Privacy Policy
Last updated: 15 October 2026
1. Who we are
This Privacy Policy explains how Instama B.V. ("Instama B.V.", "we", "us", "our") processes personal data in accordance with the General Data Protection Regulation (GDPR) and the Dutch implementation act (Uitvoeringswet AVG).
Instama B.V.
Bakenesserstraat 12
2011 JJ Haarlem, The Netherlands
Chamber of Commerce (KvK): 93689721
Email: hello@instama.co
We have not appointed a data protection officer; questions about personal data go to hello@instama.co.
2. What this policy covers, and our role
This policy covers the Instama website (instama.co, including the demo booking and the access request form), the Instama platform (whether you reach it on our domain or on a domain your organisation connected), the API, MCP connections, the Figma plugin and the emails we send.
Instama B.V. is the data controller for your account, your membership of an organisation, billing, usage and security records, support, the website and the demo booking.
Instama B.V. is a data processor for everything you and your organisation put into the platform or create with it ("Client Data"): brand materials, text, images, video, audiences, chats with the assistant, the pages we read from your website at your request, and any personal data these contain. The organisation that holds the workspace is the controller of Client Data and decides what it is used for. We process it only on that organisation's instructions, under the data processing terms in section 7 of our Terms. If you want to exercise your rights over Client Data, contact that organisation; we assist it.
3. The data we process, why, and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account: name, email address, profile picture, language, sign-in codes and the settings of your authenticator app. If you sign in with Google, Microsoft or GitHub we receive your name, email address and profile picture from that provider. | Creating, securing and supporting your account | Performance of a contract (art. 6(1)(b) GDPR) |
| Membership: the organisations and brands you belong to, your role, invitations (a member of an organisation enters your email address to invite you), and what other members see of you in the shared workspace: your name, picture, presence and activity on content. | Running a shared workspace | Performance of a contract; for an invitation you have not yet accepted, the legitimate interest of the inviting organisation in working with you (art. 6(1)(f)) |
| Billing: company name and address, VAT and Chamber of Commerce number, invoice email address, plan, invoices and payment status, and the country derived from your IP address at checkout. Card and bank details are entered with our payment provider; we never see them. | Charging for the service, invoicing, VAT determination, bookkeeping | Performance of a contract; legal obligation (tax and bookkeeping law, art. 6(1)(c)) |
| Client Data (see section 2), including the conversations you have with the assistant and the instructions you give it. | Delivering the platform as your organisation instructs | Processed on behalf of your organisation, the controller |
| Usage and audit records: the actions taken in your workspace and by whom, AI usage (model, token counts and cost, not the content), and technical performance measurements of the pages you open (page, timings, browser, your user id). | Operating, securing, supporting and improving the platform; metering usage for billing | Our legitimate interest in a reliable, secure and billable service (art. 6(1)(f)) |
| Security records: server logs (IP address, browser, time, request), the IP address and browser of a sign-in code verification, API keys (stored hashed), OAuth grants and the IP address that registered an API client. | Protecting accounts and the platform, detecting and investigating abuse | Our legitimate interest in security (art. 6(1)(f)) |
| Connected accounts: when you connect Facebook, Instagram, LinkedIn, Pinterest or Google Ads, the access tokens and the identifiers of the pages and ad accounts you choose. | Publishing and advertising on your instruction | Performance of a contract |
| Website analytics: cookies and identifiers set by Google Analytics on the website and the platform; cookieless speed measurements (see section 9). | Understanding how the website and the platform are used | Your consent for analytics cookies (art. 6(1)(a)); our legitimate interest for cookieless speed measurement |
| Demo booking: name, email address, time zone, the time you chose and your answers to the booking questions. Our scheduling provider holds the meeting; we keep our own record of the booking. | Scheduling and holding the demo, sending the invitation and reminders, following up | Steps at your request before entering into a contract (art. 6(1)(b)) |
| Newsletter: your email address, language, and when and where you ticked the box (for instance on the demo booking form). The box is never pre-ticked. | Sending you the Instama newsletter | Your consent (art. 6(1)(a)), which you can withdraw at any time through the link in every newsletter or by emailing hello@instama.co |
| Access request (waitlist): email address, name, company, your note and language. We keep a keyed hash of your IP address to limit repeated requests, never the address itself. | Reviewing your request and granting access | Steps at your request before entering into a contract |
| Support and feedback: what you send to hello@instama.co and the account it concerns. | Answering you, fixing problems, improving the platform | Performance of a contract; our legitimate interest in handling feedback (art. 6(1)(f)) |
Account and billing data are needed to provide the service; without them we cannot open or keep an account. Everything else is optional or follows from how you use the platform.
We do not ask for special categories of personal data (such as health, religion or political opinions). If Client Data contains such data, the organisation that uploaded it is responsible for having a lawful basis.
4. AI processing and automated decisions
The platform creates and edits content with AI models. To do so it sends the relevant Client Data and your instructions to the model providers listed on our Governance page. Each organisation controls which models it enables. Our agreements with these providers prohibit the use of your data to train or improve their models, and we do not use your data to train models either.
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (art. 22 GDPR). The AI assists with marketing content, not with decisions about people.
5. Who receives personal data
We do not sell personal data. We share it only with:
- Service providers (processors) that act on our instructions under data processing agreements: hosting, database and file storage infrastructure in the European Union (the Netherlands, Germany and France); rendering infrastructure in Frankfurt, Germany; AI model, web search and website reading providers; our payment provider (Mollie, the Netherlands); our email delivery provider; our demo scheduling provider (Calendly); and our analytics providers (Google Analytics and Vercel Speed Insights). A named list of these providers, with their locations, is available on request, and we tell you before a new provider starts processing your data.
- Social and advertising platforms you connect (Meta, LinkedIn, Pinterest, Google). What you publish or advertise there is processed by those platforms as independent controllers under their own privacy policies.
- Third-party applications you authorise through an API key, an MCP connection or the Figma plugin. They act on your behalf, see what you allow them to see, and what they keep is governed by their own privacy policies. You can revoke their access at any time in your account settings.
- Members of your organisation, who see your name, picture, presence and activity in the shared workspace.
- Authorities and professional advisers, when the law requires it or to establish, exercise or defend legal claims.
6. International data transfers
We store and process personal data in the European Union. Some of our providers are established in the United States (among them the AI model providers, Google Analytics and Calendly). Where personal data is transferred outside the European Economic Area we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework for providers certified under it, and otherwise on the Commission's Standard Contractual Clauses together with an assessment of the destination country. You can ask us for a copy of the safeguards that apply to a transfer.
7. How long we keep data
| Data | Retention |
|---|---|
| Account | As long as your account exists. You can ask us to delete it at any time; we delete it within 30 days unless we must keep part of it by law. |
| Organisation and Client Data | As long as the organisation has access. When its subscription or trial ends, its brands, content, chats and members are removed 60 days later; owners are notified before that happens. Content you move to the trash is permanently deleted after 30 days; a deleted brand after 48 hours; autosave checkpoints after 30 days. |
| Invoices and billing records | 7 years after the financial year, as Dutch tax law requires. |
| Usage, audit and performance records | Up to 24 months. |
| Records of AI quality checks | 90 days. |
| Server and security logs | Up to 90 days. |
| Sign-in codes, invitations, API and OAuth tokens | Sign-in codes 7 days; invitations up to 90 days after they expire; tokens 30 days after they expire. |
| Demo bookings and access requests | 12 months after the demo (or its cancellation) or after the decision on the request. |
| Newsletter consent | Until you withdraw it; the record of the withdrawal 12 months longer, as proof. |
| Support correspondence | As long as needed to handle your request and keep a record of it, and no longer than 24 months after it is closed. |
Backups are overwritten on a rolling basis within 30 days of a deletion.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected and incomplete data completed;
- have your data erased;
- restrict processing while a question about it is being resolved;
- receive the data you gave us in a structured, machine-readable format, and have it transmitted to another provider where technically feasible;
- object to processing based on our legitimate interest, which we then stop unless we have compelling grounds to continue;
- withdraw consent at any time, without affecting the processing before withdrawal;
- lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the authority of the EU country where you live or work.
To exercise a right, email hello@instama.co from the address on your account, or describe the data concerned. We may ask you to confirm your identity. We answer within one month; if a request is complex we may extend this by two months and tell you why. Exercising your rights is free of charge. Your organisation can also export its content from the platform at any time.
For Client Data, contact the organisation that holds the workspace; it is the controller of that data and we support it in answering you.
9. Cookies and similar technologies
Essential: a session cookie keeps you signed in to the platform and ends when your session does; a short-lived cookie carries a sign-in in progress; your browser's local storage keeps preferences such as language, theme and open panels. These are needed to provide the service and require no consent.
Analytics: Google Analytics sets cookies (such as _ga, kept for up to two years) on the website and the platform to measure how they are used. We set these cookies only after you accept them in the cookie banner; a choice is remembered for a year and can be changed at any time through "Cookie settings" in the footer of the website. Vercel Speed Insights measures page speed without cookies and without identifying you.
We do not use advertising or cross-site tracking cookies.
10. Security
We protect personal data with measures that include:
- encryption in transit (TLS) and at rest;
- access control enforced per brand in the database, so a member sees only the brands they belong to;
- two-factor authentication with an authenticator app, and passwordless sign-in codes;
- API keys stored as hashes, revocable at any time;
- audit logging of actions in a workspace, and least-privilege access for our staff;
- hosting in the European Union with regular backups and security reviews.
If a personal data breach is likely to put you at risk, we notify the Autoriteit Persoonsgegevens within 72 hours and inform you without undue delay, as articles 33 and 34 GDPR require.
11. Children
The platform and the website are intended for businesses and are not directed at children under 16. We do not knowingly collect personal data from them; if you believe we have, contact us and we will delete it.
12. Changes to this policy
We may update this policy; the date at the top shows the current version. We announce material changes by email or in the platform before they take effect.
13. Contact
If you have any questions about this Privacy Policy or our data practices, contact us at:
Instama B.V.
Bakenesserstraat 12
2011 JJ Haarlem, The Netherlands
Chamber of Commerce (KvK): 93689721
Email: hello@instama.co