How we found you

Only what your Instagram profile showed publicly at the time we looked:

• Your account handle and display name.
• Your profile description, as written, and any link in it.
• Your follower and post counts.
• The country we inferred from your profile, and the product category we guessed at — jewellery, candles, crochet and so on.

We hold no private messages, no email address unless your profile published one, no payment details, and nothing from a private account.

We did not get it from you. We found your profile by searching public Instagram accounts for makers and small sellers, using a third-party web-scraping service, Apify. Everything in section 01 came from the public version of your profile as Apify recorded it. We have not bought your details from a list broker and we have not combined them with data from anywhere else.

We build Mark8ly, a storefront for people who currently sell by taking orders in their direct messages. We approached you because your public profile suggested you sell that way. The only purpose is to ask whether that is a problem worth solving for you. We are not profiling you, scoring you, or making any automated decision about you.

In the UK and the EU we rely on our legitimate interests under Article 6(1)(f) of the GDPR — approaching a business about a product relevant to how that business operates. We assessed that interest against your interests and rights before contacting you, and we will share that assessment with you on request.

In India, information you have yourself made publicly available falls outside the Digital Personal Data Protection Act 2023 under section 3(c)(ii). We rely on that, and we still honour the requests below.

In Australia, Canada and New Zealand we rely on the equivalent provisions for business contact information published openly, in a business capacity, where our message relates to that business.

Reply STOP to our message, or email [email protected]. Either one is enough, and you do not have to give a reason.

Where the GDPR applies you have an absolute right to object to direct marketing under Article 21(2): once you object we must stop, with no balancing exercise. We add you to a suppression list so the same profile cannot be re-imported and contacted again by mistake. If you would rather we deleted the record outright than suppressed it, say so and we will.

If you do not reply, we delete the record twelve months after we collected it. If you ask us to stop, we keep only the minimum needed to honour that — a one-way fingerprint of your handle on the suppression list — so that we do not contact you again. If you reply and want to talk, it becomes an ordinary business contact record and our general privacy policy applies.

You can ask us for a copy of what we hold, ask us to correct it, or ask us to erase it. Email [email protected] and we will respond within one month.

If you are unhappy with how we handled it you can complain to your data protection authority — the Information Commissioner's Office in the UK, or your national authority in the EU. You do not need to come to us first.

Tesserix Pty Ltd (ACN 694 070 865), 5 Tagu Place, Kings Park NSW 2148, Australia, is the controller for this outreach. Reach us at [email protected].