Privacy notice

1. Who we are

The controller of your personal data is [company legal name, registered address and company number to be confirmed] (“Legit Score”, “we”). [Data protection contact and any EU or UK representative to be confirmed.] Until a dedicated address is published, you can reach us through the forms on our disputes page.

2. Whose data we use, what, and where it comes from

This section is also our public notice under Article 14 of the GDPR and UK GDPR for people whose data we don’t collect from them directly. Contacting every person in an audience sample individually would be impossible or take disproportionate effort, so we publish this notice instead.

We don’t use special-category data (such as health, ethnicity, religion or political views), and we never use a creator’s format (whether they show their face, use a synthetic voice or AI visuals) as a scoring input.

3. Why we use it, and our legal basis

• Scoring audiences, so creators can show their audience is real and sponsors can plan campaigns and protect their brands. Basis: legitimate interests for public account and audience data; consent for creators who sign up, claim or connect an account.
• Running accounts and paid plans. Basis: contract.
• Handling disputes and opt-outs. Basis: legal obligation and legitimate interests.
• Waitlist and product updates. Basis: consent, which you can withdraw at any time.
• Keeping records for tax and accounting. Basis: legal obligation.

4. Our legitimate-interests assessment

Where we rely on legitimate interests, we have weighed them against your rights:

• Our interest: giving creators and sponsors an independent, explainable view of audience quality, which neither can easily get alone.
• Necessity: we use statistical samples rather than whole audiences, and only the fields the methodology needs.
• Balance: we use public data only; audience members are hashed and only reported in aggregate, so no individual follower or commenter is ever named; raw data is deleted within 30 days; scores are only shown publicly for accounts whose holder has claimed them; and anyone can object and opt out easily (section 7).

[Full assessment available on request, to be confirmed.]

5. Automated opinions

Scores are produced automatically and are opinions, not decisions. We don’t make decisions with legal or similarly significant effects about anyone, and our terms forbid customers from using a score for employment, credit, insurance or housing decisions. You can ask for a person to review a score through a dispute. How scores are made is set out in our methodology.

6. How long we keep it

• Raw platform data (posts, comments, sampled profile signals): deleted or refreshed within 30 days of collection.
• Scores and aggregate results: kept, with their engine version, so a score can be explained later, until the account is removed or opts out. They contain no identifiable audience members.
• Hashed identifiers of accounts showing automated patterns: kept as hashes only, for [retention period to be confirmed].
• Suppression list: kept for as long as needed to honour an opt-out (see below).
• Account, dispute and billing records: for as long as your account is open, then [period to be confirmed], or longer where tax law requires.
• Waitlist: until launch or until you ask us to remove you.

7. Your rights, including opting out

You have the right to object to our use of your data (Article 21). We make this easy, whether or not you have a Legit Score account:

• If you own or manage an account, you can ask us to hide its score and stop scoring it.
• If you follow or comment on accounts, you can ask us to leave you out of future audience samples.

To honour an opt-out we keep a minimal suppression record (a salted one-way hash of the platform identifier) so we don’t collect or score it again. Use the opt-out form; we aim to acknowledge it within 72 hours.

You can also ask to access, correct, delete, restrict or port your data, or withdraw consent at any time. You can complain to your data protection authority, such as the UK Information Commissioner’s Office or the authority where you live.

California residents can ask to know, delete or correct personal information. We do not sell or share personal information for cross-context behavioural advertising. [California-specific disclosures to be confirmed.]

8. Who we share it with

We use these service providers, under contracts that limit how they use your data:

• Cloudflare: Hosting, content delivery, queues and file storage
• Supabase: Database and login
• Stripe: Payments. Billing data is kept separate from scoring and is never used in a score.
• ScrapeCreators: Collection of publicly available platform data

Customers see scores and aggregate results, never the identities of audience members. We may disclose data where the law requires. Some providers process data outside your country; where they do, we rely on [transfer safeguards to be confirmed].

9. Security

We hash audience identifiers before storing them, restrict database access by role, keep billing data separate from scoring, and delete raw data on a fixed schedule. No system is perfectly secure, and we will notify you and the authorities of a breach where the law requires.

10. Children

Legit Score isn’t for children and we don’t knowingly accept sign-ups from anyone under [age to be confirmed]. Audience samples can include public accounts of any age; those are hashed and only counted in aggregate.

11. Changes

We will update this notice as the service changes and show the date of the latest version at the top. Material changes will be announced on this page before they take effect.