Privacy Policy

Last updated: September 23, 2026

This policy explains what personal data Cedarfollow collects, why, who we share it with and what rights you have. We collect as little as we can: we don't need an account, we never ask for your Instagram password, and we don't use advertising trackers.

1. Who is responsible for your data

The data controller is [COMPANY LEGAL NAME], [REGISTERED ADDRESS], company number [COMPANY ID] ("Cedarfollow", "we", "us"). For any privacy question or request, email [email protected].

2. What data we collect

Data you give us when you order:

• your public Instagram username;
• your email address;
• the package you chose.

Data we create about your order:

• your order ID, order status and timestamps (when the order was created, paid and delivered);
• the Stripe payment reference (payment intent ID) and amount;
• your refill history (dates and quantities of refills requested and delivered);
• the website that referred you to us, if your browser passes it (only the domain name, for example "google.com", or "Direct").

If you leave a review: your star rating, the text you write and the display name you choose, linked to your order ID. We publish the rating, text, display name, package size and month; never your username or email.

Data handled by our service providers: Stripe processes your card or wallet details, billing information, and device and IP-derived data to take payments and prevent fraud. Cloudflare processes your IP address and technical request data to deliver the website securely and protect it from attacks. We do not receive or store your full card number.

What we don't collect: your Instagram password or login codes, your name (unless you tell us), private messages, or data from advertising trackers.

3. Why we use it and our legal bases

• To process and deliver your order, including followers, engagement on new posts, and refills (legal basis: performance of a contract, GDPR Art. 6(1)(b)).
• To send service emails: order confirmation, delivery updates and answers to your questions (performance of a contract).
• To take payments, prevent fraud and handle disputes and chargebacks (performance of a contract and our legitimate interest in protecting our business, Art. 6(1)(f)).
• To keep the website secure and running (legitimate interest).
• To understand which websites send us customers, using only the referring domain stored with the order (legitimate interest).
• To invite you to leave a review of your order, once, by email (legitimate interest; you can opt out at any time by replying to the email or writing to us).
• To keep accounting and tax records (legal obligation, Art. 6(1)(c)).

We do not sell your personal data, use it for advertising profiles, or make automated decisions about you that have legal or similarly significant effects.

4. Who we share it with

We share data only with service providers who help us run Cedarfollow, and only what each one needs:

• Stripe (payments and fraud prevention): your email, order amount and payment details. Stripe acts as an independent controller for some purposes, such as fraud prevention and legal compliance; see stripe.com/privacy.
• Cloudflare (content delivery and security): IP address and technical request data for everyone who visits the site.
• Our email provider, [EMAIL PROVIDER NAME] (sending order emails): your email address and the content of those emails.
• Our hosting provider, [HOSTING PROVIDER NAME] (the server where order data is stored).
• Third-party growth suppliers (delivering followers, likes and views): only your public Instagram username and the quantities to deliver. They never receive your email, payment details or order ID.
• Authorities or advisers, when required by law or to establish or defend legal claims.

Some of these providers are located in, or may process data in, the United States or other countries outside the EU/UK. Where that happens, transfers are protected by appropriate safeguards, such as the EU-US Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses (and the UK addendum).

5. How long we keep it

• Order data (order ID, username, email, package, payment reference, timestamps, refill history, referring domain): for as long as your order is active, which includes the lifetime refill period, so that we can provide refills. You can ask us to delete it at any time, but then we can no longer provide refills for that order.
• Accounting records (payment reference, amount, date): for as long as tax and accounting law requires, typically [RETENTION PERIOD FOR ACCOUNTING RECORDS, E.G. 5-10 YEARS], even if you ask us to delete your other data.
• Support emails: up to [SUPPORT EMAIL RETENTION PERIOD] after the conversation ends.
• Data held by Stripe and Cloudflare is kept according to their own retention policies.

6. Cookies and local storage

We do not use advertising or analytics cookies, and we do not use tracking pixels such as the Meta Pixel or Google Ads tags. We use Cloudflare Web Analytics to count page views; it does not set cookies, does not use local storage and does not identify or track individual visitors across sites. The only cookies or similar technologies involved are strictly necessary ones:

• Stripe (on the checkout page) uses cookies and device data to process payments securely and prevent fraud;
• Cloudflare may set security cookies to protect the site from bots and attacks.

Because these are essential for the site to work, they don't require your consent. If we ever add non-essential cookies, we will ask for your consent first and update this policy.

7. Your rights

Depending on where you live (including under the EU and UK GDPR), you have the right to:

• access the personal data we hold about you and get a copy;
• correct inaccurate data (for example, a changed Instagram username);
• have your data deleted, unless we need to keep it for a legal obligation;
• restrict or object to processing based on our legitimate interests, including the review invitation;
• receive your data in a portable format;
• lodge a complaint with a data protection authority, for example where you live or work. In the EU, see the list at edpb.europa.eu; in the UK, the Information Commissioner's Office at ico.org.uk.

To use any of these rights, email [email protected] from the email address on your order, including your order ID. We may ask for information to confirm it is your order. We reply within one month.

8. Security

The site is served only over encrypted HTTPS connections, behind Cloudflare. Payments are handled by Stripe, which is certified to PCI DSS Level 1, so card details never reach our server. Order lookups require both the order ID and the matching username or email. Access to order data is limited to people who need it to run the service. No system is perfectly secure, but we will notify you and the authorities of a breach where the law requires it.

9. Children

Cedarfollow is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has placed an order, contact us and we will delete the data.

10. Changes to this policy

We may update this policy when our service or the law changes. The date at the top shows the latest version. If we make a material change, such as adding a new type of data or a new recipient, we will tell customers with active orders by email.

11. Contact

[COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Email: [email protected].