Privacy Policy.

Instill (“we,” or “us”) is the team operating the Instill website, applications, and services (the “Service”). Instill is currently in early Beta and is not yet incorporated as a separate legal entity; the operators of the Service are responsible for handling your data in accordance with this policy.

If you have any question about your data, write to us at hello@instill.expert.

We collect the following categories of personal data:

• Account information. Your name, email address, and authentication identifiers when you sign up or sign in. Experts additionally provide professional background and profile information.
• Content you submit. Prompts, briefs, files, run inputs, and any other material you provide when engaging an expert agent. For experts: the materials you use to instill an agent — methods, examples, voice references.
• Run & engagement data. The outputs produced by agents, expert verifications, revisions, and the audit trail of the engagement.
• Payment data. Billing details and transaction history are processed by Paddle, our Merchant of Record. Instill receives transaction confirmations and limited metadata; we do not store your full card or banking details.
• Usage & device data. Log data such as IP address, browser type, pages visited, timestamps, and referring URLs, collected for security and product improvement.
• Cookies & local storage. Used to keep you signed in and to remember your preferences. See section vii.
• Communications. Messages you send us by email or through the Service.

We use personal data to:

• Provide, operate, and maintain the Service.
• Authenticate you, secure your account, and prevent fraud or abuse.
• Run agent engagements — including sending your inputs to language model providers to produce outputs (see section iv).
• Process payments and fulfil our tax, accounting, and regulatory obligations.
• Improve the product, debug, monitor performance, and develop new features. Where we use Your Content to improve models or templates, we de-identify or aggregate it first.
• Send transactional and Service-related communications (e.g., receipts, security alerts, important notices).
• Respond to your requests, feedback, and support questions.
• Comply with applicable law and enforce our Terms of Use.

Our legal bases for processing (where GDPR or similar laws apply) include performance of a contract with you, our legitimate interests in operating and improving the Service, your consent (for non-essential cookies or marketing), and compliance with legal obligations.

We do not sell your personal data. We share it with carefully chosen providers who help us run the Service, under contractual confidentiality and data-protection obligations:

• Paddle — payment processing and Merchant of Record.
• Supabase — authentication, database, and file storage.
• Vercel and Railway — application hosting and background workers.
• Language model providers (for example, Google and OpenAI) — to execute agent runs on the inputs you submit. These providers process inputs and outputs on our behalf under their respective enterprise terms; they do not train their models on your data.
• Operational tools — email delivery, error monitoring, and product analytics providers that support the Service.

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets — in which case we will give you notice where reasonably possible.

Our service providers operate across multiple jurisdictions, including the United States, the European Union, and India. Your data may be transferred to and processed in countries other than where you reside. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses to protect international transfers.

We retain personal data for as long as your account is active and for a reasonable period afterwards to support legitimate business and legal needs — for example, to defend legal claims, satisfy tax and accounting obligations, or maintain security logs. After that, we delete or anonymize it.

During Beta, retention practices may evolve. If you delete your account, your content will be removed from active systems and from backups in the ordinary course of our backup cycle.

We use a small number of cookies and local-storage entries to keep you signed in, remember your preferences, secure the Service, and understand how it is used. We do not use cookies for cross-site advertising.

You can control cookies through your browser settings; disabling essential cookies may prevent parts of the Service from working.

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to our processing of your personal data, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data-protection authority.

To exercise any of these rights, email us at hello@instill.expert. We will respond within the timeframes required by applicable law.

We use industry-standard administrative, technical, and physical safeguards — including encryption in transit, access controls, and audit logging — to protect personal data. No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as required by law.

The Service is not directed at children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy as the Service evolves. We will change the effective date at the top, and for material changes we will give additional notice through the Service or by email.

For any privacy-related question or request, write to us at hello@instill.expert. As Instill is in early Beta and not yet incorporated as a separate legal entity, this email is the primary channel for privacy correspondence.