Privacy Policy

Last updated 20 September 2026

EarnFans is a customer-relationship tool for creators and the agencies that work with them. This policy explains what the service stores, why, who else can see it, and how to have it removed. It covers earnfans.app and the EarnFans desktop app.

1. Who we are

EarnFans is operated by [legal entity name], [registered address]. For anything in this policy, including requests to see or delete your data, contact [privacy@yourdomain].

Where this policy describes information you enter about your own subscribers, you are the data controller and EarnFans acts as a processor on your instructions. Where it describes your own account, we are the controller.

2. What we collect

Everything below is either entered by you, created by your use of the service, or fetched from a platform you explicitly connected.

Your account

Name and email address, handled by our authentication provider. We never receive or store your password.

Workspace content

What you record in the CRM: subscriber names and handles, notes you write, spend and purchase history, tasks, content records, message templates and automated-reply rules.

Team members

The name, optional email, role and assigned accounts of people you add to your workspace.

Creator accounts

The platform, display name and handle of each account you track.

Instagram connection

If you connect Instagram: an access token, your Instagram Business account ID and username, the linked Facebook Page ID and name, and your Meta user ID.

Instagram metrics

For each profile you track: follower and post counts, biography, website, and for recent posts the ID, media type, caption, permalink, like and comment counts, and timestamp.

Billing

Subscription status, plan and invoice records. Card details go directly to Stripe and never reach our servers.

Technical data

Standard server and security logs, including IP address and browser user agent, kept by our hosting providers.

We do not collect Instagram or OnlyFans passwords, and we do not ask for identity documents.

3. Instagram and Meta data

Connecting Instagram is optional. If you do connect it, we use Meta’s official Graph API and only the permissions you grant on the consent screen: instagram_basic, instagram_manage_insights, pages_show_list and pages_read_engagement.

We read profile and post metrics through Business Discovery, which returns information Instagram already publishes for Business and Creator accounts. We store those figures so the tracker can show change over time.

What we never do with the connection: post, comment, follow or message on your behalf; read your private messages or direct-message inbox; or access accounts you have not asked us to track.

The access token is stored so verification can run without asking you to reconnect. It is never displayed in the app, never returned to a browser, and never shared with another workspace. It expires after roughly 60 days unless you reconnect, and removing EarnFans from your Facebook account deletes it automatically — see section 8.

4. Why we use it

To provide the service you signed up for: showing your CRM, tracking followers and engagement, running the automations you configure, ranking team performance, and billing your subscription.

We also use aggregate, non-identifying usage information to find faults and decide what to build. We do not sell personal data, and we do not use your workspace content for advertising.

6. How long we keep it

Workspace content is kept while your account is open, and for [30] days after you close it, so an accidental deletion can be undone. After that it is removed from our live systems; encrypted backups age out within [90] days.

Invoices and other records we must keep for tax and accounting are retained for as long as the law requires, regardless of account closure.

7. Your rights

Depending on where you live, you may have the right to see the personal data we hold about you, correct it, delete it, object to or restrict how we use it, receive a copy in a portable format, and complain to a data protection authority. In the UK that is the Information Commissioner’s Office.

Write to [privacy@yourdomain] and we will respond within one month. We do not charge for this, and exercising a right will never cause us to degrade your service.

8. Deleting your data

Instagram connection only. Open the Social page in EarnFans and choose Disconnect. This deletes the stored access token and the connection record immediately. Tracked follower history stays until you delete the accounts themselves.

From Facebook. Go to Settings & Privacy → Settings → Apps and Websites on your Facebook account and remove EarnFans. Meta notifies us automatically and we delete the stored token and connection record without any further action from you.

Everything. Email [privacy@yourdomain] from the address on your account, or send a data deletion request through Facebook. We will delete your workspace and confirm when it is done, subject to the retention periods in section 6.

Requests made through Facebook return a confirmation code you can quote if you need to follow up.

9. Security

Traffic is encrypted in transit, data is encrypted at rest by our database and hosting providers, and access to a workspace is limited to the people you have added to it. Access tokens are readable only by server-side code, never by a browser.

No service can promise perfect security. If a breach affects your personal data we will tell you and the relevant regulator as the law requires.

10. Where your data is processed

Our providers operate globally, so your data may be processed outside your country, including in the United States. Where data leaves the UK or EEA, it is protected by the safeguards those rules require, such as Standard Contractual Clauses.

11. Age

EarnFans is for adults working in the creator industry. It is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a minor has an account, contact us and we will remove it.

12. Changes to this policy

We will update the date at the top when this policy changes. If a change materially affects how we handle your data, we will tell you in the app or by email before it takes effect.

13. Contact

[legal entity name]
[registered address]
[privacy@yourdomain]