Privacy notice

Who we are

Victic is a competitive social monitoring service provided by Andrej Majer, a sole trader established in Ireland, of 11 Millbrook, Mill Lane, Carlow R93 T026, Ireland. We are the data controller for everything described below, unless a client contract says otherwise.

For anything in this notice, including a request to see or delete your data, write to info@victic.eu. We are not required to appoint a data protection officer and have not appointed one, so that address reaches the person responsible directly.

Your right to object

You can object at any time to our processing of your data, including content you published or content that shows you. If you run an account we watch, we stop watching it and add it to our exclusion list, so it is not captured again for any client. If you appear in a post, we remove that post from our data. Write to info@victic.eu with the account handle or a link to the post. We act on objections within five business days.

1. If you are visiting this website

This site collects nothing about you. There is no analytics, no tracking pixel, no embedded video, no chat widget, no advertising, and no font or script loaded from anyone else's server. The fonts are served from this domain, so your browser never has to announce itself to someone else in order to show a page.

The site sets no cookies and uses no local storage. There is nothing to consent to, which is why you are not being asked. See the cookie notice for the detail.

The request form on the pricing and contact pages is the one thing on this site that sends us anything, and only when you press send. What you typed goes to this domain, and our server turns it into two emails: one to our mailbox, and one back to you confirming what you asked for. The form stores nothing itself; the emails are sent by Resend, listed in section 4, and land in our mailbox.

The site is hosted by Cloudflare, which processes the connection data any web server necessarily sees, such as your IP address, for the short time needed to serve the page and to protect the service from attack.

2. If you contact us or become a client

What we hold

• Your name, the organisation you work for, your email address, and a phone number if you gave one.
• The plan you built on the pricing page, if you sent the request from there.
• Our correspondence with you.
• The list of accounts you have asked us to watch.
• For clients, the commercial and billing records of the engagement.

Why, and on what basis

• To answer your enquiry and decide whether we can help: our legitimate interest in responding to someone who has contacted us (Article 6(1)(f) GDPR).
• To deliver the service you have engaged us for: performance of a contract (Article 6(1)(b) GDPR).
• To keep accounting and tax records: our legal obligation (Article 6(1)(c) GDPR).

Business emails you did not ask for

We do not add people who contact us to a mailing list, and we do not send newsletters. If we ever write to you about our service without you having asked, and you would like us not to, reply to that email or write to info@victic.eu. We then add your address to our do-not-contact list and keep it there, so that it does not happen again.

How long

Enquiries that do not become work are deleted twelve months after our last exchange. Client correspondence is kept for the engagement and two years after it. Invoices and accounting records are kept for six years, as Irish tax law requires. The full list is in section 5.

3. If your public account, or your image, is in content we monitor

This section is the notice required by Article 14 GDPR for people whose personal data we hold without having collected it from them.

What we do, and why

We watch the public Instagram posts and stories of business, brand, organisation and public body accounts, and of political parties and politicians acting in their public role, for two purposes:

• to compare an organisation's public communication with that of its competitors and peers, for the client who asked us to; and
• to keep a reference set of how brands communicate, which informs the reports we prepare for all our clients. Some accounts are watched only for this purpose, without any client having asked for them.

In both cases, labels, scores and findings derived from one account's posts can appear in reports for more than one client. A client never receives another client's reports.

Where the data comes from

Content the account published for every Instagram user to see, obtained from commercial data providers that supply public social media content to businesses. We never log in to collect content, we never use a client's login, and we never collect private, follower-only or close friends content.

What we hold

Category	Detail
Published content	Posts and stories: the image or video, the caption, the format and the time of publication.
Story stickers	The question or poll the account asked, its answer options and the total count for each option. Never who answered or how any person voted.
Account details	The handle, the display name, and daily counts of followers, accounts followed and posts.
Engagement counts	Total likes, comments and views of each post, measured repeatedly over its first fourteen days.
Details in the post	Hashtags, mentioned, tagged and collaborating accounts (username only), story links, the music track, the paid partnership label, the place the account tagged, and the local time and weekday of publication.
People in brand content	Brand posts can show people: staff, customers, crowds at events, athletes, artists and other public figures. They are part of the image or video we keep. We do not identify them, and our descriptions mention people only by role, action and setting.
Our analysis	Categories, written descriptions and creative labels for each post, produced with the help of AI models, and scores comparing posts with the account's own earlier posts.

What we never collect

• Comments, or the identities of people who comment, like or vote.
• Follower or following lists.
• Direct messages, or answers people send to an account's story.
• Private, follower-only or close friends content.
• The location of individuals, as distinct from a place an account tagged in its own post.

We do not use facial recognition, we do not build profiles of people who appear in content, and our descriptions never state anyone's health, ethnic origin, religion, sexual orientation, political opinions or trade union membership. We do not watch the personal accounts of private individuals. For a politician, we describe what they say and show in their own posts, never the views of the supporters or crowds around them, and we never identify those people or keep lists of them.

Our legal basis

Legitimate interest, Article 6(1)(f) GDPR: our interest in running a monitoring and analysis service, and our clients' interest in understanding how the organisations in their market communicate in public. We have weighed those interests against your rights in a written assessment, and you can ask us for a summary of it.

Where a political party or a politician publishes its political views, those views are data they have made public themselves, Article 9(2)(e) GDPR. We analyse them as communication and draw no conclusion about anyone else's opinions.

That assessment holds because of the limits above: business, organisation and political accounts only, published content only, no audience data, no profiles of people, and short retention. "The data was public" is not by itself a legal basis under the GDPR, and we do not rely on it as one.

Why you were not told directly

The accounts we watch are organisations, or politicians publishing in their public role. People tagged or mentioned in their posts appear only as a username, and people shown in images and videos are not identified by us at all. Contacting each of them would mean collecting the very contact details we avoid collecting, which would be disproportionate. We therefore rely on Article 14(5)(b) GDPR, and this public notice is how we make the information available instead, from the moment processing starts.

How long we keep it

The live views clients browse hold the last 30 days only. Everything else captured is deleted at the latest six months after we captured it. Deletion is real: media files are removed from storage first, then the records, and a sweep afterwards catches anything left behind. The full list is in section 5.

Your rights, and how to use them

Besides objecting, you can ask us for a copy of what we hold about you, and ask us to correct it, delete it or restrict what we do with it (Articles 15 to 18 GDPR). If you appear in a post, send us the link. We answer within one month.

To make sure a request about an account comes from that account, we may ask you to write from an email address shown on the account or its website, or to publish a short code we send you. We never ask for identity documents.

You can also complain to a supervisory authority. In Ireland that is the Data Protection Commission (dataprotection.ie); you may also complain to the authority where you live or work.

4. Who else handles the data

We use a small number of suppliers to run the service. Each acts on our instructions under a data processing agreement and may not use the data for its own purposes.

Supplier	What for	Where
Supabase	Database and media storage	Ireland
DigitalOcean	The server that runs capture and analysis	United Kingdom
Google	Our mailbox, report delivery in Google Drive, and the Gemini AI models that describe and label content	EU and United States
Notion	The live workspace some clients use to browse the last 30 days	United States
Cloudflare	Hosting this website and running the request form	Global
Resend	Sending the emails the request form produces	United States

The commercial data providers that supply public content are not our processors: they collect on their own account as independent controllers, and we send them only the handles of the public accounts we watch.

The United Kingdom is covered by an adequacy decision of the European Commission. Transfers to the United States rely on the EU-US Data Privacy Framework or the Commission's standard contractual clauses. Google's AI models are used through its paid business service, under terms that do not allow Google to train its models on what we send.

We do not sell personal data. Beyond these suppliers, it reaches only our clients, in the form of their reports.

5. How long we keep each kind of data

Data	Kept for
Live views in Google Drive and Notion	30 days from capture
Captured posts and stories, media, counts and our per-post analysis	At most six months from capture
Reports and data bundles we hold	At most six months from the capture of the newest post they contain
Period findings: labels, scores and short written findings about how an account communicates	Kept as our own analytical record, so one period can be compared with the next. They contain no media, no captions and no words quoted from posts, and they never identify a person
Enquiries that do not become work	Twelve months from our last exchange
Client correspondence	The engagement, plus two years
Invoices and accounting records	Six years, as Irish tax law requires
Requests made under this notice	Two years from when we close them
Do-not-contact list and exclusion list	For as long as we need them to keep honouring your choice

Copies a client has downloaded are the client's responsibility. Our terms require clients to delete data bundles within six months of receiving them.

6. Security

The system has no public interface. Access is limited to the two people who run Victic, credentials are kept outside the code, and media is stored in a private, non-listable storage bucket. Every scheduled job is monitored, and a failed run raises an alert instead of passing silently.

7. Changes

If this notice changes materially, we update the date at the top and, where it affects clients, tell them directly. Earlier versions are available on request.