Privacy Policy
What we watch, what we keep, and what we never touch.
EFFECTIVE 9 AUGUST 2026
Paparaze is an independent publication. We share magazine-style updates when publicly known figures follow or unfollow each other on Instagram. This policy explains what we do, why we are allowed to, and the rights you have - whether you are a member or someone we cover.
Who we are
Paparaze is an independent publication based in Bulgaria. Day-to-day operations are managed by a single publisher ("we", "us"), with editorial contributions from a small network. Under data protection law we're the data controller for the data described here. Questions and requests: hello@paparaze.com.
Who this policy covers
This policy covers two different groups, and it keeps them apart the whole way down. People we cover are the public figures we report on - they are not our customers, and we hold nothing about them that is not already public. Members are people who buy access - we hold only what is needed to give them that access. Every section below says which group it applies to.
People we cover: what we process, and our lawful basis
We process only information the account holder has already made public: public profile identifiers - handle, display name and profile picture - and changes to public follow lists. We process these for journalistic purposes, to report confirmed follow-list changes between public figures.
- Under KVKK Article 5 (Turkey, Law No. 6698), processing is permitted without separate consent where the data has already been made public by the account holder - which is the case for every account we cover.
- Under the GDPR we rely on legitimate interests (Article 6(1)(f)) together with the exemption for journalistic purposes (Article 85), as implemented in the Bulgarian PDPA. We apply strict data minimisation: we process what is needed to report a confirmed change, and nothing else.
- Private accounts are never included. If an account is not public, it is outside our coverage entirely.
People we cover: what we store
We keep the minimum needed to report accurately and to handle correction or removal requests.
- We store: for each account we cover, its public handle, display name and profile picture; the confirmed follow-list changes we have reported, with the date each was confirmed; and the posts and briefs we published about them.
- We do not store: any account password or login credentials. We never log in as you or as anyone we cover, and we hold nothing that is not visible on a public profile.
For the accounts we cover we hold no sensitive personal data and no contact details - no email addresses, phone numbers, postal addresses or government identifiers - and nothing that is not visible on a public profile.
People we cover: how long we keep it
Different records have different lifespans:
- Published posts and their briefs are kept indefinitely, as our editorial archive. A takedown request removes a post from that archive.
- Follow-list records are kept while the follow is live. Once a change is confirmed and reported, the old record is removed.
- Correction and takedown requests are actioned within 48 hours, and we keep a short note of what we changed and when.
People we cover: your rights
If you are someone we cover, you can ask us to:
- see what we hold about you, or object to its processing;
- delete it (right to erasure / “right to be forgotten”);
- remove a specific published post - we respond to takedown requests within 48 hours;
- remove an account from our coverage entirely;
- publish your response alongside a post about you (right of reply).
Email hello@paparaze.com and we will action eligible requests. Minors are excluded from coverage on request and by policy.
Members: what we hold
If you buy access, we hold what is needed to give you that access - and nothing more.
When you buy a day pass or a subscription we hold the email address you used at checkout, which tier you bought, when your access expires, and the customer and subscription ids we receive from Creem. Our lawful basis is performance of our contract with you (GDPR Article 6(1)(b)).
Creem is the legal seller and handles the payment itself. Your card and billing details go to Creem, never to us - we do not see them and we do not store them.
For payment processing, Creem acts as an independent controller for the billing data it collects directly from you - card details, billing address and transaction records - under its own privacy policy. We are the controller for your account and subscription data only.
Member sign-in is not live yet. When it launches you will sign in with a one-time code sent to your email, or with Google, and we will set a session cookie to keep you signed in. We will never ask you for a password.
Members: how long we keep it
Your account and subscription records are kept while your access is active, and for 12 months afterwards so we can answer billing and access questions. After that they are deleted, except for anything we are required to retain for tax or accounting purposes.
Members: your rights
If you are a member, you can ask us to:
- see the account data we hold about you;
- correct it if any of it is wrong;
- delete it - we remove your account data, keeping only what we must retain for billing records;
- receive it in a portable form, or object to how we process it.
Email hello@paparaze.com and we will action eligible requests. Billing records held by Creem are subject to its own privacy policy - it is the controller for those.
Third parties
- Payments - Creem: Creem acts as our Merchant of Record and is the legal seller. It handles VAT and sales tax (including Turkish KDV) and processes your billing details under its own privacy policy.
- Editorial drafting: a third-party text-generation provider processes the handles and public names involved in a confirmed event in order to draft the short brief. It receives no member or billing data, and nothing beyond the public event itself.
- Profile pictures: pictures shown on our website may load directly from third-party APIs rather than from our own servers, so your browser contacts those providers when a picture is displayed.
Some of these providers operate outside the EU/EEA. Where that is the case, the transfer relies on the safeguards those providers have in place, such as standard contractual clauses.
Complaints
Whichever group you fall into, you can complain to a supervisory authority: the Commission for Personal Data Protection (CPDP) in Bulgaria, or the Personal Data Protection Authority (KVKK) in Turkey.
Business status and regulatory registration
Paparaze is an independent publication, not a registered company or agency. It is operated by a single publisher, with editorial contributions from a small network. We are separately confirming whether VERBİS registration (Turkey's data-controller registry) applies to us, and will register if so.
Changes
We may update this policy; the effective date above will change and material updates will be announced in the app.
Contact
For any privacy question or request, email hello@paparaze.com. See also our Terms of Use.