Privacy Policy | Sorsa API

This Privacy Policy explains how Scouts Labs Inc ("Sorsa", "we", "us" or "our") collects, uses, shares and protects personal data in connection with Sorsa API: the website at api.sorsa.io, the dashboard, the API, the Playground, our free tools, the Documentation and our support (together, the "Service").

It covers two groups of people:

our customers, and people who visit our website, sign in, contact us or use our free tools (Sections 3 and 4); and
people whose publicly available information on X and other public sources can be accessed through the Service (Section 5).

This policy is a notice that describes our practices; it is not a contract. Our Terms of Service govern the use of the Service. Sorsa is independent and is not affiliated with, endorsed by or sponsored by X Corp. X and the X logo are trademarks of X Corp.

1. Who we are

The controller of your personal data is Scouts Labs Inc, a company incorporated in the British Virgin Islands, with its registered office at Intershore Chambers, PO Box 4642, Road Town, Tortola, VG1111, British Virgin Islands. We operate Sorsa API.

For any privacy question or request, write to contacts@sorsa.io. Putting "Privacy request" in the subject line helps us route it faster.

Section 6 explains when we act on behalf of a customer rather than as the controller.

2. What this policy does not cover

This policy does not cover X or other platforms and websites, which have their own privacy policies; the products and services of our customers, who decide how they use the data they obtain through the Service and are responsible for their own privacy notices; or other Sorsa products that have their own privacy notice.

3. Information we collect about customers and visitors

3.1 Account information

When you create an account, we collect what we need to register you, sign you in and manage your account. Depending on the sign-in method you choose, this includes:

email address and password, if you sign up with email;
for Google: your email address, name and Google account ID;
for GitHub: your username, email address and GitHub account ID;
for Telegram: your Telegram user ID, username, name and other details shared through Telegram's login;
for a crypto wallet: your wallet address and the signature used to sign in.

We also keep your account settings, the API keys you create, your notification preferences (such as usage alerts by email or Telegram), your plans and your balances.

You need to give us the account information for your chosen sign-in method, and payment information when you buy, to use the Service: without it we cannot create your account or process your purchase. Everything else you give us is optional.

3.2 Billing and payment information

Card and cryptocurrency payments are handled by our third-party payment processors. We do not receive or store full card numbers or card security codes. We receive and keep payment records: the plan and period, amount and currency, payment method type (card or crypto), the card brand and last digits where the processor provides them, payment status and time, invoice and transaction references, and, for crypto payments, the transaction details needed to confirm them.

3.3 API usage information

When you use the API and the dashboard, we automatically record:

request logs: which API key made which request, when, to which endpoint, with which parameters (such as usernames, user IDs, post links and search queries), the response status and whether the request was counted;
responses: the full response returned to each request;
the IP address a request comes from, the user agent, and the approximate location derived from the IP address (country or region);
performance, error and security data.

3.4 Website, dashboard and free tools

When you visit our website or dashboard, we record the pages you view, the links you click, referring pages, your device and browser type and your approximate location; analytics providers receive this only with your consent (Section 3.6). When you sign up from one of our pages, we may record with your account which page or link brought you, to learn which parts of our site work. When you use a free tool or the Playground, we process what you enter, such as a username or a post link, to return the result, and we log it with the time and your IP address to keep the tools available and prevent abuse.

3.5 Messages and forms

When you contact us by email, through support tickets or chat, through our sales form or through an academic application, we collect what you send us, such as your name, email address, Telegram username, company, role, institution, expected request volume, project description, messages and attachments.

3.6 Cookies and similar technologies

On the api.sorsa.io website and dashboard, we use cookies and similar technologies for:

strictly necessary functions (authentication, session management, security);
preferences and features (theme, language, dashboard layout);
analytics (understanding how the Service is used and improving it), through Google Analytics;
advertising measurement (understanding which of our ads lead to sign-ups, API use and purchases), through Google Ads.

Analytics and advertising cookies are set only after you allow them in our cookie banner. You can accept all optional cookies, allow analytics only or reject them, and you can change or withdraw your choice at any time through the "Cookie settings" link in the website footer or in the dashboard account menu. You can also manage cookies in your browser settings. Before you make a choice, or if you reject these cookies, Google tags may still send limited cookieless signals (such as the page visited and the time) that do not identify you and that Google uses to estimate aggregate measurements. Blocking some cookies may affect how the Service works. We do not use cookies for remarketing or personalised advertising.

3.7 Advertising measurement

If you reach the Service through one of our ads or a tagged campaign link, the link contains campaign parameters such as the Google Ads click identifier (gclid, gbraid or wbraid), the campaign, ad group, keyword and UTM parameters. Until you accept advertising cookies, we use these parameters only within the current page visit. After you accept, we store them in a first-party cookie for up to 90 days and link them to your account when you sign in, so that we can measure which campaigns lead to registrations, first API use and purchases. For this purpose, we may send Google Ads the click identifier together with the type, time and value of the resulting action. We do not send your email address, wallet address, API keys or the content of your API requests to advertising platforms. If you withdraw consent, we delete the cookie and stop using stored click identifiers for future advertising measurement.

3.8 Information from other sources

We receive information from the sign-in providers you choose (Section 3.1), from our payment processors (the payment details in Section 3.2), and, with your consent, from our analytics and advertising partners (measurement and aggregated reports).

4. How we use customer and visitor information

Where the GDPR, the UK GDPR or similar laws apply, we rely on the legal bases shown below.

Purpose	Information used	Legal basis
Create and run your account, sign you in, provide the API, the dashboard and support	Account, usage, messages	Performance of our contract with you
Count requests, apply plans and balances, bill you, process payments and keep financial records	Account, billing, usage	Contract; legal obligations (tax and accounting)
Keep the Service secure, prevent fraud, abuse and multiple free accounts, and enforce our Terms	Account, usage, IP address, device	Legitimate interests in protecting the Service, our customers and the public
Monitor, debug and improve performance and reliability, investigate incidents and handle uptime claims	Request logs, responses, error data	Legitimate interests in a reliable Service; contract, for uptime claims
Send service messages: receipts, usage alerts, plan reminders, security notices and changes to our terms	Account and contact details	Contract; legitimate interests
Send product news and offers by email (you can unsubscribe at any time)	Email address, account and usage information	Legitimate interests in telling customers about our products, or consent where the law requires it
Answer sales, academic and support enquiries	Messages and form entries	Legitimate interests; steps at your request before a contract
Analytics and advertising measurement	Cookie and campaign data	Consent
Comply with the law, respond to lawful requests, and establish, exercise or defend legal claims	Any relevant information	Legal obligations; legitimate interests

We do not use customer or visitor personal data for targeted advertising or remarketing.

5. People whose public information is available through the Service

If you have a public account on X, information you have made public may pass through the Service when our customers request it. This section explains what that means for you.

Your right to object

You can object at any time, on grounds relating to your particular situation, to our processing of your personal data based on legitimate interests, including the processing described in this Section 5. Write to contacts@sorsa.io.

5.1 What information, and where it comes from

The Service can return public profile information (such as username, display name, user ID, bio, the location you entered, profile and banner images, links, account creation date, verification and other public account labels, and public counts), public posts, replies, reposts and quotes with their public metrics, public follower and following relationships, and public lists, communities, Spaces, articles and "About this account" information. It comes from X and other public sources, as they make it available at the time of each request. We also generate analytics from it, such as Sorsa Score for accounts in our crypto index (Section 13).

5.2 What the Service is designed not to process

The Service is not designed to process private messages, posts that their authors have limited to approved followers (such as posts from protected accounts), passwords or other non-public account data. We do not set out to collect special categories of personal data, such as information about health, religion, political opinions or sexual orientation, and our analytics are not designed to infer them. Such information may still appear in what people choose to publish.

5.3 Why we process it

To provide the API: to retrieve and deliver the public information our customers request for their own purposes, such as research, analytics, brand and market monitoring, journalism, security, checking the actions of campaign participants, and building their products.
To produce Sorsa Score and other analytics.
To operate, secure and support the Service: our request logs and stored responses let us bill correctly, answer support questions, investigate errors and abuse, and handle uptime claims.
To handle objections and legal requests, and to establish, exercise or defend legal claims.

5.4 Legal basis and safeguards

Where the GDPR or similar laws apply, we rely on legitimate interests: our interest in operating a lawful data service; our customers' interests in accessing public information for research, analytics, security and other business purposes; and the public interest in access to information and freedom of expression. We have weighed these interests against your interests and rights, taking into account that the information has been made public on your account, that the Service is read-only and is not designed to reach private content, and the following safeguards:

public information only, with no private messages and no posts limited to approved followers;
no special categories of data sought or inferred;
limited storage: full responses for 30 days and request logs for one year (Section 5.6);
our customers must use the information lawfully and in line with the platform rules that apply to them, as our Terms of Service require, and are responsible for their own processing;
you can object at any time (Section 5.7), and our Terms allow us to withhold or remove information;
security measures (Section 10).

Some laws treat publicly available information differently or exclude it from their scope; where that applies, we follow the rules of that law.

5.5 Who receives it

The information goes to the customers who request it, who decide independently how they use it and are responsible for using it lawfully; to our service providers (Section 7); and to authorities or other parties where the law requires (Section 7). When we fetch information from X for a customer, we do not tell X who the customer is.

5.6 How long we keep it

What	How long
Information fetched for a request	Fetched live from the source; we keep only the response and the log below
Full responses returned to customers	30 days, then deleted
Request logs, which may include the username, ID, link or search terms a customer asked about	One year, then deleted
Shadowban check results	Cached for up to one hour
Sorsa Score data	While the account is part of our crypto index, refreshed regularly; earlier values are kept only as long as needed to show changes over time

Customers who receive information keep it under their own policies, which we do not control.

5.7 Your choices and rights

You can ask us for access to, correction or deletion of the personal data we hold about you, or object to our processing of it, by writing to contacts@sorsa.io. To protect you, we may ask you to show that you control the account concerned, for example by posting a short code from it. Where the law requires it, we will stop processing your public information for our own purposes, and we may stop returning it through the Service. We cannot delete information from X or from our customers' systems. Where the law requires it, we will pass your request on to the customers who received the information, as far as this is possible and proportionate. You can also complain to a data protection authority (Section 11).

6. When we act for a customer

When we retrieve and deliver public information at a customer's request, we act on that customer's behalf, as set out in our Terms of Service (Section 10). The customer decides what to request and how to use what it receives, and is responsible for its own processing and for answering requests about information it holds. For our own purposes, listed in Sections 4 and 5.3, we act as the controller and this policy applies. If you contact us about a customer's use of your information, we will pass your request on to that customer where the law requires it and we can identify them.

8. International transfers

We are based in the British Virgin Islands, and we and our service providers process data in other countries, which may have different data protection laws from yours. Where the law requires it, we protect transfers with recognised mechanisms, such as adequacy decisions or the European Commission's Standard Contractual Clauses, with the UK Addendum where relevant.

9. How long we keep information

Information	How long we keep it
Account information	While your account exists. After you delete it, we delete or anonymise it within a reasonable period, except what we must keep for the reasons below
Google sign-in data	Deleted within 30 days after you close your account, or sooner on request
Request logs (which requests were made and when)	One year, then deleted
Full API responses	30 days, then deleted
Payment and tax records	As long as tax, accounting and anti-fraud laws require
Support, sales and academic messages	As long as needed to deal with them and keep a record of our service, then deleted or anonymised
Advertising campaign identifiers	Up to 90 days in a first-party cookie, with your consent
Security and abuse records	As long as needed to protect the Service and handle claims

We may keep information for longer where the law requires it, or where we need it to resolve disputes or to establish, exercise or defend legal claims.

10. Security

We use administrative, technical and organisational measures designed to protect personal data, including encryption of connections with TLS 1.2 or 1.3, access controls and monitoring. No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your sign-in credentials and API keys secure. If a personal data breach occurs, we will notify you and the authorities where the law requires it. Please report vulnerabilities to contacts@sorsa.io.

11. Your rights

Depending on where you live, you may have the right to:

know what personal data we hold about you and get a copy of it;
correct inaccurate or incomplete data;
have your data deleted;
restrict how we use it;
receive your data in a portable format;
object to processing based on legitimate interests, and object at any time to direct marketing;
withdraw consent where we rely on it, without affecting processing before the withdrawal;
not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you; and
complain to a data protection authority, for example where you live or work, or to the Information Commissioner of the British Virgin Islands.

If you live in a U.S. state with a consumer privacy law, you may also have the right to know, access, correct, delete and obtain a portable copy of your personal data, and to opt out of its sale, of targeted advertising and of certain profiling. We do not sell our customers' or visitors' personal data or use it for targeted advertising. We will not treat you differently for exercising your rights. If we decline your request, you may appeal by replying to our answer with "Appeal" in the subject line, and we will respond within the time the law sets. An authorised agent may make a request for you with proof of their authority.

How to make a request. Write to contacts@sorsa.io. We will confirm your identity before acting, for example through the email address on your account or, for information from X, by asking you to show that you control the account concerned. We answer within one month, or within the time your local law sets, and may extend this where the law allows, telling you why. Requests are free unless they are manifestly unfounded or excessive. Account holders can also update their details and delete their account in the dashboard settings.

12. Emails and notifications

We send service messages as part of the Service, such as receipts, usage alerts, reminders before a crypto plan ends, security notices and changes to our terms. You can choose your usage alerts and the channel for them (email or Telegram) in the dashboard settings. We may also send you product news and offers; every such email has an unsubscribe link, and you can also unsubscribe by writing to us. Unsubscribing from marketing does not stop service messages.

13. Automated processing and Sorsa Score

We do not make decisions about our customers, or about people whose information is available through the Service, that have legal or similarly significant effects on them based solely on automated processing.

Sorsa Score is an automated estimate of how an account is regarded in the crypto community. It is calculated from which influential crypto accounts, such as projects, investors and known commentators, publicly follow the account, and from how influential those followers are. Follower counts, content and verification badges do not affect it, and follow-for-follow and mass-following patterns are filtered out. It is available only for accounts in our crypto index. If you think your Score is based on wrong information, or you object to your account being scored, write to us.

We also use automated checks to detect abuse and fraud, such as multiple free accounts. If such a check affects your account, you can ask for a person to review it.

14. Google user data

When you sign in with Google, we access your email address (to identify your account), your name (to personalise the Service) and your Google account ID (to authenticate you). We use this data only to create your account, sign you in, send you service messages and help you recover your account. We do not use it for advertising, we do not sell it, and we do not use it to develop, improve or train artificial intelligence or machine learning models. We share it only with service providers that help us run the Service, where the law requires it, or as part of a business transfer. You can revoke our access at any time in your Google Account settings. Data from your Google sign-in is deleted within 30 days after you close your account, or sooner on request.

Sorsa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

15. Children

The Service is not directed to children and is not intended for anyone under 18, or under the age of digital consent in your country if that is higher. We do not knowingly collect personal data from children through our website or dashboard. If you believe a child has given us personal data, write to contacts@sorsa.io and we will delete it.

16. Do Not Track and browser signals

There is no common standard for Do Not Track signals, so our website does not respond to them. Optional analytics and advertising cookies run only after you allow them (Section 3.6). If you allow them, Google may collect information about your visit through our website and combine it with information from other websites under its own policies.

17. Third-party services and AI tools

The Service links to and works with third-party services, such as sign-in providers, payment processors and AI assistants or other tools that you connect to our API. When you send data to them, including data you pass from our API to an AI assistant, their own terms and privacy policies apply, not this policy.

18. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new date. For material changes, we will also notify account holders by email or in the dashboard before the changes take effect. Where the law requires your consent to a change, we will ask for it.

19. Contact

Scouts Labs Inc (Sorsa API)
Intershore Chambers, PO Box 4642, Road Town, Tortola, VG1111, British Virgin Islands
Email: contacts@sorsa.io (subject line "Privacy request")