This policy explains what data is collected when you use Bazarscope, what it is used for, who it is shared with, and your rights. The operator of the service, [Şirkətin hüquqi adı] (TIN [VÖEN], [Hüquqi ünvan], Bakı, Azərbaycan), processes your personal data in accordance with the Law of the Republic of Azerbaijan “On Personal Data”. For questions: [privacy@domen.az].
1What data we collect
Account data. At sign-up: your email address, your name (optional) and your password. The password is stored only in a non-reversible form (argon2 hash); we cannot see it either. If you sign in with Google, we receive your email, your name and your Google account's permanent identifier from Google. We do not see your Google password.
Security data. Last sign-in time, the IP address and browser details (user agent) of sessions. These are used to protect your account, detect suspicious sign-ins and apply request limits.
What you enter. The Instagram account names you add for analysis (your own business and competitors), website addresses, keywords, posts in the content calendar, texts and the images you upload.
Public business data. For the accounts you add, only publicly visible data:
- Instagram: profile (name, picture, follower count, bio link), posts and their statistics, comment text, date and like count;
- Meta Ad Library and Google Ads Transparency: public ads;
- the public page of the website shown in the bio.
We do not store commenters' usernames or profiles. No password is required and we never sign in to any Instagram account.
Usage data. Credit transactions (which feature was used and when) and the technical logs needed to run the service.
2What we use the data for
- to create your account, recognise you and let you sign in;
- to compare your account with your competitors and prepare statistics, summaries and the weekly report;
- to analyse comments with AI (tone, topics, questions, complaints) and create content ideas and a marketing plan;
- to send service emails: confirmation, password reset, the weekly report and credit alerts;
- to publish your posts on Instagram when you connect it;
- to protect the service, find errors and prevent abuse.
We do not sell your data or use it for advertising.
3Who we share it with (service providers)
We use the following providers to deliver the service. They process data only on our instructions and under their own privacy terms.
- Apify (Czech Republic, EU): collection of public Instagram, Meta and Google data. Only account names and search terms are sent to it.
- Anthropic (USA): comment texts, statistics and post texts for AI analysis. Under Anthropic's commercial terms this data is not used to train its models.
- Google: “Sign in with Google” and keyword statistics (Google Ads Keyword Planner).
- Post for Me: only if you connect automatic publishing to Instagram; the texts and images to be published.
- Email provider (SMTP): delivery of service emails.
- Hosting provider: servers and the database.
- Payment provider (once online payment is added): you enter your card details directly with them; we do not see or store the card number.
Some providers are located outside Azerbaijan (EU, USA), so data may be transferred to these countries. Where required by law, we may provide data to the competent public authorities.
4Cookies and browser storage
We use only the cookies the service needs to work:
access_token: keeps you signed in, valid for 15 minutes;refresh_token: renews the session for up to 30 days;g_oauth: a 10-minute security check during Google sign-in.
Your browser stores only the theme you chose (light or dark) and the interface language. We use no analytics, advertising or tracking cookies.
5How long we keep it
- Account data and your workspace (brands, competitors, calendar, reports) are kept as long as your account exists.
- Public Instagram statistics are kept for the comparison history and may be deleted once no workspace follows them.
- Backups are kept for 14 days and then deleted automatically.
- Technical logs are kept for a short time and rotated automatically.
6Your rights
At any time you can:
- find out what data is stored about you and get a copy;
- ask for incorrect data to be corrected;
- ask for your account and all your data to be deleted;
- opt out of the weekly report emails (Reports section);
- withdraw your consent.
To do this, write to [privacy@domen.az] from the email you signed up with. We reply within 30 days. If you think your rights have been violated, you can also contact the competent public authority.
7Security
All connections are encrypted with HTTPS. Passwords are stored as hashes, and API keys saved in the admin panel are encrypted (AES-256-GCM). The site is protected with strict security headers. The database is reachable only from the internal network. No system is 100% secure. If a data breach occurs, we notify you and the relevant authorities as required by law.
8Businesses' request forms
Businesses that use Bazarscope can create a request form (bazarscope.com/f/…) for their own customers. The person filling in the form enters their name, phone and/or email themselves and ticks the consent box themselves.
The owner of this data is the business that created the form; Bazarscope stores it on behalf of and as instructed by that business (as a processor).
- With every request we store the exact text the person consented to, its version, the date and where the link was shared (bio, comment, DM, QR).
- The data is deleted automatically after a set period (90 days by default); the business can delete any request at any time.
- The business can download the list only in SHA-256 hashed form (a Meta Custom Audience file); plain phone numbers and emails never go into the file.
- To withdraw your consent or ask for your data to be deleted, write to the business that created the form or to us at [privacy@domen.az].
9Children
The service is for businesses and is not intended for people under 18.
10Changes and contact
We may update this policy. We give advance notice of significant changes by email or in the service. Terms of the service: Terms of use. Contact: [Şirkətin hüquqi adı], [Hüquqi ünvan], Bakı, Azərbaycan, [privacy@domen.az].