Privacy Policy

Account Information

When you sign in with Google, we receive your name, email address, and profile picture. We use this to create and manage your account.

Bot Configuration

Information you provide during setup: your bot's name, personality, use cases, and any custom instructions. This is stored in our database and used to configure your AI instance.

Payment Information

Payment details are collected and processed directly by Stripe. We do not store your credit card number. We receive your Stripe customer ID, subscription status, and billing history.

Usage Data

We collect basic analytics about how you interact with our website and dashboard, including pages visited and features used.

Each subscriber gets a dedicated virtual machine. Your conversations with your AI assistant via Telegram are processed on your dedicated instance. We do not routinely access, monitor, or read your conversations.

Conversation data, workspace files, and generated content are stored on your dedicated instance. We may access your instance for technical support, troubleshooting, or to enforce our Terms of Service and Acceptable Use Policy.

Public websites you create through canvas are accessible to anyone on the internet and should not be considered private.

We use the following third-party services that may process your data:

• Stripe — Payment processing. Subject to Stripe's Privacy Policy.
• Google — Authentication (OAuth). Subject to Google's Privacy Policy.
• DigitalOcean — Infrastructure hosting for your AI instance.
• Tailscale — Encrypted networking between our systems and your instance.
• AI Model Providers (OpenRouter, Moonshot/Kimi) — Your AI assistant sends prompts to these providers to generate responses. These providers may have their own data retention policies.
• Resend — Transactional email delivery.

We implement security measures to protect your data:

• Each customer gets a dedicated, isolated virtual machine
• All inter-system communication is encrypted via Tailscale (WireGuard)
• AI instances run with non-root privileges
• Instances are protected by cloud firewalls restricting external access
• API keys and secrets are injected at the system level and not exposed to the AI agent directly

No system is perfectly secure. While we take reasonable precautions, we cannot guarantee absolute security of your data.

Your account data is retained as long as your account is active. If you cancel your subscription, your AI instance is terminated at the end of the billing period and instance data is deleted within 30 days.

We may retain billing records and basic account information as required by law or for legitimate business purposes (e.g., fraud prevention) after account deletion.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Opt out of marketing communications

To exercise any of these rights, contact us at support@instaclaw.bot.