Privacy Policy

This Privacy Policy explains how we use your personal information when you use the Service, either as an individual customer, through AI agents, or when you access the Service through an organization’s account. We are the data controller of your personal information when we use it as described here, meaning that we determine and are responsible for how it is processed.

The Service allows customers to submit, store, and process content relating to others — including application data, data generated by AI agents, and data belonging to the end users of applications deployed on InstaCloud (“Customer Data”). We process Customer Data primarily as a processor, on behalf of and under the instructions of the relevant customer, in accordance with our data processing agreements. This Privacy Policy does not apply to our processing of Customer Data in that capacity. If you are an end user of an application built on InstaCloud, please refer to the privacy notice of the relevant InstaCloud customer.

This Privacy Policy does not apply to information about our employees or contractors, or to aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you.

• California — Your California Privacy Rights: If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of personal information to third parties for their direct marketing purposes. We do not sell your personal information as defined under the California Consumer Privacy Act (CCPA). You have the right to know what personal information we collect, the right to request deletion of your personal information, the right to correct inaccurate personal information, and the right to opt out of the sale or sharing of personal information. To exercise these rights, contact us at support@insforge.dev. We will not discriminate against you for exercising any of these rights.
• Nevada: We do not sell your personal information within the meaning of Chapter 603A of the Nevada Revised Statutes. If you would like to submit an opt-out request, please contact us at support@insforge.dev.
• European Economic Area, United Kingdom, or Switzerland: If you are located in the EEA, UK, or Switzerland, see Section 11 — European-Specific Disclosures for additional disclosures, including the lawful bases on which we process personal information and your rights.
• Note for international visitors: Where you choose a region for a service, the data that service stores stays in that region. Account and control-plane information is processed in the United States, and personal information may be transferred to and processed in countries other than the one where it was collected. See Section 12 — International Data Transfers.

We collect personal information in connection with your visits to and use of the Service, including information from AI agents operating on your behalf.

Information That You Provide

Registration information: We collect personal and/or business information when you register for an account, including your name, email address, the identifier from the sign-in provider you use, and organization details. We use this to administer your account, provide the Service, and communicate with you.

Agent and credential configuration: We collect information about the AI agents, API keys, and MCP clients you authorize to use the Service, including their identifiers, scopes, and operational parameters. This lets us authenticate them, apply your governance rules, and attribute activity correctly.

Payment information: We collect transactional information for plan charges and usage-based billing. Card details are handled by our payment processor; we do not store card numbers.

Communications: When you contact us, we collect your contact information and the contents of the communication in order to respond and to improve the Service.

Content, secrets, and agent-generated data: In the course of using the Service you and your agents create, upload, and transmit application code, container images, database contents, stored objects, environment variables, and secrets. You control this content; we process it to run the services you provision.

Information from Third-Party Sources

Single sign-on: We support sign-in with GitHub and Google. When you use one, we receive information such as your name, email address, account identifier, and avatar in accordance with that provider’s authorization flow.

Integrations: Where you connect the Service to a code repository, agent runtime, or other developer tool, we receive the information that integration is configured to share with us.

Information Collected Automatically

Device and usage data: We automatically collect information about your device and how you interact with the Service, including IP address, browser type, operating system, access times, pages viewed, and referring URLs.

Agent and API activity: We collect metadata about the requests your agents and clients make — the operations invoked, the resources affected, timing, quotas consumed, and errors returned — to operate the platform, meter usage, enforce governance rules, and diagnose problems.

Service telemetry: We collect operational metrics and logs from the services you run, such as CPU, memory, storage, and network usage, in order to bill for usage and to show you metrics and logs in the console and CLI.

We may share your personal information in the following circumstances:

• Service providers and sub-processors: We share information with third-party providers who help deliver or improve the Service. They are contractually bound to use personal information only as instructed and are subject to confidentiality obligations. Our principal providers are:
  • Amazon Web Services: platform hosting, managed databases for our own systems, and transactional email delivery
  • Fly.io: hosting for the compute and managed database services you provision
  • Tigris: object storage for the storage services you provision
  • Stripe: payment processing and billing
  • GitHub and Google: single sign-on
  • PostHog: product analytics and usage monitoring in the console
  The current list, including providers added after this page was last updated, is maintained in our Trust Center.
• Legal requirements: We may share information as required by law, to comply with legal process, or to protect the rights, property, or safety of InsForge, our customers, or others.
• Business transfers: We may transfer information in connection with any merger, acquisition, or sale of assets, with reasonable efforts to ensure consistent treatment of personal information.
• With your consent: We may share information for any other purpose with your prior authorization.
• Aggregated or anonymized data: We may share aggregated or anonymized information that does not reasonably identify you directly or indirectly.

We do not sell your personal information, and we do not share it with third parties for their own direct marketing purposes. We do not use Customer Data to train machine learning models.

Depending on your location, you may have the following rights with respect to your personal information. To exercise any of them, contact us at support@insforge.dev.

Right of access: You may request confirmation of whether we process your personal information and, if so, a copy of the information we hold about you, the categories of data, the purposes of processing, and the recipients to whom data has been disclosed.

Right to rectification: You may request correction of inaccurate or incomplete personal information without undue delay.

Right to erasure: You may request that we delete your personal information where continued processing is no longer justified. Upon a verified request we will delete it from our active systems without undue delay and instruct our service providers to do the same, unless we are required to retain it for legal, regulatory, or legitimate business purposes. See Section 6 — Data Deletion Requests.

Right to data portability: You may request a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format.

Right to restriction of processing: You may request that we limit the processing of your personal information in certain circumstances, such as when you contest its accuracy.

Right to object: You may object to processing based on our legitimate interests. For direct marketing, you may object at any time for any reason.

Right to withdraw consent: Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Right to lodge a complaint: You have the right to complain to your local data protection authority if you believe we have not complied with applicable data protection laws. See Section 11 for authority contact information.

Exercising Your Rights

To submit a request, email support@insforge.dev with the subject line “Data Subject Request.” We will respond to verified requests within 30 days. We may require you to verify your identity before fulfilling a request by providing information associated with your account; if we cannot verify your identity, we may be unable to fulfill the request. You may also designate an authorized agent to make a request on your behalf, provided the agent can demonstrate valid authorization.

Email Communications

You may receive emails about Service updates, products, or promotional offers. Our marketing emails include tracking technologies to assess engagement, and you can unsubscribe using the links in them. You cannot unsubscribe from service-related communications such as billing notices, security alerts, and governance approval requests.

Managing Your Account and Agents

You can modify account information, manage organization members, review and revoke API keys and agent credentials, inspect agent and governance activity, and delete projects, environments, and services from the InstaCloud console or the CLI.

We and our providers collect usage information through cookies and similar technologies. The marketing site and the console use them differently, so both are described here.

Cookies We Use

Strictly necessary cookies: Required for the Service to function. These include session cookies for authentication, CSRF protection tokens, and load-balancing cookies. They cannot be disabled. Session cookies are set by the console, are HTTP-only, and are scoped to the console’s host.

Display hint: The console sets a small, non-sensitive cookie across instacloud.com carrying a display name and avatar URL, so that this marketing site can greet you by name when you are signed in. It is not a credential and grants no access; clearing it simply returns the site to its signed-out header.

Analytics cookies: The console uses PostHog to understand how the product is used — pages visited, features used, navigation patterns. You may opt out through your browser settings. The marketing site sets no analytics or advertising cookies.

Third-party cookies: Our payment processor and sign-in providers may set cookies for fraud detection and session management when you use those flows.

How We Use This Data

• Remember your preferences and keep you signed in
• Monitor the effectiveness and performance of the Service
• Analyze usage patterns to decide what to build next
• Diagnose technical problems
• Detect and prevent fraud and abuse

Managing Your Preferences

You can manage cookies through your browser settings; blocking strictly necessary cookies will prevent you from signing in. We honor “Do Not Track” signals sent by your browser: when one is detected, non-essential tracking is disabled.

We retain personal information for as long as needed to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law. The specific period depends on the nature and sensitivity of the information, the purposes for which it is processed, and applicable legal requirements.

Account information: Retained for as long as your account is active. Upon account closure we retain contact information for 60 days to allow for account recovery, after which it is deleted from our active systems.

Content and agent-generated data: Retained for the duration of your account. Upon account deletion it is deleted from our active systems within 30 days. Backup copies may persist for up to 90 days before being overwritten.

Payment records: Retained as long as necessary to comply with tax, accounting, and financial reporting obligations — typically 7 years from the date of the transaction.

Usage and analytics data: Retained in identifiable form for up to 24 months, after which it is aggregated or anonymized. Metered usage records underlying an invoice are retained with the payment records above.

Agent, API, and governance activity logs: Retained for up to 12 months for service quality, billing dispute resolution, security, and debugging, unless you request earlier deletion.

Communications: Support communications are retained for up to 24 months after resolution.

Legal hold: If we are involved in litigation or a legal obligation requires it, we may retain information beyond these periods until the matter is resolved.

You may request deletion of your personal information at any time. We take data deletion seriously and follow the procedure below.

How to submit a request: Email support@insforge.dev with the subject line “Data Deletion Request.” Include your account email address and specify whether you want deletion of specific data or of your account and all associated data.

Identity verification: To protect your privacy, we verify your identity before processing a deletion request. We may ask you to confirm it from the email address associated with your account or to provide additional identifying information.

Processing timeline: We will acknowledge your request within 5 business days and complete the deletion within 30 days of verification. If we need additional time — up to 90 days for complex requests — we will notify you of the reason and the expected completion date.

Scope of deletion: Upon a verified deletion request, we will:

• Delete your personal information from our active databases and systems
• Instruct our service providers and sub-processors to delete your data
• Deprovision the services in your projects and environments, including their compute, volumes, databases, and storage buckets
• Revoke API keys and agent credentials and delete the associated activity logs

Exceptions: We may retain certain information where required by law, for fraud prevention, to resolve disputes, to enforce our agreements, or where deletion is technically infeasible. Backup copies may persist for up to 90 days before being overwritten in the normal course of backup rotation. We will tell you about any data we are unable to delete and why.

Confirmation: Once deletion is complete we will confirm by email, including a summary of what was deleted and of any data retained together with the legal basis for retaining it.

We implement commercially reasonable physical, technical, and organizational measures to protect personal information, including:

• Encryption of data in transit over TLS and of data at rest
• Role-based access controls and multi-factor authentication for internal systems
• Isolation between customer environments, and between branch environments
• Scoped, revocable credentials for agents rather than shared long-lived secrets
• Regular security assessments and vulnerability scanning
• Incident response procedures with defined escalation paths
• Audit logging and monitoring of access to personal information
• Employee security awareness training

Details of our current controls and certifications are available in our Trust Center. No security system is completely secure, however, and we cannot guarantee the absolute security of your information.

Security Breach Notification

In the event of a security breach affecting your personal information, we will investigate promptly and take appropriate steps to contain and remediate it. Where required by applicable law, we will notify affected individuals and the relevant data protection authorities without undue delay and within the timelines the law requires — such as 72 hours for authority notification under the GDPR. Our notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures we have taken or propose to take.

The Site and the console link to third-party websites and services, including agent vendors, developer tools, template repositories, and our providers’ documentation. We are not responsible for their practices. Your interactions with them are governed by their own terms and privacy notices, and we encourage you to review them.

The Service is not intended for children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently done so, we will delete it promptly. Contact us at support@insforge.dev if you believe we have collected information from a child under 13.

We may change this Privacy Policy from time to time. We will notify you of material changes by appropriate means — such as email to the address associated with your account or a prominent notice on the Site — at least 30 days before they take effect. The “Last updated” date at the top of this page indicates when it was last revised. Your continued use of the Service after changes take effect constitutes acceptance of the revised Privacy Policy.

Legal Bases for Processing

If you are located in the EEA, UK, or Switzerland, we process your personal information only where we have a valid legal basis:

• Contract performance: Processing necessary to provide the Service, including account creation, authentication, provisioning, service delivery, metering, and payment processing.
• Legitimate interests: Processing necessary for our legitimate business interests, including service improvement and analytics, fraud prevention and security, customer support, and enforcing our terms. We balance our interests against your rights and will not process where your interests override ours.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent, including marketing communications and non-essential analytics. You may withdraw your consent at any time.
• Legal obligation: Processing necessary to comply with our legal obligations, including tax and accounting requirements and lawful requests from authorities.

Your European Privacy Rights

In addition to the rights described in Section 3, EEA, UK, and Swiss residents have the right to lodge a complaint with their local supervisory authority:

• EU: Contact your local Data Protection Authority. A list of EEA DPAs is available at ec.europa.eu/justice/data-protection
• UK: The Information Commissioner’s Office (ICO) at ico.org.uk
• Switzerland: The Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch

Where Your Data Lives

InsForge is headquartered in the United States, and our control plane — the systems that hold your account, organization, project, and resource metadata, and that meter usage — runs in the United States.

The services you provision are different: each one is created in a region you choose, and the data it stores stays in that region. Regions are offered in the United States, Europe, Asia Pacific, and South America; the current list is shown when you create a service and through insta regions in the CLI. If you need your application data to remain in a particular jurisdiction, select a region there.

Transfer Mechanisms

Where we transfer personal information from the EEA, UK, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we use appropriate safeguards, including:

• Standard Contractual Clauses: We use SCCs approved by the European Commission and the UK Information Commissioner’s Office to govern transfers to the United States and other countries.
• Data processing agreements: We maintain data processing agreements with our sub-processors that include appropriate transfer mechanisms and security obligations.
• Supplementary measures: We implement additional technical and organizational safeguards, including encryption and access controls, to protect transferred data.

You may request a copy of the relevant transfer mechanisms by contacting us at support@insforge.dev.

For questions about this Privacy Policy, to exercise your rights, or to raise a privacy concern, contact us:

• Privacy inquiries: support@insforge.dev
• General inquiries: info@insforge.dev

We are committed to resolving complaints and concerns about your privacy and our collection and use of your personal information. If you are unsatisfied with our response, you have the right to lodge a complaint with the appropriate data protection authority in your jurisdiction.