Privacy Policy

We use your information for these purposes:

• Provide the Service: Create and maintain your account, host storefronts, process payments via Stripe
• Personalization: Remember your preferences, settings, and usage patterns
• AI generation: Generate product descriptions and storefront layouts (only content you provide)
• Communication: Send account updates, transactional emails, support responses, billing notifications
• Security and fraud prevention: Detect abuse, prevent chargebacks, identify suspicious activity, enforce ToS
• Legal compliance: Fulfill legal obligations (tax reporting, DMCA takedowns, subpoenas)
• Product improvement: Analyze usage to improve features, fix bugs, develop new functionality
• Analytics and monitoring: Understand how users interact with the Service, measure performance
• Legitimate business interests: Protect against fraud, enforce our Terms, troubleshoot technical issues

For users in the EEA/UK, our processing is based on:

• Contract: Processing necessary to provide the Service and execute our Agreement with you
• Legal obligation: Complying with tax laws, anti-money laundering, law enforcement requests
• Legitimate interests: Fraud prevention, security, product improvement, business operations
• Consent: Optional features like optional AI generation, marketing emails (you can withdraw anytime)

How long we retain your data:

• Account data (email, name, profile): Retained while account is active. After account deletion, retained for 3 years for fraud prevention and legal compliance, then deleted.
• Payment and transaction history: Retained for minimum 7 years for tax, accounting, and legal compliance (required by law). Longer retention may apply based on jurisdiction.
• Store content (product images, descriptions): Retained while store is live. Upon deletion, retained for 30 days in backups/archives, then permanently deleted (except where legal holds apply).
• Logs and analytics (IP, device info, usage): Retained for up to 24 months for security and troubleshooting. Older logs are aggregated or deleted.
• Customer data from your storefronts: Your responsibility to retain or delete. We retain a copy for order fulfillment and dispute resolution. After 3 years of inactivity, we may delete customer contact info.
• Cookies and session tokens: Typically expire after 30 days of inactivity or when you log out.

instxnt is based in the US and data is primarily processed in the US via Cloudflare and Stripe. Both processors may transfer data internationally depending on where they operate.

For EU/UK Users (GDPR & UK GDPR):

Transfers to the US are based on:

• Adequacy decisions (e.g., UK GDPR for UK data)
• Standard Contractual Clauses (SCCs) between us and our processors
• Contractual commitments with Stripe and Cloudflare

To request a copy of our Standard Contractual Clauses or execute a Data Processing Addendum (DPA), contact privacy@instxnt.xyz.

General Rights (All Users):

• Access: Request a copy of your personal data
• Correct: Update inaccurate information
• Delete: Request deletion of your data
• Port: Request your data in a portable format

GDPR Rights (EU/EEA/UK Users):

• Right to be forgotten: Delete your data (with exceptions for legal obligations)
• Right to restrict processing: Ask us to limit how we use your data
• Right to object: Opt out of legitimate interest processing
• Right to lodge a complaint: Contact your data protection authority (DPA)

CCPA/CPRA Rights (California Users):

• Right to know: What categories of personal information we collect
• Right to delete: Request deletion (with exceptions)
• Right to correct: Fix inaccurate data
• Right to opt out: Opt out of any "sale" or "sharing" of personal information (we don't sell, but may share for marketing under CPRA definition)
• Right to limit: Limit use of sensitive personal information
• Limit tracking: Opt out of cross-context behavioral advertising (CPRA)

LGPD Rights (Brazil Users):

• Access, correct, delete, port, and object to processing
• Right to withdraw consent anytime

How to Exercise Your Rights: Email privacy@instxnt.xyz with:

• Your name and account email
• The specific right you're requesting (access, delete, correct, port, etc.)
• Sufficient information to locate your data

Response time: We will verify your identity and respond within 30 days (may extend by 60 days if complex). We may request government ID for verification.

We implement technical and organizational safeguards to protect your data:

• Transport security: TLS 1.2+ encryption for all data in transit
• Encryption at rest: Provider-managed encryption for databases and storage (Cloudflare, Stripe)
• Access control: Role-based access; employees can only access data needed for their role
• Authentication: Multi-factor authentication for admin access
• Monitoring & logging: Logs of administrative actions and access attempts
• Regular security audits: Third-party penetration testing and vulnerability assessments
• Incident response: Documented procedures for responding to breaches

If you discover a security vulnerability, please email security@instxnt.xyz.

In the event of a confirmed breach of your personal data, we will:

• Notify you without undue delay (typically within 72 hours)
• Describe the nature of the breach and data affected
• Provide steps to mitigate risk
• Notify relevant supervisory authorities where required by law
• Notify Stripe and other processors as appropriate

We use cookies and similar tracking technologies to:

• Maintain your session and remember login state
• Remember your preferences and settings
• Analyze usage patterns via Cloudflare analytics

We do not use third-party advertising cookies or sell behavioral data to advertisers. You can disable cookies in your browser settings, but some features may not work properly.

See our Cookie Policy for more details.

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we discover that we have collected data from a child under 13, we will delete it promptly.

Parents or guardians who believe a child has provided information should contact privacy@instxnt.xyz.

Content you publish to your storefront (product titles, images, descriptions) is public and may be:

• Indexed by search engines (Google, Bing, etc.)
• Cached by third-party services and archives
• Screenshot and shared on social media

You are responsible for the privacy implications of publishing content. We can help remove content from our Service, but cannot control third-party caches or archives.

We do NOT sell personal information.

Under CCPA, we also DO NOT "share" personal information for cross-context behavioral advertising, though we may share data with processors for legitimate business purposes (e.g., Stripe for payments).

If you are a California resident and want to opt out of any future "sale" or "sharing," contact privacy@instxnt.xyz.