Privacy Policy
Last updated 2 September 2026
Ostryno is operated by Muhammad Mudassir, a sole trader based in Pakistan, who is the data controller for the personal data described here.
What we collect
Account data
Your email address, a hashed password, and your plan. We never store your password in readable form.
Waitlist data
If you join the waitlist we store your email address, the page you signed up from, and the date. We use it once, to tell you the product has opened, plus occasional progress updates. Every message has an unsubscribe link.
Usage data
The handles you analyse, when you analysed them, and the resulting reports, so we can show your history, meter credits, and cache results for 24 hours.
Payment data
We never see or store your card details. Payments go through Paddle, our merchant of record. We receive only a subscription identifier, plan status, and the last four digits and brand of the card for display.
Analytics
Privacy-friendly, aggregate page analytics with no cross-site tracking and no advertising cookies.
Data about creators you analyse
When you analyse a creator, we retrieve publicly available profile and post metrics for that account from the official Instagram Graph API and YouTube Data API. This is public information published by the account holder on a public platform.
We retain it only as long as needed to serve your report and its 24-hour cache, plus your report history. We do not build creator profiles for sale, do not sell creator data to third parties, and do not enrich it with data from other sources.
If you are a creator and want data about your account removed from our systems, email us and we will delete it.
Why we are allowed to process it
- Performing our contract with you — running your account, generating reports, taking payment.
- Legitimate interests — keeping the service secure, preventing abuse, and understanding aggregate usage.
- Consent — waitlist and product emails. Withdraw it at any time.
- Legal obligation — keeping transaction records where tax law requires.
Who we share it with
We use a small number of processors, and share only what each one needs:
- Paddle — payments, invoicing and sales tax, as merchant of record.
- MongoDB Atlas — database hosting.
- Vercel — application hosting.
- Amazon Web Services (Bedrock) — generating the written analysis. Only the computed metrics for a report are sent. Your email address and account details are not.
- Our email provider — sending transactional and waitlist email.
We do not sell personal data. We do not share it for advertising.
International transfers
We operate from Pakistan and our providers operate in the United States and the European Union, so your data is transferred internationally. Where that involves personal data of people in the UK or EEA, transfers rely on the providers' standard contractual clauses.
How long we keep it
- Account data — while your account is open, then 30 days.
- Reports and history — while your account is open, then 30 days.
- Cached creator data — 24 hours.
- Waitlist emails — until you unsubscribe or we close the waitlist.
- Billing records — as long as tax law requires.
Your rights
You can ask for a copy of your data, correct it, delete it, or object to processing. Email hello@ostryno.com and we will respond within 30 days. Deleting your account removes your data on the schedule above.
Cookies
We use a session cookie to keep you signed in. That is strictly necessary for the service to work. We do not use advertising or cross-site tracking cookies.
Security
Traffic is encrypted in transit over HTTPS. Passwords are hashed. Access to production data is limited to the operator. No system is perfectly secure, and we will tell affected users promptly if a breach affects their data.
Children
The service is for business use and not intended for anyone under 16. We do not knowingly collect data from children.