Privacy Policy

Last updated: 2 July 2026

This policy explains what personal data Unfed Space processes when you connect your Instagram account and publish a portfolio site with us, why we process it, who it is shared with, and the rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and Polish law.

1. Data controller

The controller of your personal data is Twój Wuja Jakub Sroka, a sole proprietorship entered in the Polish Central Register and Information on Economic Activity (CEIDG), registered at ul. Marszałkowska 58, 00-545 Warszawa, Poland, NIP PL7511744403, REGON 387212660.

For any privacy matter — including exercising your rights — contact us at hello@unfed.space. We have not appointed a Data Protection Officer; enquiries to that address reach the controller directly.

2. What data we process

  • Instagram profile data — your username, display name, biography and profile picture, read through Instagram's API when you authorise the connection.
  • Your posts — the images, videos and captions of the posts we import to build your page. We store processed copies of your images on our infrastructure so your page does not depend on Instagram remaining available.
  • Instagram access token — the credential that lets us read your profile on your behalf. It is encrypted at rest and is never logged, displayed, or shared.
  • Account & contact data — your email address (for sign-in links, account confirmation and essential service notices) and your Instagram account identifier.
  • Site configuration you provide — the details you confirm during onboarding or edit later (subdomain, discipline, style tags, city, language, booking link).
  • Technical data — server logs (including IP address and request metadata, processed for security and reliability) and privacy-preserving, cookieless product analytics. We set only strictly-necessary cookies: a session cookie that keeps you signed in and a short-lived sign-in-security (CSRF) cookie. We do not use advertising or cross-site tracking cookies.

3. Purposes and legal bases

  • Creating, generating and hosting your portfolio site, and letting you manage it — performance of our contract with you (GDPR Art. 6(1)(b)). Importing your Instagram profile and posts is carried out on the basis of the authorisation you grant through Instagram and is necessary to provide the service.
  • AI-generated titles and descriptions for your works — part of the service (Art. 6(1)(b)); processed only when AI generation is enabled for your space, which you can turn off.
  • Passwordless sign-in and account recovery by email — performance of the contract and our legitimate interest in account security (Art. 6(1)(b) and (f)).
  • Security, abuse prevention and service reliability (logs, encrypted token storage) — our legitimate interest (Art. 6(1)(f)).
  • Cookieless product analytics — our legitimate interest in understanding and improving the product (Art. 6(1)(f)); the analytics do not use cookies or profile you across sites.

Your public page displays the content you chose to publish — it is public by design and intended to be found by search engines and other services.

4. Recipients and processors

We do not sell your personal data. We share it only with providers that process it on our behalf to run the service:

  • Cloudflare, Inc. — hosting, storage, content delivery and transactional email for the whole platform.
  • Anthropic, PBC — AI generation of work titles and descriptions from your images, only when AI generation is enabled.
  • PostHog — cookieless product analytics, on EU-based servers.
  • Meta Platforms, Inc. (Instagram) — the source API we read your profile and posts through, under Instagram's own privacy policy.

We may also disclose data where required by law or to protect our legal rights.

5. Transfers outside the EEA

Some providers are located in, or process data in, the United States (Anthropic, Meta, and some Cloudflare operations). Where personal data is transferred outside the European Economic Area, it is protected by an appropriate safeguard under the GDPR — the European Commission's Standard Contractual Clauses and/or the provider's certification under the EU–US Data Privacy Framework. PostHog analytics data is held on EU servers.

6. How long we keep it

We keep your data for as long as your account exists. Deleting your account takes your page down immediately and deletes your imported media, your email address, your sign-in sessions and your Instagram access token from our systems. A minimal deletion record (your Instagram account identifier) is retained so the deletion is honoured and your subdomain is not recycled to someone else. You can have that final record erased too — use Instagram's data-deletion request or email us. Server logs are kept only for a short period for security and diagnostics.

7. Deleting your data

  • In your dashboard: Delete account.
  • Via Instagram: remove Unfed under Settings → Apps and websites and submit Meta's data-deletion request — we honour it automatically and erase the deletion record as well.
  • Or email hello@unfed.space.

8. Your rights

Under the GDPR you have the right to:

  • access your data and obtain a copy;
  • have inaccurate data corrected;
  • have your data erased ("right to be forgotten");
  • restrict or object to certain processing (including processing based on our legitimate interests);
  • data portability, where processing is based on contract or consent;
  • withdraw any consent at any time, without affecting processing already carried out.

To exercise any of these, email hello@unfed.space. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.

9. Providing data is voluntary

Providing your data is voluntary, but connecting your Instagram account and providing an email address are necessary to create and maintain your Unfed site — without them we cannot provide the service.

10. Automated decision-making

We use AI to generate titles and descriptions for your works, but we do not carry out automated decision-making that produces legal or similarly significant effects concerning you within the meaning of Art. 22 GDPR.

11. Children

Unfed Space is not directed at children. You must be at least 13 years old (the minimum age for an Instagram account) to use it, and old enough to run a professional or creator Instagram account.

12. Changes to this policy

If this policy changes in a way that materially affects you, we will update the date above and notify account holders by email. Continued use after a change means you accept the updated policy.