Privacy Policy

Last updated July 21, 2026

How Zomler collects, uses, shares, and protects information, including the public social-media data we analyze and the data you provide when you connect an account or become a customer.

This Privacy Policy explains how Zomler, Inc. (“Zomler,” “we,” “us”) handles personal information in connection with the Zomler website and services (the “Services”). We designed the Services around a simple principle: creators should own the story their data tells. This policy tells you what we collect and the choices you have, whether you are a registered user, a creator whose public profile appears on Zomler, or a brand using Zomler to evaluate creators.

01Who we are

Zomler is operated by Zomler, Inc.. For any privacy question, or to exercise your rights, contact us at support@zomler.com. If you represent a supervisory authority or need our data-protection contact, use the same address and mark it for the attention of the Privacy Team.

02Scope and key definitions

This policy uses a few terms consistently, because Zomler handles three different data flows and they carry different rights and obligations:

Public Data, information that is already publicly available on a platform such as Instagram or YouTube (public profile fields, public posts, and the engagement counts shown on them).
Connected-Account Data, information we receive from an official platform API after a creator explicitly connects and authorizes their own account.
Tracked Profile / Creator, a person or account whose Public Data appears on Zomler, whether or not they are a registered user.
User / Customer, a person who registers for an account or subscribes to a paid plan.

03Information we collect

Information you provide. When you register, subscribe, or contact us, we collect your email address, account credentials, billing details (processed by our payment provider, we do not store full card numbers), and the content of your messages and support requests.

Public social-media data. We collect information that is publicly available about creator profiles on supported platforms, public profile fields (username, display name, bio, avatar, verification status, follower and post counts) and the public posts and engagement metrics shown on those profiles. We do not access private messages, private accounts, or any content that is not publicly visible, and we do not attempt to log in as any account to collect it. If a creator makes their account private on the source platform, we stop collecting new Public Data about it.

Data from accounts you connect. If a creator connects an account through an official platform API (for example, the Instagram or YouTube APIs), we receive the data covered by the permissions granted at connection, which may include audience demographics, reach and impressions, and content insights. We request only the scopes needed to provide the feature, and access can be revoked at any time (see the Data & Removal Requests page).

Data collected automatically. Like most websites, we collect device and usage information (IP address, browser type, pages viewed, referring URLs) through cookies and similar technologies. See our Cookie Policy.

04How we use information

Provide, operate, and improve the Services, including generating analytics and verified profiles.
Create and maintain your account and process payments.
Compute benchmarks and comparison metrics across accounts.
Communicate with you about your account, updates, and support.
Detect, prevent, and address fraud, abuse, and security issues.
Comply with legal obligations and enforce our terms.

05Legal bases for processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Contract, to provide the Services you sign up for.
Consent, for connected-account data (which you authorize), non-essential cookies, and marketing.
Legitimate interests, to process Public Data in order to provide creator analytics and a professional discovery tool. We have weighed this interest against the rights of tracked creators: we use only already-public information, we provide a clear removal mechanism, and we do not process sensitive data for this purpose. Because Public Data concerns a large number of profiles, individually notifying each one is not possible; this policy and our removal page serve as that notice.
Legal obligation, where processing is required by law.

07Meta Platform data (Instagram and Facebook)

If you connect an Instagram professional account or a Facebook Page to Zomler, we receive data from Meta under the permissions you grant at the moment you connect. We ask for the narrowest set that makes the features work, and we tell you here exactly what each one is for. You can review or withdraw any of it at any time from your Facebook or Instagram settings.

The permissions we request, and why:

instagram_basic / instagram_business_basic — your account ID, username, profile picture, follower and media counts, and your posts. This is what a media kit and an engagement rate are computed from.
instagram_manage_insights — reach, views, interactions, saves and shares for your account and your posts, and the age, gender, city and country breakdown of your own audience. Meta only provides audience demographics for the account that authorised us, never for anyone else.
pages_show_list and pages_read_engagement — to find the Facebook Page linked to your Instagram professional account, which Meta requires in order to read Instagram data through this route. We do not post to your Page.
instagram_manage_comments — to show comments on your posts and, where you ask us to, reply to them.
instagram_manage_messages / instagram_business_manage_messages— to show and reply to conversations a brand has started with you, or you with them. Meta's rules mean we can only participate in conversations the other person began; Zomler cannot and does not send unsolicited direct messages.
instagram_content_publish — only if you use scheduling, and only to publish the content you have composed yourself.
Business Discovery— where available, we use Meta's Business Discovery endpoint to read the public profile and public post metrics of Instagram professional accounts. This returns only information Instagram already displays publicly, and never audience demographics, email addresses or private data belonging to those accounts.

What we do not do with Meta data. We do not sell, license or transfer it to data brokers or advertising networks. We do not use it to build or augment profiles of people who have not authorised us. We do not use it to make or inform decisions about eligibility for credit, employment, housing, insurance or similar benefits. We do not use it for surveillance purposes, and we do not attempt to re-identify or de-anonymise it.

Retention and deletion. We keep connected-account data while you have a Zomler account, so that your history remains available to you. Disconnecting inside Zomler revokes our access and stops any further syncing; it does not by itself erase what we already hold.

To have it erased, either remove Zomler from your Facebook apps settings and choose to delete the data — Meta notifies us automatically and we delete everything we received, including the access token, then give you a confirmation code to check at zomler.com/data-deletion — or ask us through the removal request form. Either route is actioned within 30 days, and we also delete connected-account data when you close your Zomler account.

Connecting an account is entirely optional. Zomler's public analytics work without it — connecting is what adds your own audience demographics and post-level insights, which Meta provides only to the account holder.

08Third-party platforms and API compliance

When a creator connects a Meta account, our use of that data complies with the Meta Platform Terms and Developer Policies, and we do not transfer platform data to data brokers.

Zomler uses YouTube API Services. By using YouTube-powered features you agree to the YouTube Terms of Service. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google’s handling of your information is described in the Google Privacy Policy. You can revoke Zomler’s access to your Google account at any time via Google security settings.

09Cookies and tracking technologies

We use cookies and similar technologies to run the site, remember your preferences, and understand usage. You can control non-essential cookies through our consent banner and your browser. Full details, including the categories and providers we use, are in our Cookie Policy.

10Data retention

We keep personal information only as long as needed for the purposes above: account data for the life of your account; billing records for the periods required by tax and accounting law; and Public Data for as long as a profile is tracked, subject to removal requests. Historical snapshots may be retained to power trend charts, and are deleted or anonymized when no longer needed.

11International data transfers

We may process and store information in countries other than your own. Where we transfer personal data internationally, we use appropriate safeguards such as Standard Contractual Clauses or an equivalent lawful transfer mechanism.

12Data security

We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

13Your privacy rights

GDPR / UK GDPR. Subject to conditions, you have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to lodge a complaint with your supervisory authority.

California (CCPA/CPRA). California residents have the right to know, delete, and correct personal information, to opt out of sale/sharing (we do not sell or share as defined), and to not be discriminated against for exercising these rights.

To exercise any right, contact support@zomler.com. We respond within the timeframe required by applicable law (generally within 30 days for GDPR requests) and may need to verify your identity first.

14Removal and opt-out for tracked creators

If your public profile appears on Zomler and you are not a registered user, you can still ask us to remove it. Anyone may request removal of their public profile, and we honor verified requests. See the Data & Removal Requests page for how to submit a request and our response timeframe.

15Children’s privacy

The Services are not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where a higher age applies). If you believe a child has provided us personal information, contact us and we will delete it.

16Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “last updated” date and, where appropriate, provide additional notice.

17Contact us

Questions about this policy or your data? Email support@zomler.com.