Privacy Notice

Who is responsible for your information

TitanCore Media is operated by Norbert Baki Barabas. For the purposes of this Privacy Notice, Norbert Baki Barabas is the controller of personal data submitted through this website.

You can contact us about anything in this notice at hello@titancoremedia.com.

What we collect

When you request a Free Instagram Audit, the form asks for:

• your name;
• your Instagram handle (or profile link);
• your email address;
• which best describes you (for example personal trainer or online coach);
• what you'd most like to improve;
• anything else you choose to tell us in the optional message box.

We need everything except the message to prepare your audit; without it we can't do the audit. The message is up to you.

We don't ask for your phone number, address, payment details, revenue or follower count. The form also contains a hidden spam-check field that people never see or fill in; it doesn't hold any information about you. When you send the form we also use limited technical information to protect it from abuse (see below).

Why we use it, and our legal basis

We use the information you send to:

• look at your public Instagram profile and content;
• prepare and send you the personalised audit you asked for;
• contact you about your request, including follow-up questions about the audit;
• keep a record of your request in our internal system, linked to a contact record for you. If you've been in touch before (for example with the same email address or Instagram handle), your request may be linked to the record we already hold.

We do this because you asked for the audit: the processing is necessary to provide the free audit you requested and to take the steps you asked us to take (Article 6(1)(b) of the GDPR).

After your audit has been sent, we keep your request for a limited time (see "How long we keep it") so we can answer follow-up questions, recognise a repeat request and deal with any complaint or legal claim. We do this on the basis of our legitimate interests in keeping an accurate record of what we've done (Article 6(1)(f) of the GDPR).

Your email address is not added to a newsletter or mailing list. We don't run a newsletter sign-up at the moment, and we wouldn't add you to one unless you opted in separately. We don't sell your information.

Protecting the form from abuse

To help stop the form being misused (for example, automated mass submissions), when you send it we turn your network (IP) address, or for IPv6 the network part of it, into a coded identifier using a keyed one-way process. We use that identifier only to count how many requests come from the same connection or network. We don't store your IP address for this. The identifier is still treated as personal information, it's stored separately from your request, and it's deleted on a rolling basis, normally within a few days.

If too many requests come from the same connection or network in a short time, the form temporarily stops accepting more from it. This automatic limit only delays a request; you can always email us instead. We don't make any other automated decisions about you.

We do this on the basis of our legitimate interests in keeping the form available for real visitors and protecting it, and us, from spam and abuse (Article 6(1)(f) of the GDPR).

Where it's stored and who can see it

Audit requests are stored in TitanCore's internal system, which runs on Supabase (a hosted database service). The website itself is hosted on Netlify.

When you request an audit, we send you a one-off confirmation email using Resend (an email delivery service). To do that, your email address is passed to Resend. The confirmation email doesn't include your name, Instagram handle or message.

These providers handle information on our behalf to host the site, store requests and deliver email. Only authorised TitanCore staff can see audit requests, by signing in to TitanCore's internal system. TitanCore clients who use the client portal cannot see them.

Like most online services, our hosting, database and email providers may keep standard technical logs when you visit the site or send the form (for example your IP address, browser type and the time of the request) so their services can run securely.

Some of these providers are based in the United States or use infrastructure outside the European Economic Area (EEA), so your information may be processed outside the EEA. Where the law requires it, we rely on the safeguards set out in those providers' data processing terms, such as the European Commission's Standard Contractual Clauses. You can contact us for more information about these safeguards.

Analytics and cookies

The pages generate basic, non-personal events, such as "the audit button was clicked" or "the form was submitted". These events never contain your name, email address, Instagram handle or message. At the moment they are not stored or sent to any third-party analytics service. If that changes, we'll update this notice.

The public pages and the audit form don't set cookies. (The separate sign-in area for TitanCore clients and staff stores a sign-in session in your browser so you stay logged in.)

How long we keep it

We keep your audit request and the contact record linked to it for no longer than 12 months after our last meaningful contact with you about it, unless:

• you become a client, in which case different retention rules apply to your client records;
• we need to keep it longer to meet a legal obligation or to establish, exercise or defend a legal claim; or
• you ask us to delete it sooner, in which case we'll delete it unless we have a lawful reason to keep it.

The coded abuse-prevention identifier is deleted on a rolling basis, normally within a few days. Our providers keep their own technical logs and email delivery records for the periods set by their own policies.

Your rights

Under data protection law you can ask us to:

• tell you what information we hold about you and give you a copy;
• correct information that's wrong or incomplete;
• delete your information;
• restrict how we use it, for example while we check a concern you've raised;
• give you the information you provided in a commonly used electronic format, or send it to someone else, where this applies.

Your right to object: where we rely on legitimate interests (protecting the form from abuse, and keeping your request after the audit), you can object at any time on grounds relating to your particular situation. We'll then stop, unless we have compelling legitimate grounds to continue or need the information to establish, exercise or defend a legal claim.

To use any of these rights, email hello@titancoremedia.com from the address you used on the form and tell us what you'd like us to do. We may ask you to confirm it's you. We'll reply within one month, or tell you if we need longer, as the law allows.

You also have the right to complain to a data protection supervisory authority, in particular in the EU or EEA country where you live, work or where you think the problem happened. We'd appreciate the chance to sort out your concern first, so please contact us.

Changes to this notice

If the way we handle your information changes, we'll update this page and the "Last updated" date above.