Privacy Policy

Who is responsible for your data

GramScaler operates gramscaler.com and decides how the data described on this page is used. Under data-protection law, that makes us the "data controller" — the party answerable for your data. For anything on this page, email [email protected].

What we collect when you order

• The service, quality tier, and quantity you chose.
• The public Instagram @username or post link you typed in. This is the only part of the order form that identifies anyone.
• An order reference — a random receipt code created in your browser. It joins your payment, your order, and any later support request together.
• The email address, name, and country PayPal passes back after a payment. We do not ask for these on our form; PayPal sends them with the payment so we can email your receipt and screen for fraud.
• The payment reference PayPal assigns to the completed payment. Never your card or bank details — see below.
• Housekeeping fields: the order's status, the delivery network's own order number once it has one, whether your confirmation email was sent, and timestamps.

If you start checkout and do not finish

When you open checkout, we save the service, quantity, and link before the payment screen appears — whether or not you go on to pay. No email address is attached, because we never asked you for one. We keep these rows for two honest reasons: a payment occasionally arrives without its order details, and that row is the only thing we can match it to; and a pattern of abandoned checkouts is how we find out something on the page is broken. They are deleted within 12 months.

What we never collect

• Your Instagram password. No page on this site has a field for one, and we will never ask by email.
• Your card, bank, or PayPal login details. Payment happens entirely on PayPal's own screens. Those details never touch this site and are never stored by us.
• Anything from inside your Instagram account. We only ever have the public username or link you typed yourself.

Technical logs

Like every website, the servers that deliver this site record the IP address (the number that identifies your internet connection), the browser type, and the time of each request, and use them to serve pages and block automated abuse. We also record the country your connection appears to come from; comparing it with the country PayPal reports helps us spot fraud.

Analytics, cookies, and consent

We use Google Analytics 4 (GA4 — Google's visit-measurement tool) to see which pages people use and where checkout fails, and we may use Microsoft Clarity (a tool that shows how pages are used, such as scrolling and clicking) for the same purpose. These are measurement tools only. We do not use them to build advertising audiences or to follow you around other websites.

If you are in the EU or UK, cookie rules may require your consent before analytics tools run. Where a consent choice is shown on this site, analytics runs only according to the choice you make, and declining does not affect ordering in any way.

Our own ordering code sets no tracking cookies. It stores one small random code in your browser's session storage (temporary browser memory that clears when the tab closes) so your order stays joined up while you complete it.

Why we are allowed to hold your data

Data-protection law requires a lawful reason for every use of personal data. Ours, in plain words:

• To deliver what you bought. The order details and the email address PayPal sends are what an order is made of. Without them we cannot deliver or send your receipt. (The law calls this "performance of a contract.")
• To run the business safely. Server logs, fraud screening, and abandoned-checkout records keep the site working and payments honest. (The law calls this "legitimate interests," and we keep those records deliberately small.)
• Because the law says so. Records of completed sales must be kept for tax and accounting.

Who else sees your data

A small number of providers help us run the service. Each one gets only what its job needs:

• PayPal, our payment processor — handles the payment and your card details on its own screens, and passes us back your email address, name, country, and a payment reference. For what you enter on its screens, PayPal is responsible under its own privacy policy.
• Our hosting and content-delivery provider — serves the site and runs the order code, so every request passes through it.
• Our database host — stores the order records. Reaching them requires a key that exists only as an encrypted secret on our server; your browser can never reach the records.
• Our email delivery provider — sends your order confirmation. It receives your email address and the contents of that message.
• The upstream delivery network — receives exactly three things: the service, the @username or link, and the quantity. It never receives your email address, your name, or your payment details.
• Analytics providers — GA4, and Clarity if enabled, receive the usage measurements described above.

We do not sell your personal information, we do not share it for advertising, and we do not pass it to anyone outside this list.

Data crossing borders

Some of these providers process data in more than one country. Where data leaves the EU or UK, the transfer relies on the safeguards data-protection law allows for it, such as an adequacy decision (an official ruling that a country protects data well enough) or standard contractual clauses (a legally approved data-protection contract) in the provider's own terms.

How long we keep it

• Paid orders: for as long as tax and accounting rules require sales records to be kept, and no longer.
• Abandoned checkout rows: no more than 12 months.
• Support emails: for as long as the conversation is useful; where they relate to a paid order, on the same schedule as that order.
• Analytics data: for the retention period set inside the analytics tool, measured in months.

Ask us to delete sooner and we will, unless the law requires us to keep the record of a sale — in that case we keep the minimum that record needs and delete the rest.

Your rights if you are in the EU or UK (GDPR)

The GDPR (the EU's General Data Protection Regulation, mirrored in UK law) gives you these rights over your own data, all free to use:

• Access — ask for a copy of what we hold about you.
• Rectification — have wrong data corrected.
• Erasure — have your data deleted, where we are not required to keep it.
• Restriction — make us keep data but stop using it while a question is settled.
• Portability — receive the data you gave us in a machine-readable file.
• Objection — object to uses based on "legitimate interests," including analytics.

We make no automated decisions about you that have legal or similarly serious effects — the link check that runs before payment is a format check, not a decision about you. If you are unhappy with our answer, you can complain to your data-protection authority; in the UK, that is the Information Commissioner's Office (ICO).

Your rights if you are in California (CCPA)

The CCPA (California Consumer Privacy Act) gives California residents these rights:

• Know — ask what personal information we collect about you and how we use and share it. This page is that disclosure, and you can also ask us directly.
• Delete — have personal information we collected from you deleted, with limited exceptions such as records the law requires us to keep.
• Correct — have inaccurate personal information corrected.
• Opt out of sale or sharing — we do not sell your personal information and do not share it for cross-context advertising, so there is nothing to opt out of. If that ever changed, we would post an opt-out link first.
• Non-discrimination — using these rights never changes the price or service you get.

How to make a data request

Email [email protected] from the email address PayPal holds for your order, or quote the order reference from your receipt. Those are the only two ways we can be sure an order is yours — we check because we will not hand your data to someone pretending to be you. Support is 24/7 and we reply within hours; a data request is answered within the time limit the law sets, and usually much sooner.

Children

This service is for adults. We do not knowingly collect data from anyone under 18, and our Terms of Service do not allow orders for children's accounts.

Security

Everything is served over HTTPS (encrypted connections). Order records sit behind a key that exists only as an encrypted secret on the server — nothing a browser can see has access to them. We hold no card details, so there are none here to steal.

Changes to this policy

We update this page when what we actually do changes, not on a schedule. The date shown on this page — August 19, 2026 — is the real one.

What happens to an order that goes wrong is set out in our Refund Policy.