Privacy policy

Last updated: November 3, 2026

This is a translation provided for convenience. In the event of any discrepancy, the French version prevails.

This policy describes how NOVSTR collects, uses and protects personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act. It applies to NOVSTR users (creators and professionals), people who contact us, and creators analysed by a professional without having an account themselves.

1. Data controller

The data controller is NOVSTR, a French simplified joint-stock company with a single shareholder (SASU) with a share capital of €1,000, whose registered office is at 7 avenue Victor Hugo, 64200 Biarritz, registered with the Bayonne Trade and Companies Register under number 130 572 340. Contact for any data-related question: contact@novstr.com. NOVSTR has not appointed a data protection officer (DPO), as this is not mandatory for its activity.

2. Data we process

a) Account data

Email address and, if you provide it, your name
Password, stored hashed (never in plain text)
Account type (creator or professional), organisation and role within it
Date of acceptance of the terms of use and age declaration (18 or over)
If you sign in with Google: the email address and name provided by Google

b) Data from a connected Instagram account (creators)

The connection is made read-only through our partner InsightIQ / Phyllo, with your explicit consent given in the connection window: no posting or editing is possible. We collect:

the public identity of the account (username, display name);
performance data for posts from roughly the last 90 days (followers, likes, comments, shares, saves, reach, views);
aggregated audience data (breakdown by country, city, gender and age range), which does not identify your followers.

You can withdraw this access at any time from "My socials" ("Disconnect" button) or from your Instagram account settings ("Apps and websites").

c) Data entered in the service

Collaboration parameters (formats, exclusivity, usage rights, duration, sector, target)
Asked price and negotiated price that you enter (these prices are private: a creator never sees the professional's prices, and vice versa)
Campaigns, budgets, codes and team invitations (email address of the person invited)

d) Data on creators analysed without an account (Flash Analysis)

A professional can estimate the price of a collaboration with a creator who does not use NOVSTR, based on public figures or figures they declare (account name, followers, engagement, reach). See section 6.

e) Payments

Payments are processed by Stripe. NOVSTR neither receives nor stores your card numbers; we keep your purchase history (amount, date, number of credits or analyses) for invoicing.

f) Technical data

IP address, used only to limit abuse (number of attempts) and kept from a few minutes to 24 hours at most
Log of actions on your account (sign-in, invitation…), without IP address
Anonymous audience measurement (pages viewed, journey steps), without cookies, without account identifier and without session recording
Technical error reports, without personal data

g) Contact and demo requests

Name, email address, organisation and message you send us through the "Contact us" or "Request a demo" forms. They are sent to us by email and are not stored in our database.

3. Purposes and legal bases

Creating and managing your account, generating your analyses, managing teams and campaigns: performance of the contract
Connecting your Instagram account and processing the related data: your consent, which you can withdraw at any time
Sending the emails needed for the service (verification, password reset, invitation, receipts): performance of the contract
Securing the platform (abuse limitation, fraud prevention, granting free analyses only once per company via the email domain): legitimate interest
Measuring audience anonymously and fixing errors: legitimate interest
Improving our model and producing market statistics from anonymised data (section 4): legitimate interest
Answering contact and demo requests: pre-contractual measures or legitimate interest
Invoicing and meeting our accounting obligations: legal obligation

4. Market statistics

To improve its pricing model, NOVSTR keeps the characteristics of each analysis (sector, formats, conditions, recommended price, asked and negotiated prices). These characteristics are anonymised as soon as they are recorded: they contain no name, email address, account name or link to your account or organisation, and values that could point to a specific account are rounded (followers and reach to within about 5%, engagement to a tenth of a point, date to the month).

The only link kept is to the report they come from, as long as that report exists; it is removed with the report or when your account is deleted. You can object to this processing by writing to contact@novstr.com. The indicators we derive from it are aggregated. No personal data is sold.

5. Recommended price: an automated estimate

The recommended price and the negotiation range are calculated automatically from the audience, engagement, reach, formats and conditions of the collaboration. It is an indicative estimate intended to inform a negotiation between people: it is not a decision producing legal effects concerning you within the meaning of article 22 of the GDPR.

6. Shared reports and creators analysed by a professional

Certified Analysis. A professional (advertiser or agency) generates an invitation link (containing a code) and sends it to a creator. When the creator uses this code and connects their account, the report is shared with that professional (performance and audience data, recommended price), but never the creator's private prices. By using a code, the creator agrees to this sharing.

Role of professionals. For the analyses, campaigns and reports created in their area, the professional acts as data controller and NOVSTR as processor, under the clauses set out in the appendix to the terms of use. Requests concerning these records (access, erasure, objection) can be sent to the professional concerned or to NOVSTR, which will forward them.

Has your account been analysed without you using NOVSTR? A professional may have estimated the price of a collaboration with you based on public figures or figures they declared (account name, followers, engagement, reach). This data is kept in that professional's area for as long as they use the service and, once anonymised, contributes to the statistics in section 4. You can object or ask for it to be erased by writing to contact@novstr.com with your account name.

7. Recipients and processors

Your data is accessible only to authorised NOVSTR staff and, for shared reports, to the professional concerned. We use the following providers, bound by confidentiality and security commitments:

Vercel: application hosting and anonymous audience and speed measurement, without cookies (United States)
Neon: database hosting (European Union, Frankfurt)
InsightIQ / Phyllo: read-only connection to Instagram accounts (United States)
Stripe: payments (Stripe also acts as data controller for its own anti-fraud and anti-money-laundering obligations)
Resend: sending emails (United States)
PostHog: anonymous audience measurement (European Union)
Sentry: technical error detection (European Union)
Upstash: abuse limitation (IP address, kept for 24 hours at most)
Google: sign-in with a Google account, if you use it

8. Transfers outside the European Union

Some providers are located outside the European Union (in particular in the United States). These transfers are governed by the EU-US Data Privacy Framework for certified providers and, failing that, by the European Commission's standard contractual clauses.

9. Retention periods

Account and personal reports: as long as the account is active. When the account is deleted, they are erased immediately; Instagram access is revoked with our partner.
Instagram data: until the Instagram account is disconnected or your account is deleted.
A professional's reports and campaigns: as long as the organisation uses the service; deleted when the organisation's last account is deleted.
Purchase history: 10 years (accounting obligation), with no other personal data once the account is deleted.
Verification and reset links: 7 days after they expire; invitations: 30 days after they expire.
Account action log: 12 months.
IP addresses used for abuse limitation: 24 hours at most.
Contact and demo requests: 3 years after the last exchange.
Market statistics: anonymous, kept with no time limit.

10. Security

We implement appropriate technical and organisational measures: encrypted communications (HTTPS), hashed passwords, revocable sessions, access separated by organisation and role, abuse limitation, European database hosting, backups, and read-only connection to third-party networks.

11. Your rights

You have the rights of access, rectification, erasure, objection, restriction and portability, as well as the right to withdraw your consent at any time and to give instructions on what happens to your data after your death.

From your account: export your data ("Export my data"), change your name, disconnect Instagram, delete your account.
By email, for any other request: contact@novstr.com. We reply within one month.

You can also lodge a complaint with the French data protection authority (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at www.cnil.fr.

12. Cookies and trackers

NOVSTR only uses cookies that are strictly necessary for the service to work, which do not require your consent:

session: keeps you signed in;
novstr_locale: the display language you chose;
novstr_2fa_device_…: the "remember this device" option of two-factor authentication, if you tick it (30 days);
temporary Google sign-in cookies (sign-in security, 10 minutes).

Audience measurement is carried out without cookies or persistent identifiers (data stays in memory for the duration of the visit). No advertising or social media cookies are set.

13. Minimum age

NOVSTR is reserved for people aged 18 or over, which each user certifies when signing up.

14. Changes

This policy may be updated, in particular when a new provider or feature is added. The date of the last update appears at the top of the page; users are informed of any significant change.