Privacy Policy

1. Who is responsible for your data

Instanics, run by a sole trader based in the UK, is the controller of your personal data under UK data protection law. You can contact us about privacy at instanicsdev@gmail.com.

2. What we collect

• Account details. Your email address and password, which is stored securely and never in plain text. If you sign in with Google instead, we receive your name, email address and profile picture from Google.
• What you tell us. Your business idea, your answers during onboarding and the briefs we generate. That includes the names, colours, logos and other choices you make. Please don't put sensitive personal information in your idea.
• A random browser ID. When you use Instanics without an account, your browser stores a random ID. It lets you get back to your briefs and lets us move them into your account when you sign up.
• Your IP address. We record it when a brief is created so we can apply fair-use daily limits and stop abuse.
• How you use onboarding. For example, which step you reached and which options you picked. We use this to improve the flow.
• Purchases. What you bought, when you bought it, and the customer and payment IDs from Stripe. Stripe handles your card. We never see or store your full card number.
• Messages. Emails you send us, and the account emails we send you, such as sign-up confirmation and password reset.

3. How we use it, and our legal basis

• To provide Instanics: to generate briefs, save them, unlock what you've paid for and run your account. Legal basis: contract.
• To keep the service safe and affordable: to apply daily limits, prevent fraud and abuse, and fix bugs. Legal basis: legitimate interests.
• To improve the product: to understand where people get stuck during onboarding. Legal basis: legitimate interests.
• To keep financial records: we have to keep payment records for tax purposes. Legal basis: legal obligation.

We don't send marketing emails unless you've opted in. We don't make decisions about you that have legal or similarly significant effects using automated means alone. We don't use your ideas or briefs to train AI models.

4. Who we share it with

We use trusted service providers to run Instanics. They may only use your data to provide their service to us.

• Lovable and Supabase. Hosting, database and sign-in.
• AI providers, including Anthropic, through Lovable's AI gateway. Your idea and choices are sent to them to generate your brief and to research competitors on the web. Their terms don't allow them to use this data to train their models.
• Stripe. Payments, tax and fraud prevention. Stripe acts as the reseller (merchant of record) for purchases, so it also uses your payment details under its own privacy policy.
• Porkbun. We check domain availability with them. We send only the domain names, never your personal details.
• Google. Google provides sign-in if you choose it. Google Fonts also serves the fonts on our pages, which means your browser connects to Google and shares your IP address with it.
• Our email provider. It sends account emails.

If you choose to build your site on Lovable, you'll take your brief to Lovable yourself. Lovable's own privacy policy then applies to what you share with them.

We may also share data if the law requires it. If our business is sold, your data may transfer to the buyer under the same protections.

5. International transfers

Some of our providers process data outside the UK, mainly in the United States and the European Economic Area. When they do, we rely on UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum. These safeguards protect your data to UK standards.

6. Cookies and browser storage

We don't use advertising or analytics cookies. Your browser stores a few small items that Instanics needs in order to work: the login session that keeps you signed in, the random browser ID described above, and your progress through onboarding. Because these are strictly necessary, we don't ask for consent to store them. You can clear them in your browser settings. If you do, you'll be signed out and lose access to any briefs that weren't saved to an account.

7. How long we keep it

• Account data and saved briefs: while your account is open. We delete them within 30 days of you asking us to.
• Briefs never saved to an account: 12 months.
• IP addresses used for daily limits: 30 days.
• Payment and invoice records: 6 years, as UK tax law requires.
• Emails to us: as long as we need them to deal with your request, and no longer than 2 years.

8. Your rights

Under UK data protection law, you have the right to:

• get a copy of your personal data;
• have your personal data corrected;
• have your personal data deleted;
• restrict how we use it, or object to how we use it;
• receive your data in a portable format.

To use any of these rights, including deleting your account, email instanicsdev@gmail.com from the address on your account. We'll reply within one month. These requests are free.

If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

9. Security

We protect your data with encryption in transit, access controls on our database and limits on which staff and systems can see what. No online service can be completely secure. If a breach puts your rights at risk, we'll tell you and the ICO as the law requires.

10. Children

Instanics is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has used Instanics, contact us and we'll delete their data.

11. Changes to this policy

If we change this policy, we'll update the date at the top. If we make a significant change, we'll also tell you by email or in the app.

12. Contact

If you have questions about privacy, email instanicsdev@gmail.com.