Privacy policy

1. Who we are

The Radari service is provided by BitCryptics (“we”). For the processing described in this policy, we are the controller of personal data within the meaning of the Law. Our contact details are at the end of this page.

For any privacy question or request, write to us: andrewgouma@gmail.com. You can also use the privacy request form.

This policy applies to:

• our customers and the users of their accounts;
• people who request a free demo;
• people whose public data appears in the public profiles of the businesses we monitor, for example business owners, content creators, commenters and reviewers;
• visitors to our website.

2. In short

• Radari serves businesses. It shows owners of small businesses what their competitors publish on Instagram, Facebook, TikTok and Google Maps and what customers say about them.
• We read public data only. We never ask for social media passwords, never access private accounts and never read private messages.
• We monitor businesses, not individuals. We do not build profiles of individuals and do not make decisions about them.
• We do not keep the identity of people who comment in our database: the username is replaced by a code made with a secret key, and the full platform responses, which can contain it, are deleted after 14 days.
• We keep a reviewer's name only for reviews of your own business, to help you reply. Competitors' reviews are stored without names.
• We do not sell data and do not use it for advertising.
• Any business or person can ask us to stop monitoring a profile. We then delete it and never collect it again (section 13).
• You can object at any time to processing based on legitimate interest (section 11).

3. What data we collect and where it comes from

3.1 Customers and account users

To create an account we need your email and a password. For invoices we need the data that tax law requires. Everything else is optional. Without the mandatory data we cannot provide the service.

3.2 People who request a demo

The link and email are needed to prepare and deliver the demo. We use the WhatsApp number to deliver the demo on WhatsApp, once this channel is live, and for abuse limits, for example one demo per business profile or per number within 30 days.

3.3 People whose public data appears in monitored profiles

We monitor the public profiles of businesses: the customer's business and the competitors the customer chooses or we suggest. These profiles can contain data about individuals:

Sources of this data:

• public pages on Instagram, Facebook, TikTok and Google Maps, read through the Apify service;
• Meta's public Ad Library, for the active ads of business pages (how many, since when, where they run and the text of some of them), read through Apify;
• a Google Maps reader on Apify (or the Google Places API, if we switch it on), to find similar businesses on the map;
• public Instagram search by hashtags, locations and keywords, to suggest competitors;
• the business's website homepage (title, description, social links, published phone numbers and addresses);
• Google's Gemini, for the questions that measure a business's visibility in AI assistants;
• our customers, when they add a competitor's link.

We do not read private profiles, or profiles the platform shows only to signed-in users (for example because of age or country restrictions). If a profile is private, we skip it.

3.4 Website visitors

• IP address and browser type, received by our servers and, when used, by Cloudflare Turnstile, PostHog and Sentry;
• pages you visit and a few key actions (e.g. “pricing page viewed”). We strip the secret report and payment codes from page addresses;
• the referring page and UTM parameters;
• cookies and browser storage (section 14).

3.5 When you contact us or send a request

When you write to us or use the privacy request form, we keep your message, your email address, the profile link you send, the language and your IP address (only as a hash with a secret key), and our reply, for as long as needed to handle the request and to show that we handled it (section 9).

4. Why we use data and on which legal basis

The legal bases are those of Article 7(1) of the Law: consent (letter “a”), contract or steps before it (letter “b”), legal obligation (letter “c”) and legitimate interest (letter “dh”).

We do not use data for a new purpose that is incompatible with the original one. If we want to use it for another purpose, we inform you first.

Sensitive data. We do not seek or use sensitive data (for example about health, beliefs or political opinions). A public review or comment may happen to contain such information, which its author made public. We do not use it to draw conclusions about the person.

5. Monitoring public profiles: how we protect people

We collect and analyse public business data on the basis of legitimate interest. Businesses have a legitimate interest in understanding their market and their competition, and we have an interest in providing this service. The data was published by the businesses themselves, or by people who chose to publish it on business pages.

To make sure your interests, rights and freedoms are not overridden, we apply these measures:

• Business profiles, public content only. Our automatic suggestions include only accounts that look like businesses. We do not read private profiles. If a personal profile has been added by mistake, write to us and we exclude it (section 13).
• As little as possible. Per reading we collect up to the 20 newest posts of a profile, up to 20 comments per post (5 in a demo), up to 200 reviews on the first reading of a profile and up to 50 on later readings. These are the current limits, and we may lower them.
• Commenters without identity. In our database the username is replaced by a code that differs for each business. Customers never see the code or the comment text.
• Reviewer names only where needed: only for reviews of the customer's own business.
• Masking before AI. Phone numbers and email addresses are masked in texts the AI analyses. The only exception is the contact number of the customer's own business.
• Short periods. Full platform responses are deleted after 14 days, and the result of each reading at Apify as soon as we have read it. Posts, comments and reviews are kept for no more than about 13 months, even while the profile is still followed. Data of a profile that no business follows any more is deleted automatically (section 9).
• No profiles of individuals. We do not build profiles of individuals, do not use the data for advertising, do not sell it and do not make decisions about individuals.
• Right to object and exclusion. You can object at any time (section 11) or ask us to stop monitoring a profile (section 13).

Who sees this data. Only the customers who follow the business concerned, in the dashboard and in reports, and anyone to whom a customer gives a report link.

Why we do not inform you individually. We have no contact details for the people who appear in public profiles, and to inform them we would have to collect even more data about them. We therefore inform you through this public policy and the measures above, in line with Article 13(2)(a) of the Law.

6. Automated analysis and artificial intelligence

We use Google's Gemini model to:

• classify posts (topics, offers, prices), reviews (sentiment, topics, urgency, names or roles of staff mentioned) and comments (sentiment, customer questions);
• write the daily briefs, the weekly report, reply drafts for reviews of your business and drafts of post captions;
• answer the questions you send us on WhatsApp, once this channel is live;
• ask Gemini questions a customer might ask (e.g. “best restaurant in Tirana”) and measure whether your business is mentioned. For the demo's questions, Gemini also searches with Google's search engine; Google then keeps the questions and answers for up to 30 days.

We send Gemini only the texts and numbers the task needs, with phone numbers and email addresses masked. We send a reviewer's name only for reviews of your own business: the full name for the reply draft and the first name for briefs. We use the paid Gemini API, under which Google does not use this data to improve its products.

The AI writes the sentences, not the numbers. Every number in a report is computed from the collected data and checked automatically. Scores and rankings (e.g. “Pulse”, a competitor's threat level) rate the public activity of businesses, not people.

We make no decisions based solely on automated processing that produce legal effects or similarly significant effects for you (Article 20 of the Law). Recommendations and drafts are suggestions: the customer decides.

7. Who we share data with

We do not sell data and do not share it for advertising. We share it only with the recipients below, each only for its own task:

We have data processing agreements with our processors, as required by Article 26 of the Law. Report links are secret codes that expire: 30 days for customer reports and 14 days for demos.

8. Transfers outside Albania

Some recipients process data outside Albania. We transfer data only:

• to countries the Commissioner has recognised as providing an adequate level of protection (Article 40 of the Law; Decision No. 01 of 30.04.2025). These include the EU and EEA states, the United Kingdom, Switzerland, Kosovo, North Macedonia and others. For the United States, adequacy applies only to companies that adhere to the EU–US Data Privacy Framework;
• or with appropriate safeguards under Article 41 of the Law.

You can ask us for information about the safeguards, or for a copy of them, by writing to us: andrewgouma@gmail.com.

9. How long we keep data

We keep data only for as long as the purpose it was collected for requires. Automatic deletions run every day.

When you delete your account in Settings, we immediately:

• delete your account's personal data (we keep only a row without personal data, for invoices and the action log);
• end all your sessions and report links;
• delete your demo requests and your email log; requests to stop messages are kept only as a hash;
• if you are the sole owner of a business: cancel the subscription and delete the business's name and details, its recipients, conversations, locations, competitors, briefs, reports, recommendations, alerts, analyses, AI checks, messages, email log, demos and events.

Invoices, payments and the action log are kept as fiscal and security records. Invoices keep the buyer's name and NIPT, as the law requires.

10. Your rights

Under the Law you have the following rights. You have them even if you are not a customer, for example if you wrote a public review of a business we monitor.

• Right to information (Article 13): to know how we process your data. This policy serves that purpose.
• Right of access (Article 14): to get confirmation of whether we process your data and, if so, a copy of it together with information on the purpose, legal basis, source, recipients and retention period.
• Right to rectification and erasure (Article 15): to correct inaccurate or incomplete data and to ask for its deletion, for example when it is no longer needed or when you have objected. When we delete or correct data, we also inform the recipients we disclosed it to.
• Right to be forgotten (Article 16): where we must erase data that we have published ourselves, we take reasonable steps to tell other controllers processing it that you asked for its erasure.
• Right to restriction of processing (Article 17): for example, while we verify the accuracy of the data or your objection.
• Right to data portability (Article 18): to receive the data you gave us in a structured, machine-readable format and to transmit it to another controller.
• Right to object (Article 19): see section 11.
• Right not to be subject to automated decisions (Article 20): we make no such decisions (section 6).
• Right to withdraw consent (Article 8(3)), at any time and as easily as you gave it. Withdrawal does not make earlier processing unlawful.
• Right to complain to the Commissioner (Article 86): see section 12.

11. Your right to object

12. How to exercise your rights

Yourself, without writing to us:

• Settings → Download your data: the account owner downloads the account and business data as JSON. Public posts and reviews we collect from the platforms, including those of your own profiles, are not in the export; it lists the links of the profiles you follow.
• Settings → Notifications: change or stop notifications.
• Settings → Delete account: delete your account, even if you no longer have a business (section 9 lists what is deleted).
• Demo emails: click “Unsubscribe in one click” at the bottom of the email and we send you no more reminders or offers after the demo. Emails about a demo you asked for (when it is ready, or if it fails) still reach you.
• WhatsApp: send STOP or NDALO and we immediately stop every message to that number.

On request: fill in the privacy request form or write to us: andrewgouma@gmail.com. Say which right you want to exercise. If you are not a customer, send us the link to the profile, post or review that concerns you. For comments: since we do not keep usernames, we can find your comments only if you tell us your username and the link to the post. We compute the same code from them and do not store the name.

• Identity: if we have reasonable doubts about your identity, we may ask for additional information (Article 12(3)). We will not ask for more than we need.
• Time limit: we answer without delay and no later than 30 days after receiving the request. For complex or numerous requests we may extend this to 60 days. In that case we tell you, with the reason, within 30 days (Article 12(4)).
• Free of charge: answering is free. For manifestly unfounded or excessive requests, in particular repeated ones, we may charge a reasonable fee or refuse to act (Article 12(5)).
• Refusal: if we do not fulfil a request, we tell you why within 30 days, together with your right to complain to the Commissioner and to go to court.

Complaints to the Commissioner. You have the right to complain to the Commissioner for the Right to Information and Personal Data Protection, https://www.idp.al. A complaint costs you nothing. You can also write to us first, so we can try to resolve it together.

13. Asking us to stop monitoring a profile

Any business or person can ask us to stop monitoring a profile, for example a business owner for their own business's profile, or a person for their own personal account or for a profile that features them.

1. Fill in the privacy request form and choose “Stop monitoring a profile”, or write to us (andrewgouma@gmail.com) with the subject “Exclusion from monitoring”. Send us the link to the profile (Instagram, Facebook, TikTok, Google Maps or the website).
2. We run a simple check that the request comes from the business or person concerned, for example a message from the business's official email or profile. We do not ask for identity documents unless it is really necessary.
3. An administrator adds the profile to the exclusion list and deletes it from our database, together with the data collected from it: posts, comments, reviews, image copies and full platform responses. By default we exclude the whole business, on every platform, unless you ask for one profile only.
4. The profile is never collected again. Customers cannot add it, and automatic suggestions skip it. Customers who followed it are told only that it was removed for privacy reasons, not who asked.
5. On the exclusion list we keep only the profile's identifiers (link, username, platform ID or website address), for as long as the exclusion applies, so that we can honour it.
6. We confirm the exclusion by email without delay and no later than 30 days. The data disappears from backups within about 4 weeks.

If you only want one of your own reviews or comments removed, and not the whole business profile, send us its link with the same form. We handle it as an erasure request or an objection (sections 10 and 11).

14. Cookies and browser storage

We use no advertising cookies and do not track you across other sites. We use only the following:

Statistics (PostHog, when we switch it on). The in-browser statistics tool uses no cookies and no storage on your device: everything stays in the page's memory. We do not record sessions, do not auto-capture clicks, and strip secret codes from addresses. If your browser sends a “Do Not Track” signal, this tool collects nothing. A few key events (e.g. “report opened”, “payment succeeded”) are still recorded on our servers with your account or demo-request identifier, and sent to PostHog in the EU under a pseudonymous code, without names, emails or phone numbers.

Bot protection (Cloudflare Turnstile). On the demo, signup, sign-in, email sign-in link, checkout and privacy request forms we load Turnstile from Cloudflare. It processes your IP address, browser type and some technical connection signals to tell people from bots. Cloudflare also uses this data as an independent controller, to improve Turnstile.

Error reports (Sentry, when we switch it on). If an error occurs, we send a technical report without cookies, request headers or the secret codes in addresses.

For these reasons we show no cookie banner.

15. WhatsApp and email messages

For now we write to you by email only. WhatsApp messages start once this channel is live, and the rules below then apply to them.

• WhatsApp: we message you only after you have confirmed your number with the “Confirm” button. At any time you can send STOP or NDALO and we immediately stop every message to that number. If you choose in WhatsApp to stop only marketing messages, we stop the demo reminders but not the briefs you pay for.
• Reminders and offers after a demo are sent only if you chose them in the demo form: by email after 72 hours and after 7 days; on WhatsApp, once this channel is live, after 24 hours (only if your competitors did something new) and after 72 hours. They stop automatically when you subscribe, when the demo expires or when you ask us to stop.
• Demo emails say why you receive them and end with an “Unsubscribe in one click” link. After you unsubscribe we send you no more reminders or offers; emails about a demo you asked for (when it is ready, or if it fails) still reach you.
• Account and billing emails, such as invoices and renewal notices, keep coming for as long as you have an account. You change business notifications in Settings.

16. Security

• Data travels encrypted (HTTPS, with HSTS).
• Passwords are stored only as argon2id hashes. Session, report, demo and sign-in link codes are stored only as hashes.
• IP addresses are stored only as keyed hashes. Commenter usernames are replaced by a keyed code.
• Forms are protected against bots and excessive requests.
• Administrator access is restricted and needs two-step verification, with a code from an authenticator app. For support, an administrator can view your account as you, in read-only mode and for no more than one hour. Such a view, and every administrator action that changes data, is logged.
• Card data never passes through our servers.
• Processors and everyone with access are bound by confidentiality (Article 30 of the Law).

If a personal data breach occurs, we notify the Commissioner without delay and no later than 72 hours after becoming aware of it, unless the breach is unlikely to endanger your rights and freedoms (Article 29(1)). If the risk to you is high, we also inform you.

17. Children

Radari is a service for businesses and is not directed at anyone under 18. We do not knowingly collect children's data. If a minor appears in a public post, or has written a comment or review on a business profile, we apply the measures in section 5 (for example, comments are stored without identity). A parent or guardian can ask us to delete it with the privacy request form or by writing to us: andrewgouma@gmail.com.

18. Changes to this policy

If we change this policy in a significant way, we notify you by email (and on WhatsApp, if you use it) before the change takes effect. The date of the last update is shown at the top. We send previous versions on request.

19. Contact

For any privacy question, write to us: andrewgouma@gmail.com. For requests you can also use the privacy request form. Our name and contact details are below.