Privacy
What Untagged stores, why, and for how long. As of November 2026.
app/site.py:
COMPANY['name'], COMPANY['street'], COMPANY['city'], HOSTING['name'], HOSTING['address'], HOSTING['log_days']
Controller
Responsible for processing personal data on this website and in the service is:
[Company name][Street and number]
[Postcode and city]
Email: support@getuntagged.com
Further details are in the legal notice.
At a glance
- No analytics, no tracking, no advertising. The site sets cookies only to keep you logged in and to remember your language.
- For an account we store your email address, optionally your company name, your password as a hash, the time of your last login, the brands you add and, if you switch on two-step login, the key for your authenticator app.
- For a scan we store the publicly visible details of the videos found, never the videos themselves.
- Only if the AI assessment is switched on are video details sent to Anthropic in the USA.
- Deleting your account removes everything that belongs to it.
Visiting the website
Every time a page is loaded, the server records your IP address, the time, the address requested and the response status in its access log. We need this to deliver the site and to detect and fix faults and misuse. Legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and working service.
The site runs on servers of [hosting provider], [address of the hosting provider], which processes this data on our behalf under a data processing agreement (Art. 28 GDPR). Access logs are deleted after [number] days.
Fonts (Inter, IBM Plex) and all images and clips on the public pages come from our own server. Loading the site does not connect to Google Fonts, a CDN or any other third party.
Your account
When you create an account, we store your email address, optionally the name of your company, and your password, only as a hash (scrypt), never in plain text. Each time you log in, we store the time of this last login, replacing the previous one. In the account we store the brands you add with their spellings, topic searches, own channels and tone of voice, and the mentions found for them, including whether you marked them as done or ignored.
If you switch on two-step login, we also store the key your authenticator app uses to make its codes, the time step of the last code accepted (so that no code works twice) and your ten recovery codes, only as a hash, together with whether each has been used. To check the key, we have to store it readably; it is shown only once, while you set it up, and the QR code for it is made on our own server. Between the password and the code, your browser holds a random token for up to five minutes, which we store only as a hash and delete once the code is accepted. All of this is deleted when you switch two-step login off.
To run the service, we as the operator see an internal overview of all accounts: email address, company name, time of registration and last login, whether two-step login is on, the brands with their spellings, topic searches and own channels, the number of mentions found and the time of the last scan. Passwords, keys, recovery codes and sessions are not shown there.
We need this data to provide the service you signed up for (Art. 6(1)(b) GDPR); the overview and the time of the last login also serve to run the service securely and to detect misuse (Art. 6(1)(f) GDPR). It stays until you delete your account, which you can do at any time in the dashboard under “Account”. This deletes the account, all brands, all mentions found, all sessions and everything to do with two-step login at once.
Scans and the videos found
A scan searches YouTube Shorts and TikTok from our server. YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland) receive the search terms of your brand and the topic searches as search queries, but no details about you. To find more TikTok videos, the same search terms also go to Microsoft's search engine Bing (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Where the TikTok search runs through the service provider Apify (Apify Technologies s.r.o., Prague, Czech Republic), Apify receives the search terms instead and queries TikTok on our behalf.
For each video found we store publicly visible details: title, description, tags, channel name, subscriber, view, like and comment counts, publication date, length, the address of the thumbnail and the transcript, and for TikTok videos with a mention a copy of the thumbnail. The videos themselves are not stored. For a TikTok video without captions whose sound the creator recorded themselves, our server fetches that sound once and transcribes it on our own server, without any outside service; the audio file is deleted straight after. Details of videos in which no brand was found are kept for 7 days, so that the next scan does not fetch them again, and then deleted.
If you published one of these videos: the details above may include personal data about you, such as your channel name or what you say in the video. They come from YouTube or TikTok, where they are publicly accessible. We process them so that the brand concerned can see where it is mentioned and decide whether to reply (Art. 6(1)(f) GDPR; legitimate interest of the brand and of us in monitoring public mentions). The details stay until the brand or the account that found them is deleted. You can object to this at any time by email; we will then delete the details about your video.
AI assessment (Anthropic)
The AI assessment is currently switched off, so nothing is sent to Anthropic. Once it is switched on, the following applies. For each video in which a brand was found, its title, description, channel name and transcript, together with the brand name, the found passages and the tone of voice set for the brand, are sent to the API of Anthropic, PBC, 548 Market Street, San Francisco, CA 94104, USA. Anthropic returns whether the brand is really meant, the sentiment, a short summary and reply suggestions, which we store with the mention.
Legal basis is Art. 6(1)(b) GDPR for the account holder and Art. 6(1)(f) GDPR for the people in the videos. Anthropic processes the data in the USA; the transfer is based on the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR) in Anthropic's data processing terms.
Thumbnails
In the dashboard, the thumbnails of YouTube videos are loaded by your browser directly from YouTube's servers. Google thereby receives your IP address and the usual browser details. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. Legal basis is Art. 6(1)(b) GDPR, because the thumbnails are part of the service you use. The public pages and the preview do not load anything from YouTube. Thumbnails of TikTok videos come from the copy on our server, so your browser does not contact TikTok.
Contacting us
If you write to us by email, we use your address and your message only to answer you (Art. 6(1)(b) GDPR for questions about the service, otherwise Art. 6(1)(f) GDPR). We delete the correspondence once your request is settled, unless statutory retention periods require us to keep it.
Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). An email to us is enough.
Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation. This applies in particular to the details of videos found during scans.
You can also lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work.
We do not make automated decisions with legal or similarly significant effects about you (Art. 22 GDPR). The reply score only sorts mentions for the account holder.
Security
The site is transmitted encrypted (HTTPS). Passwords are stored only as a salted scrypt hash; the session cookie cannot be read by scripts on the page. If you want, logging in also asks for a code from an authenticator app. Access to the data is limited to what running the service requires; the internal overview of all accounts is open only to the operator, and only with two-step login.
We update this policy when the service changes. The current version is always on this page.