Privacy policy

For your account (who you are and how you use Instasite), Netcetera is the controller under the EU General Data Protection Regulation (GDPR).

For the content of your websites (pages you edit with Instasite Edit, and anything on them, which may include personal data about your own visitors or customers), you are the controller and Netcetera is your processor. We process that content only to provide Instasite to you, under your instructions and our terms.

Information you give us: your name, email address and profile photo when you sign up; the sites you add; the business names and briefs you write; changes you make to pages; and messages you send to support.

If you sign in with a Netcetera account: we send your Netcetera email and password to Netcetera to check them, and keep your email and the list of your Netcetera domains. We never store your Netcetera password.

Information created by the service: pages Instasite designs for you, page drafts and the earlier copies of pages you change, screenshots, SEO, speed and pre-launch check results, social post drafts, and the activity log for each site.

Information collected automatically: sign-in and security records (such as IP address, browser and time of access) kept by our sign-in provider, and basic server logs kept by our hosting providers.

Information from other sources: public facts about the domains you add: their public pages, brand details, and, when you link one, the business's Google profile.

• To provide Instasite: create your account, fetch brands, design and edit pages, publish pages you choose to publish, and run the checks you ask for. Legal basis: performing our contract with you.
• To keep Instasite secure, prevent misuse (including the limit on free designs), fix faults and improve the service. Legal basis: our legitimate interest in running a reliable, secure service.
• To answer you when you contact support. Legal basis: contract, or legitimate interest.
• To send occasional news about Instasite, where you have agreed or are an existing user. You can opt out at any time from any such email. Legal basis: consent, or legitimate interest.

What you enter for a design, and the public text and images of your site when you choose to use them, are sent to the AI provider below to produce the result. We do not use your data to train AI models, and we do not use it for advertising profiles or for decisions that have legal or similarly significant effects on you.

We share personal data only with the service providers that run parts of Instasite for us, under contracts that limit them to processing it on our instructions, and with authorities where the law requires it. Pages you publish on instasite.app are public. If Netcetera is reorganised or sold, data may pass to the new owner under this policy.

Some providers above are outside the European Economic Area. Where personal data goes to a country without an EU adequacy decision, we rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, with additional safeguards where needed. You can ask us for a copy of the safeguards that apply.

Instasite uses only what it needs to work: sign-in cookies that keep you logged in and protect your account, a setting in your browser that remembers light or dark mode, and the support chat, which stores an identifier so a conversation continues across pages. We do not use advertising or analytics cookies. If we add analytics, this section will say so first, and we will ask for consent where the law requires it.

Account data, sites, designs and check results are kept while your account is open. Deleting your account in Settings deletes them straight away, and your sign-in is removed with them. Pages you published on instasite.app stop being served when you unpublish them or close your account. Security and server logs are kept for a limited period, normally no more than 12 months.

We protect data with encryption in transit, access controls that keep each account's sites and designs separate, and least-privilege keys for our providers. Instasite Edit only works with a key unique to your site and only changes pages you confirm. No system is completely secure; if a breach affects your personal data we will tell you and the authorities as the GDPR requires.

Under the GDPR you can ask us to:

• give you a copy of your personal data;
• correct data that is wrong or incomplete;
• delete your data (you can also do this yourself in Settings);
• restrict or object to how we use it, including for direct marketing;
• give you your data in a portable format;
• withdraw consent, where we rely on it, without affecting earlier processing.

Email privacy@instasite.app from the address on your account. We reply within one month, and may ask you to confirm your identity. For personal data on your own website, you are the controller: we will help you answer requests about it.

You can also complain to a data protection authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee. You may also contact the authority where you live or work.

Instasite is not meant for anyone under 16. We do not knowingly collect their data.

We will update this policy when Instasite or the law changes, and change the date at the top. If a change is significant, we will tell you by email or in Instasite before it takes effect.

NETCETERA OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia. Registry code 16768111.
Privacy questions and requests: privacy@instasite.app