Privacy Policy — Social Janitor

Data controller

PANCON is the controller of the personal data described in this Privacy Policy.

Controller: PANCON, trading as Social Janitor
Business ID: 2992028-1
Postal address: Luhtimäki 1, Vantaa, Finland
Privacy and support: Contact us

Scope of this policy

This policy applies when you visit the Social Janitor website, create or use an account, purchase or manage a subscription, join a waiting list, contact us, or use the Social Janitor web application.

Social Janitor is an independent service and is not affiliated with, sponsored by, endorsed by, or administered by Instagram or Meta. Instagram and Meta process information under their own policies. You can review the Instagram Privacy Policy separately.

Your Instagram files stay local

Social Janitor does not ask for your Instagram password.

Instagram JSON files you select are analyzed locally in your browser. The application does not send your selected files or their contents to our servers or the providers listed below as part of the import process.

Imported files may contain Instagram usernames, relationship information and timestamps. Snapshots and comparisons are stored in your browser using IndexedDB; Keep/Reviewed decisions and some interface preferences are stored using local storage. The number of free-preview list opens and whether its import allowance has been used are stored with your account on our backend so deleting local data does not restart the free preview. Social Janitor separates this product data locally by account. It is still stored on the device, not synchronized to your account or our servers. Logging out of the free preview removes its imported data and preview choices from that browser. In the Pro dashboard, open Manage local data and choose Delete all local data before signing out on a shared device.

Use Manage local data → Delete all local data in the dashboard, or use your browser settings, to erase stored snapshots, Keep/Reviewed decisions and private notes. Deleting local data does not remove your online account, subscription, Google consent choices or the original Instagram export files or portable backup files on your device. To remove all cookies and site data as well, use your browser settings.

Pro users can export a portable Social Janitor backup containing locally stored snapshots, Keep/Reviewed decisions and private account notes. The backup is created in the browser and downloaded to a location chosen through the browser; Social Janitor does not receive or store a copy as part of this process. The file is readable JSON and is not encrypted by Social Janitor. It can be restored and merged in another supported browser while you are signed in to the same Social Janitor account. Existing snapshots with the same internal identifier are kept, and the newer version of each saved decision is used.

Because this information remains on your device, you are responsible for protecting your device, exported files and portable backups, and for ensuring that your use of information concerning other people is lawful. Clearing browser data, changing browsers or devices, or using private browsing may remove local snapshots. PANCON cannot access or restore information stored only in your browser or in a backup you control. You are responsible for securely storing and deleting backup copies. If you voluntarily include an export or account information in a support request, we process what you send as support information; please do not send an Instagram export unless we explicitly ask for it.

Personal data we process

Account data

Email address, internal user identifier, authentication and session information, and account creation or update timestamps and free-preview usage. We also record signup source and whether you selected the optional marketing checkbox, including its time and consent-text version. Passwords are handled through Supabase authentication; we do not have access to your plain-text password.

Subscription and billing data

Plan, billing interval, subscription status, dates of access and renewal, cancellation setting, Stripe customer, price and subscription identifiers, and whether a paid introductory offer has been used. We may also record complimentary access when granted. Stripe processes payments and billing details; Social Janitor does not store complete payment-card numbers.

The current three-day paid introductory offer applies to eligible monthly subscriptions; annual subscriptions are billed without that introductory period. The price, renewal date and cancellation terms are shown before you confirm payment.

Lead, waiting-list and communication data

A confirmed signup email may be added to HubSpot as a CRM lead so we can administer the customer relationship. Marketing email subscription is enabled only when you select the optional signup consent. We also process name, waiting-list status, interest label and submission time, support-ticket subject, category and message, and any information you choose to include. Email-delivery data can include delivery status, bounce information and metadata.

Technical and usage data

IP address, request time, browser and device details, referrer, diagnostics and security logs generated by normal website operation. On marketing pages, Google Tag Manager loads Google Analytics 4, and Google's Privacy & Messaging CMP handles consent choices. Google services may process limited device, page-view, referrer, interaction and consent-signal data. When analytics storage is denied, GA4 operates without analytics cookies. When analytics storage is granted, GA4 may also use analytics cookies and related identifiers, as explained in section 7.

We may also create aggregate statistics that no longer identify an individual. We do not sell personal data. We do not use imported Instagram file contents for targeted advertising, data brokerage, or training AI models.

Why we process data and our legal bases

Purpose	Data	Legal basis
Create accounts, authenticate users and provide Pro features	Account, session and subscription data	Performance of a contract
Record confirmed signups and manage the customer relationship	Email, signup source and internal consent metadata	Legitimate interests in administering requested access and customer relationships
Send optional product updates and practical cleanup tips	Email and marketing-subscription consent record	Your consent
Process payments, introductory offers, renewals and cancellations	Billing and subscription data	Performance of a contract; legal obligations
Send account, security, billing and service messages	Email address and message metadata	Performance of a contract; legitimate interests
Respond to support requests and improve reliability	Communications, technical data and diagnostics	Legitimate interests in operating and improving the service
Prevent abuse, fraud and security incidents	Account, request, log and transaction data	Legitimate interests; legal obligations where applicable
Manage the Guru waiting list and requested updates	Email, source, interest label and submission data	Your consent for marketing updates; legitimate interests in managing your request
Measure and improve website use	Limited cookieless measurement data and consent signals; after consent, analytics cookie identifiers, device and usage data	Legitimate interests in limited cookieless website measurement; your consent where required for analytics storage, advertising-related Google consent signals and related cookies or local storage
Maintain accounting and legal records	Transactions, invoices and related records	Compliance with legal obligations

Where we rely on legitimate interests, we consider the necessity of the processing and its impact on your rights. Where we rely on consent, you may withdraw it at any time without affecting processing performed before withdrawal. You can change your Google consent choices using Cookie settings in the footer or stop optional email updates using the unsubscribe option in those messages or our contact form.

You do not have to upload an Instagram export to visit the website or contact us. An email address and password are needed to create an account; payment information is needed for a paid subscription; and the requested contact details and message are needed to answer a support request. Without these, we cannot provide the relevant account, paid access or response. Optional analytics and marketing updates are not required to use the service.

Service providers and recipients

We disclose personal data only where needed to provide, secure and improve Social Janitor, comply with law, establish or defend legal claims, complete a business transaction, or follow your instructions. Our main providers are:

Supabase

Authentication, account database and subscription records.

Vercel

Website hosting, server execution, network delivery and technical logs.

Privacy notice

Stripe

Checkout, payment processing, subscriptions, invoices and fraud prevention.

HubSpot

Confirmed-signup lead records, marketing preferences, support tickets, waiting-list contacts and requested communications.

Resend

Account and other service email delivery, including delivery diagnostics.

Google

Google Tag Manager deploys measurement tags on marketing pages, Google Analytics 4 provides website measurement, and Google Privacy & Messaging / AdSense provides the consent management platform. Consent Mode communicates analytics and advertising-related consent signals to Google services.

Google Privacy Policy

These providers process information under their own terms and privacy notices and, where applicable, on our behalf under data-processing terms. Their notices explain their own processing in more detail. We may replace or add providers as the service evolves and will update this policy when the change is material.

Cookies, browser storage and Google services

Social Janitor uses necessary cookies or similar storage to maintain authentication, security and core service functions. These are needed for the service to work and are not used for advertising.

Local storage and IndexedDB are also used to keep imported snapshots, comparison history, cleanup choices and certain preferences on your device. This product storage is not used to follow you across unrelated websites.

When you export or restore a portable backup, the application creates or reads the selected JSON file locally in your browser. The backup is not uploaded to Social Janitor as part of that operation.

Google Tag Manager is used on marketing pages to load Google Analytics 4, which helps us understand aggregate website usage, such as visited pages, general acquisition source, device category and interactions. For visitors in the EEA, the United Kingdom and Switzerland, Consent Mode starts with analytics storage and the advertising-related consent signals ad_storage,ad_user_data and ad_personalization denied. Google's Privacy & Messaging CMP then updates those signals according to the user's choice.

If analytics storage remains denied, GA4 may send limited cookieless measurement signals to Google but may not read or write analytics cookies. We rely on our legitimate interests in measuring and improving the website for this limited cookieless measurement. We do not intentionally send imported Instagram data to Google. You may object to this processing by contacting us. You can also use browser or content-blocking controls, although those controls are separate from the consent choices provided by the website.

If you grant analytics storage in Google's consent message, GA4 may use first-party analytics cookies and related identifiers. Google's message may also request consent for advertising-related purposes and vendors configured in Google Privacy & Messaging; those current purposes and vendors are shown under Manage options. You may refuse or later withdraw optional consent without losing access to core Social Janitor features. Withdrawing analytics consent disables analytics storage for future measurement, but existing cookies may remain until they expire or you clear the site's browser data. Withdrawal does not undo data already processed while consent was active.

Use the Cookie settings link in the website footer to reopen Google's consent message and review or change your choices at any time. We do not intentionally send imported file contents, Instagram usernames, passwords or complete payment details to Google Analytics. More information is available on our Cookies & Browser Storage page.

You can also delete cookies and site data through your browser. Doing so may sign you out and permanently delete snapshots stored only in that browser.

How long we keep data

Local Instagram data: remains in your browser until you use Manage local data → Delete all local data or clear site storage. Portable backups remain wherever you choose to store them until you delete them. We do not receive or control copies in your original export or portable backups.
Account and subscription records: retained while an account or subscription is in use, then reviewed for deletion when no longer needed for closure, security, legal obligations or disputes. Subscription records needed to administer an active subscription cannot be deleted while the subscription is running.
Free-preview usage: retained with the account to enforce the one-time preview allowance and prevent it from being reset by deleting browser data.
Billing records: kept for the periods required by applicable accounting, tax and consumer laws.
CRM lead and waiting-list data: retained while needed to administer the customer relationship or requested updates. Marketing subscription records are updated when you unsubscribe, and a suppression record may be retained to honour that choice. Waiting-list data is kept for the requested launch updates until the list has served its purpose or you unsubscribe.
Support tickets and security logs: reviewed for deletion once a request is resolved or a security purpose ends, unless a dispute or legal obligation requires longer retention.
Analytics and consent data: cookieless measurement and consented analytics data are retained according to our configured Google Analytics data-retention setting; Google may also retain consent records according to its CMP and service settings. Some aggregated reporting data may remain longer.

Exact periods depend on the record, legal duties, disputes and provider settings. Contact us for the applicable period or criteria for a specific record. Copies of server-side records may remain in service-provider backups for a limited time after deletion. This is separate from portable backup files stored by the user. We may retain information that has been irreversibly anonymized.

International data transfers

Some providers process account, payment, communication, analytics or technical data outside the European Economic Area, including in the United States. For example, Resend states that its account data, email metadata, logs and API records are stored in the United States even when emails are sent from its EU region. This does not change the fact that imported Instagram files remain in your browser.

Transfers outside the EEA require an applicable legal basis for the transfer, such as an adequacy decision or appropriate safeguards. The mechanism depends on the provider and destination. Contact us for details of the applicable mechanism and how to obtain a copy of its safeguards. Provider notices are linked above; Resend explains its sending regions and data residency separately.

Security

We use reasonable technical and organizational safeguards intended to protect personal data, including access controls, encrypted network connections, managed authentication and restricted server-side credentials. Payment-card details are entered into Stripe's systems, not stored directly by Social Janitor.

No online service or storage method is completely secure. You should use a unique password, protect access to your email account and device, and keep downloaded Instagram exports and portable backups secure. If you believe your account or data may have been compromised, contact us promptly.

Your data-protection rights

Subject to applicable law, you may have the right to:

access personal data we hold about you;
correct inaccurate or incomplete data;
request deletion of your data;
restrict or object to certain processing;
receive data you provided in a portable format;
withdraw consent at any time; and
lodge a complaint with a supervisory authority.

To exercise a right, use our contact form or write to the postal address below. We may need to verify your identity. We normally respond within one month; applicable law allows an extension for complex or numerous requests. Some rights are subject to exceptions, including our legal record-keeping obligations.

We cannot access Instagram snapshots that exist only on your device or in a portable backup you control. To remove browser copies, use Manage local data → Delete all local data; delete separately stored backup files yourself.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman. You can find complaint and contact information at tietosuoja.fi.

Social Janitor does not use your imported Instagram relationships to make solely automated decisions about you with legal or similarly significant effects. Payment and fraud-prevention providers may conduct their own checks; see their notices above.

Children's privacy

Social Janitor is not directed to children, and we do not knowingly collect personal data from children who cannot lawfully provide it or enter into the relevant agreement. If you believe a child has provided personal data to us, contact us so that we can investigate and take appropriate action.

Changes to this policy

We may update this Privacy Policy when the service, providers or legal requirements change. The latest version will be posted on this page with a revised “Last updated” date. We will provide an additional notice when a change is material or when consent is required by law.

Contact us

For privacy questions, requests or security concerns, contact:

PANCON, trading as Social Janitor
Business ID: 2992028-1
Luhtimäki 1, Vantaa, Finland
Send a privacy request