Privacy Policy

1. Introduction

This Privacy Policy explains how Instroc ("we", "us", or "our") collects, uses, discloses, and safeguards your information when you use our AI-powered application builder platform at instroc.com (the "Service").

By using Instroc, you consent to the data practices described in this policy. If you do not agree with our policies, please do not use our Service.

2. Data Controller

The data controller responsible for your personal data is:

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish data protection laws.

3. Information We Collect

3.1 Information You Provide

• Account Information: Name, email address, and password when you register
• Profile Information: Avatar, company name, and other optional details
• Payment Information: Billing address and payment method (processed securely by Stripe; we do not store your full card details)
• Content: Applications, code, and other content you create using our platform
• Communications: Messages you send to us for support or feedback

3.2 Information Collected Automatically

• Usage Data: Features used, pages visited, actions taken within the platform
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, and referring URLs
• Where you came from: when you first visit, and only after you agree where the law asks us to, we keep the campaign and click identifiers in the link you arrived with (for example utm_source and an ad platform's click id), the page you landed on, the site that sent you, and your country. We keep this for 30 days if you do not sign up, and on your account if you do. Your IP address from sign-up is kept for 90 days.

3.3 Information from Third Parties

• OAuth Providers: Basic profile information when you sign in with Google, GitHub, or other providers

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Process transactions and send related information
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent or unauthorized activities
• Personalize and improve your experience
• Measure our advertising: to see which ads bring people who sign up, build and pay, and to tell the advertising platform that showed you an ad when that happens, so it can show our ads to people more likely to want them

5. AI and Your Data

Instroc uses third-party AI providers to generate code and power chat. The current list is published on our Subprocessors page, and we give at least 30 days' notice before adding a new one. Here's how we handle your data in relation to AI:

• Your prompts and conversation history are sent to our AI provider(s) to generate code and respond to your requests
• We do not train AI models on your content, and we have not opted into any data-sharing or training program with any AI provider. We rely on the standard commercial API terms of each provider, which prohibit them from training on our API inputs or outputs by default.
• AI requests may be proxied through infrastructure subprocessors (for caching, rate-limiting, or analytics). These subprocessors process the traffic on our behalf and do not use it for their own purposes. See the Subprocessors page for details.
• We may analyze anonymized, aggregated usage patterns (such as feature popularity and error rates) to improve the Service
• We do not sell your personal content to third parties
• AI processing is done securely over encrypted connections

6. Sharing Your Information

We may share your information in the following circumstances:

• Service Providers: With third-party vendors who assist in providing our Service, such as cloud hosting, payment processing, AI services, email delivery, and error tracking. These providers are contractually bound to protect your data and process it only on our behalf. See our current list of subprocessors for the specific vendors we use and their purposes.
• Advertising platforms: if you agreed to advertising measurement (or you are in a place where the law does not require us to ask and you have not opted out), and you arrived through an ad on Meta (Facebook or Instagram), TikTok or X, we tell that one platform when your account signs up or pays, and later when it finishes a first build or publishes, together with a hashed form of your email, the click id from the ad, your IP address, your browser type, and for purchases the amount and currency. Each platform uses this under its own terms to measure and improve our ads and is responsible for its own processing. You can stop this at any time from Cookie settings in the footer.
• Legal Requirements: When required by law, court order, or to respond to legal process
• Safety: To protect the rights, property, or safety of Instroc, our users, or others
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly agree to sharing

We do not sell your personal information to third parties.

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication with password hashing
• Regular security assessments and updates
• Access controls limiting access to personal data
• Secure cloud infrastructure with reputable providers

While we strive to protect your information, no method of transmission over the Internet is 100% secure.

8. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR. If the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

9. Data Retention

We retain your information for as long as your account is active or as needed to provide you services. We may retain certain information as required by law or for legitimate business purposes, such as resolving disputes and enforcing our agreements. When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

10. Your Rights Under GDPR

As a user in the European Economic Area, you have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Rectification: Update or correct inaccurate information
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Request limitation of processing in certain cases
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Where processing is based on consent, withdraw it at any time. For cookies and advertising measurement, use Cookie settings in the footer. The change takes effect at once for anything not yet shared.

To exercise these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or your local supervisory authority.

11. Cookies

We use these cookies and similar storage:

• Necessary: to keep you signed in, protect forms, and remember your cookie choice. Always on.
• Advertising measurement: one cookie that remembers the campaign and click id you arrived with, kept for 30 days. Only set after you agree where the law asks us to.
• Product analytics: a first-party analytics cookie that lets us see which features are used, including session recordings of how pages are used. Only set after you agree where the law asks us to; without it we count page views with no cookie and no profile.
• Affiliate referrals: if you arrive through a partner's link, a cookie remembers the partner so they can be credited if you subscribe. Only set after you agree where the law asks us to.

You can change your choices at any time from Cookie settings in the footer. Where the law does not require us to ask, we honour the Global Privacy Control signal from your browser as a choice not to share data for advertising.

12. Children's Privacy

Instroc is not intended for anyone under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn we have collected such information, we will promptly delete it. If you believe we have information from a child under 16, please contact us.

13. International Data Transfers

Your information may be transferred to and processed in countries outside the European Economic Area, including the United States (where our AI and infrastructure providers operate). We ensure appropriate safeguards are in place for such transfers, including EU Standard Contractual Clauses and reliance on adequacy decisions where available.

Meta, TikTok and X process data in the United States. Transfers to them rely on the EU-US Data Privacy Framework where the platform is certified and on Standard Contractual Clauses otherwise.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice via email or through the Service.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: