPR). You voluntarily provide the file to the browser-based tool to receive your unfollower results.

3.2 Usage analytics and cookieless baseline counting

We collect anonymised page-view data to understand how the Service is used. This is handled in two ways:

• When you accept analytics cookies: we may collect pages visited, session identifiers, approximate country or city via IP geolocation, and general device characteristics via analytics tools.
• When you reject analytics cookies or do not interact with the banner: we still collect a cookieless, anonymous "page view" count. We also anonymously count upload-error types and clicks on the one-time or ByeBud Track paywall buttons. We do not store a visitor or session identifier, do not store your IP address, and do not use cookies or device identifiers for this purpose. Nothing is stored on your device, and these events never include usernames or the contents of an uploaded file. The result is aggregated usage data with no personal identifiers. Alongside each page-view count we record only where the visit came from: the referring website's domain (for example "google.com", never the full address) and any campaign tags in the link (UTM source, medium and campaign).

Legal basis: For consent-based analytics, consent (Article 6(1)(a) GDPR), which you can withdraw or update at any time via the cookie preference link in the footer. For the cookieless baseline count, our legitimate interest in measuring site usage without identifying individuals (Article 6(1)(f) GDPR).

3.3 Contact information (optional)

If you contact us through the contact form or email, we may collect your name, email address, and any details you choose to provide. We use this information only to respond to your message.

Legal basis: Our legitimate interest in communicating with users and, where applicable, performance of any contract resulting from your request (Article 6(1)(b) or (f) GDPR).

3.4 Payment data

Payments are processed by Stripe. We do not collect or store full payment card numbers. Stripe may provide us with transaction identifiers, payment status, and billing country so we can fulfil your purchase.

Legal basis: Performance of the contract with you (Article 6(1)(b) GDPR) and compliance with accounting and tax obligations (Article 6(1)(c) GDPR).

3.5 Account email (magic-link sign-in)

If you create a ByeBud account, you sign in with a one-time link sent to your email address. There is no password. We store your email address, the date your account was created, and your subscription status so we can sign you in, manage your account and subscription, and send account and billing emails. An account is optional: the free preview and the one-time unlock work without one.

Legal basis: Performance of the contract with you (Article 6(1)(b) GDPR).

3.6 Export reminder emails (optional)

On the upload page you can choose to enter your email address if you are still waiting for Instagram to send your export. We store that address and the time you submitted it so we can send you a link to come back and analyse your file. This is entirely optional and is not needed to use ByeBud. We use this address only for this reminder and never for marketing.

Legal basis: Your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by emailing us.

3.7 Saved scan history (ByeBud Track subscribers only)

If you are signed in and have an active ByeBud Track subscription, each time you analyse your Instagram export we save the following to your account:

• the lists of follower and following usernames
• the follower, following and "not following back" counts
• the date and time of the scan

We do not save your original export file or anything else in it. This lets you see your past scans and what changed between them. Only you can see your saved scans. If you are not a subscriber, nothing from your scan is sent to us.

If you cancel or your subscription ends, we stop saving new scans. Scans you have already saved remain visible to you for 90 days after your subscription becomes inactive, after which they are automatically deleted from our servers. If you delete your account sooner, all saved scans are deleted with it. If you resubscribe within the 90 days, your saved scans stay intact.

Legal basis: Performance of the contract with you (Article 6(1)(b) GDPR).

3.8 Monthly reminder emails (ByeBud Track subscribers only)

While your subscription is active, we use your account email and your saved language to send you one short reminder each month, on the day of the month you subscribed, with a link to sign in and run a new scan. Every reminder includes a one-click link to stop these reminders, and a link to manage your subscription. Stopping reminders does not cancel your subscription.

Legal basis: Performance of the contract with you (Article 6(1)(b) GDPR). You can stop the reminders at any time.

4. Who processes your data

ByeBud uses the following processors and service providers. Each only receives the data needed to provide its service:

• Supabase — cloud hosting, database, and authentication infrastructure.
• Stripe — payment processing and checkout sessions.
• Resend — transactional, account sign-in, billing, monthly subscriber reminder, and contact-form email delivery.
• Cloudflare — security, CDN, and edge hosting.
• Endorsely — affiliate tracking (only when you click an affiliate link and consent to the relevant cookies).
• ipapi.co — approximate IP geolocation used only for analytics events.

We do not sell your personal data.

5. Data retention

• Instagram export file: Not retained at all, because it is processed in your browser and never reaches our servers.
• Account email and profile: Kept for as long as your account exists. Deleted when you ask us to delete your account.
• Export reminder emails: Kept until you ask us to delete them. We currently have no automatic deletion period for these.
• Saved scan history (subscribers): Kept for 90 days after your subscription becomes inactive, then automatically deleted. Deleted sooner if you delete your account.
• Consent-based analytics: Retained for 14 months from collection, then deleted or anonymised.
• Cookieless baseline page-view counts: Retained as aggregated statistics indefinitely. No personal identifiers are stored.
• Contact form submissions: Retained for 24 months from the date of submission, then deleted, unless a longer period is required for legal claims.
• Payment records: Retained for 7 years to comply with tax and accounting laws.

6. International transfers

Our Service is hosted by providers that may process data outside your country. By using ByeBud, you acknowledge that your data may be transferred to those locations, subject to appropriate safeguards such as Standard Contractual Clauses where required by law.

7. Your rights

Depending on your location, you may have the right to:

• Access, correct, or delete your personal data.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Data portability for data processed on the basis of contract or consent.
• Lodge a complaint with a data protection supervisory authority.

To exercise these rights, please email us at privacy@origincollective.group. Because Instagram export data is processed locally in your browser and never sent to us, we cannot delete a file we never received. You can ask us at any time to delete your account, your saved scans, or a reminder email address, and we will do so without undue delay.

8. Cookies and consent

We use a cookie consent banner to let you choose whether to accept analytics and affiliate cookies. You can change your preference at any time using the link in the footer. Essential cookies that are strictly necessary for the Service to function may be set without consent.

Our Cookie Policy lists every cookie and browser-storage item we use, what it is for and how long it lasts.

9. Security

We use reasonable technical and organisational measures to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Third-party links

ByeBud may contain links to third-party websites or services. We are not responsible for their privacy practices. We encourage you to review their policies separately.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will show when the latest changes were made. Your continued use of the Service after changes become effective means you accept the updated Policy.

12. Contact us

For privacy questions or data requests, please email us at privacy@origincollective.group.