Privacy policy
Policy draft updated: October 28, 2026.
Giveaway Studio is an IndexSocial product. This draft covers our giveaway service. Legal operator name, business address and country: [to be confirmed before publication]. Contact: support@indexsocial.app
How the service works
You can use the service without creating a registered account. A browser identifier connects your saved giveaways to this browser. A recovery code restores access on another browser or device; keep it private.
Information used for giveaways
We process submitted post links and imported public social-media information, including usernames, comments, mentions and profile-image references. We store imported pools, participation rules, draw results and relevant timestamps to run and reopen giveaways.
Payments and refunds
PayPal or Paddle processes payments, depending on the method you choose. We store purchase amounts, currency, payment identifiers and refund records needed to verify payment and manage service access. Our checkout does not ask you to enter card details directly into our application.
Cookies and access
Functional cookies maintain browser access, session state and language preferences. Recovery codes are verified using a server-side hash. An encrypted copy lets us include the current code in requested notifications. Giveaways are stored in our database, not in the cookie.
Optional email notifications
If you request an import notification, we use your email address only to send that notification and your private recovery code through Resend. We do not subscribe you to marketing. Pending email addresses and recovery credentials are encrypted in our database. Recipient data is cleared from the notification after sending finishes or is cancelled; pending notifications are scheduled for cleanup after 30 days. Resend processes the recipient address and message content to deliver the email and keeps its own delivery records.
Public results
Publishing a results link is optional. Anyone with that link can view the published winners, comments, rules and replacement reasons. Do not include private contact information in a giveaway title, prize description or replacement reason.
Providers and security
The service uses Microsoft Azure hosting and database services, PayPal or Paddle, and the configured social-data provider to deliver its functions. Operational logs may be processed for security and troubleshooting. Access credentials and recovery codes should not be shared.
Retention and requests
We retain giveaway data while needed to provide access and support, and may retain payment, security and dispute records for applicable legal and operational requirements. Expiration of access does not necessarily delete all records. Deleted information may remain in restricted backups until those backups expire. Specific retention periods and backup schedules: [to be confirmed before publication].
Why we use information
We use information to provide purchased imports, apply your rules, save results, restore access, send requested notifications, prevent fraud and investigate service failures. Where applicable, the legal bases are performance of our agreement, legitimate interests in security and service operation, consent for optional notifications, and compliance with legal obligations.
Service providers and international processing
Microsoft Azure hosts application data. Cloudflare provides network and domain services, HikerAPI supplies available Instagram data, Resend delivers requested emails, and PayPal or Paddle handles payments. Providers receive information needed for their role and may process it in other countries under their own terms and applicable safeguards. Paddle acts as merchant of record for purchases made through Paddle.
Your privacy choices
Contact support to request access, correction or deletion, or to withdraw an optional email request before it is sent. Depending on your location, you may also have rights to object, restrict processing, receive a portable copy or complain to a data protection authority. We may verify your relationship to the records before acting. Do not email passwords, payment card details or your recovery code. Some records must be retained for legal obligations or unresolved disputes.
Children and security
The service is intended for adult giveaway organizers. Do not knowingly submit sensitive information or information about children that you are not entitled to process. We use access controls and protective measures, but no system can guarantee absolute security. Contact support if you believe information has been exposed or used improperly.
Changes to this policy
We may update this policy as the service changes. We will show the updated date and provide additional notice where required by applicable law.