This policy explains what personal data Instract collects through this website and in the course of our business, why we use it, and the choices you have. It does not cover the systems we build and operate for clients, where the client decides how personal data is used and we act on its instructions.
Who we are
Instract builds enterprise workflows, applications and AI agents for organizations and operates them on the client's behalf. For the personal data described in this policy, Instract is the controller. You can reach us about privacy at privacy@instract.ai.
Data we collect
We collect only what we need to respond to you and to run our business.
- Contact details
- Name, work email, company, role and the message you send when you book a demo or write to us.
- Business relationship
- Contract, billing and correspondence records for the people we work with at client and partner organizations.
- Website use
- Pages visited, referring page, browser and approximate location from your IP address, collected with privacy friendly analytics that set no advertising cookies.
- Job applications
- The CV, links and answers you send us when you apply for a role.
How we use it
We use personal data to answer your requests and arrange demos, to deliver and invoice our services under contract, to keep this website secure and understand how it is used, to assess job applications, and to meet our legal obligations. We rely on our contract with you, our legitimate interest in running and improving our business, your consent where we ask for it, and legal requirements. We do not sell personal data and we do not use it to train AI models.
Client systems we operate
When we build or operate a system for a client, the client is the controller of the personal data in it and Instract is its processor. We process that data only on the client's documented instructions, under a data processing agreement, inside the environment the client chooses. Agents run under the same access rules as the client's people, personal fields are masked in logs and traces, and every action is written to the client's audit trail. Questions about data in a client's system should go to that organization first.
International transfers
Our team and providers may be located in different countries. When personal data moves to a country without an adequacy decision, we protect it with standard contractual clauses or an equivalent safeguard. Client systems stay in the region the client selects.
Retention
We keep enquiries for up to two years after our last contact, contract and billing records for as long as tax and accounting law requires, website analytics for up to fourteen months, and job applications for up to one year unless you agree to a longer period. We then delete or anonymize the data.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent at any time. Write to privacy@instract.ai and we will answer within one month. You can also complain to the data protection authority where you live or work.
Contact
For any question about this policy or your personal data, write to privacy@instract.ai. We will post any change to this policy on this page with a new date, and tell clients directly about changes that affect them.