Privacy policy

Account information includes email, password hash, registration IP and supported Telegram identity identifiers. We store notification preferences and support correspondence or routing identifiers needed to answer you. Passwords, session refresh tokens and API keys are stored as hashes, not recoverable plaintext.

Sessions include expiry, last-seen IP and browser user agent. Request records may include request identifiers, endpoints, paths, query parameters, customer and key identifiers, IP addresses, status, timing, charges and bounded diagnostic information. Queried Instagram usernames or identifiers may therefore appear in operational logs.

Cryptocurrency deposits are processed by a third-party cryptocurrency payment processor. It receives the deposit amount, currency, network, an order identifier and the on-chain transaction; we do not share your email or account details with it. Deposit records include coin, address, received amounts and transaction identifiers. The ledger records deposits, bonuses and call charges. On-chain addresses and transactions are public and may remain permanently visible; account deletion cannot remove blockchain records.

For new accounts we record the version of the terms and policies accepted at registration, a digest identifying their text, the server receipt time, signup method, IP address and browser user agent. These records provide evidence of the agreement and notices presented. We retain them while needed for the contract and applicable legal claims, subject to your rights and statutory requirements. Acknowledging a privacy notice is not blanket consent to processing.

Where applicable, account operation, authentication, requested API delivery, billing and essential notices rely on performance of our contract. Necessary security, fraud prevention and reliability diagnostics rely on legitimate interests, subject to balancing affected individuals’ rights. Statutory recordkeeping relies on legal obligations. Processing requiring consent must use valid consent.

You choose a query and we retrieve corresponding Instagram data. We do not claim that every item is accessible without authentication. The API is not a guarantee of permission to collect or reuse information. We do not maintain a response database or archive for customers to search. Operational records can contain queried identifiers and limited error information.

Private-account requests may be refused with 403 private_account. Availability depends on endpoints, source responses and access restrictions. We do not ask for or accept your Instagram credentials. You are responsible for the purposes, lawful basis, retention and disclosures you choose after receiving data. These obligations do not remove our own statutory responsibilities.

Contact support@herascrape.com about processing of your information, including access, erasure, restriction or objection where applicable. Provide the relevant username or identifier, never a password. We investigate what we process and what action is available. We cannot erase Instagram’s records or independent customer copies. Public visibility does not itself remove privacy rights.

Resend receives email addresses and message content for delivery. Cloudflare Turnstile processes technical browser and connection signals, including IP address, TLS fingerprint, User-Agent, sitekey and associated origin, for bot detection; Cloudflare also processes signals to improve Turnstile as described in its privacy notice. Telegram handles login identity, bot messages and community interactions. A third-party cryptocurrency payment processor handles deposits as described above. Hosting and operational providers may process data necessary to run the service. We disclose information when legally required or necessary to protect safety or establish or defend claims.

Providers may process information outside your country. Where law restricts transfers, appropriate safeguards or another valid transfer mechanism are required. Contact us for relevant processing locations and safeguards.

Account information is retained while necessary to operate the account. Operational records are retained as needed for security, billing and diagnostics. Financial records may survive account closure where legally required. Deletion requests are assessed against legal retention and legitimate claim-preservation requirements. Session expiry or key revocation does not necessarily immediately erase the record.

Depending on applicable law, you may request access, correction, erasure, portability, restriction or objection, and withdraw consent where relied on. We may verify identity proportionately and explain lawful limitations. We respond within statutory deadlines, normally one month for GDPR requests, and explain any permitted extension. You may complain to the competent data-protection authority.

We use hashing, encrypted transport and restricted operational access. No system guarantees absolute security. Breach notifications follow applicable law. The service is intended for adults; report accounts created by children. We update this notice when processing changes and provide appropriate notice of material changes. We do not currently use advertising trackers or third-party frontend analytics. See the cookie policy.

support@herascrape.com, or @herascrape_support_bot on Telegram.