Introduction
Instabase, Inc. (“Instabase,” “we,” or “us“) provides this Services Privacy Policy to explain who we are and how we collect, use and share personal information in connection with technical support, hosted or other services (the “Services“) that we provide to Instabase customers. If you have any questions about our use of your personal information, please contact us using the details provided below.
We may change this Services Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of this document. You may also request to be notified of all Services Privacy Policy updates by emailing a request to: privacy@instabase.com. We encourage you to review this Services Privacy Policy periodically to stay informed about our practices.Please note that this Service Privacy Policy does not describe our collection, use and sharing of personal information when visitors access our website (https://www.instabase.com). For information about how we collect, use and share personal information in connection with our website please see our Website Privacy Policy.
Who We Are
Instabase provides an application platform that can be used to understand unstructured data and automate business processes. Instabase is a global company headquartered in San Francisco, California. Our Services allow our customers with global and mission-critical operations to understand unstructured data with proprietary deep learning technologies, rapidly build end-to-end workflows with pre-packaged solution blocks, and innovate at scale across their organisation in real time. For more information about Instabase, please see https://www.instabase.com/company/.
If you are located in the European Economic Area (“EEA“), UK or Switzerland, the controller of your personal information is Instabase, Inc.
What This Policy Covers
This Services Privacy Policy explains how we use your personal information for our own business purposes in connection with the Services. This Services Privacy Policy applies, for example, if you use the Services as an authorised user under a customer’s (your employer’s) account (“User“) or you are an individual whose personal information is included in the text, image files, data or other content that we process within Instabase or our third party processors systems and environments in connection with the Services (“Content“).
This Services Privacy Policy does not cover the practices of companies that we do not own or control. Similarly, this Services Privacy Policy does not apply to personal information that we process as a processor or service provider on our customer’s behalf in the course of providing our Services or, relatedly, personal information that is processed exclusively within our customer’s environments and systems. For example, when customers provide us with Content in connection with our Services we typically process that information as a processor or service provider on their behalf. If you have questions or concerns about how such personal information is processed, you should contact the relevant customer that is using the Services and refer to their separate privacy policies. We are not responsible for the privacy practices of our customers or other third parties, which may differ from those described in this Services Privacy Policy.
Information We Collect Through The Services
We collect the following personal information in connection with our Services. This includes information that you provide to us in connection with the Services, information that we obtain from third parties, and information that is collected automatically (such as through the use of cookies and other technologies).
Information that you provide
If you are a User, you may provide certain personal information to us, for example when you create an account to access the Services, when you contact customer support, or when you send us an email or communicate with us in any way. The categories of personal information we collect from you include:
- Business contact information (such as name, job title, organisation, email address and company);
- Account log-in credentials (such as email or username and password when you sign-up for an account);
- Troubleshooting and support data (such as information you provide to us or we otherwise process in connection with support queries, including the content of your communications with us);
- Payment information (such as credit card numbers, associated identifiers and billing address).
- Marketing information (such as your contact and marketing preferences); and
- Inquiries and feedback (such as contact information and the contents of your communication with us).
We use this information to operate, improve and provide you with the features and functionality of the Services, as well as to communicate with you and send you email messages about products and services that may be of interest to you.
You are free to choose which personal information you want to provide to us or whether you want to provide us with personal information at all. However, some information may be necessary for the performance of our contractual obligations.
Our use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Information automatically collected through the Services
When you use our Services, we may automatically collect certain information relating to the performance, configuration and consumption of the Services. The categories of information we collect from you include:
- Log data (information stored in log files, such as IP address, browser or device type, operating system, domain name, device identifiers, and referring website addresses);
- Usage data (information about your use of the Services, such as date/time stamps associated with your usage, pages viewed, searches and other actions you take, features used, and other metrics and information regarding your use and interaction with the Services); and
- Location data (which we may be able to infer based on your IP address);
- Cookies and Other Tracking Technologies (For information about cookies and other tracking technologies we use, and options to disable them, please see our Cookie Notice.).
We use this information to provide, support and operate the Services, for security and troubleshooting purposes, and to analyse, develop and improve our products and services.
Information we process on behalf of customers
When customers use the Services, they may submit Content to us for processing. We do not control the Content that our customers may choose to submit to us, but the categories of personal information may include:
- Identification and contact data (such as name, address, title, contact details);
- Financial data (such as financial information found in bank statements, pay slips and other financial and tax documents); and
- Health data (such as health-related information as found in health records, lab reports, x-rays, insurance claims).
We generally process Content under our customers’ instructions and in accordance with our customer agreements. This means that our customers are responsible for correcting, deleting or updating the Content they submit to the Services and for complying with applicable laws and regulations requiring them to provide notice and/or obtain consent prior to submitting the Content to us. In some cases, where permitted by the relevant customer and applicable law, we may use certain Content collected through the Services to improve and develop the functionality of our Services. To the extent Content is considered personal information under applicable privacy and data protection laws, we will ensure such information is processed in compliance with this Services Privacy Policy and applicable laws.
Users of certain paid plans have the option of opting-out from the use of their content for the improvement of our services, as well as individuals who have been granted a written exception (for example, licensed professionals in highly regulated industries). You may submit a written request for such an exception to privacy@instabase.com.
How We Use Your Personal Information
We use your information for a variety of purposes, including to provide our Services, to communicate with you, and for business purposes such as analysing use of our products, improving our Services, and building, training and improving our machine learning algorithmic models.
If you are located in the EEA or United Kingdom, we need a legal basis to process your personal information. Our legal basis will depend on the information concerned and the context in which it is processed. We may process your information in order to enter into or perform a contract with you, when Instabase or a third party has a legitimate interest in processing your information which is necessary and justified considering any possible risks to you, when it is necessary to comply with our legal obligations, or with your consent.
The table below sets out our purpose for processing your personal information and our legal basis for doing so.
| Categories of personal information | Business purpose for processing | Legal basis for processing (EEA and United Kingdom only) |
| Business contact information Account log-in credentials Inquiries and feedback | To provide the Services to customers and our Users To create, administer and manage your account To provide you with the features and functionalities that you have requested | Performance of a contract Legitimate interests Consent |
| Business contact information | To communicate with you To respond to inquiries about our products and services, such as if you email us or fill out a web form or request support To send you information about our Services such as notifications, technical notices and service updates, security alerts and administrative messages | Performance of a contract Legitimate interests Consent |
| Payment information | To process your payment | Performance of a contract |
| Business contact information Marketing information Inquiries and feedback Location data | To send you marketing communications in accordance with your preferences To conduct marketing research to improve the effectiveness of our marketing campaignsTo conduct research, contests, surveys, and sweepstakes To display advertising and relevant offers to you on third-party websites, based on your activities and interests | Legitimate interests Consent |
| Troubleshooting and support data | To understand, diagnose, and resolve issues with the Services | Performance of a contract Legitimate interests |
| Business contact information Account log-in credentials Payment information | To enforce our terms and policies To detect and prevent fraud, including fraudulent payments and fraudulent use of the Services To establish, exercise, or defend legal claims | Legitimate interests Compliance with legal obligations |
| Log data Usage data Location data | To analyse usage and trends to identify opportunities for the improvement and development of the Services To use personal information (in a de-identified form) to develop new features, capabilities or products | Legitimate interests Consent |
| Content | To train and improve our machine learning models and algorithms for our customers’ benefit | Legitimate interests |
Who We Share Your Personal Information With
We may share your personal information with the following categories of third parties:
- with our group companies, and third party service providers and partners who provide data processing services to us, or who otherwise process personal information for purposes that are described in this Services Privacy Policy or notified to you when we collect your personal information;
- with any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary as a matter of law, to exercise, establish or defend our legal rights, or to protect your vital interests or those of any other person;
- with a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Services Privacy Policy; and
- with any other person with your consent.
Instabase may share your personal information with the third parties described above, but we do not sell personal information to third parties.
Data Transfers
Instabase is headquartered in the United States and the Services are provided and hosted in the United States and other counties where Instabase, our group companies and third party service providers and partners are located. This means that your personal information may be transferred to, and processed in, countries other than the country in which you reside and these countries’ laws may be different (and be less protective) as the laws of your country.
Wherever Instabase transfers personal information cross-border, we take appropriate steps to ensure the personal information is protected in accordance with this Services Privacy Policy and applicable privacy and data protection laws. This includes, for example, implementing standard contractual clauses adopted by the European Commission and UK authorities between our group companies, which require all group companies to protect personal information they process from Europe in accordance with European data protection laws, and implementing additional safeguards where necessary. We have implemented similar measures and safeguards with our service providers and partners.
Data Retention
We retain personal information so long as we have an ongoing legitimate business need to do so (for example, to provide you with the Services, to comply with applicable legal, tax or accounting requirements, to resolve disputes, or as otherwise permitted or required under applicable law).
When we have no ongoing legitimate need to process your personal information, we will delete it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. We may also further retain information in an anonymous or aggregated form where that information would not identify you personally.
Information for California Consumers
This section applies to California consumers and describes how we collect, use and share personal information in connection with our Services. For purposes of this section, “personal information” has the meaning given by the California Consumer Privacy Act of 2018 (“CCPA“) and does not include information exempted from the scope of the CCPA.
We collect the following categories of personal information (as defined by CCPA) directly from you or automatically from your device:
- Identifiers (such as name, job title, organisation, email address and company, username and password, and IP address);
- Commercial information (such as marketing information, troubleshooting and support data, and inquiries and feedback);
- Internet or network information (such as browser or device type, operating system, domain name, device identifiers, referring website addresses, and usage data);
- Financial information (such as payment information and other billing related information); and
- Geolocation data (such as city, state, and country based on IP address).
The business and commercial purposes for which we collect your personal information are described in the section of this Services Privacy Policy titled “How We Use Your Personal Information” and the categories of third parties to whom we disclose your personal information for one or more business purposes are described in the section titled “Who We Share Your Personal Information With”.
Your Rights
You may have certain rights and choices with respect to your personal information. Please note that your rights will depend on where you are located and applicable privacy and data protection laws. These may include, for example, the right to access your personal information, request correction or deletion of your personal information, object or opt-out to our processing of your personal information or request portability of your personal information.
European Rights
If you are located in the EEA or United Kingdom, you have the following data protection rights:
- Access: You can request information about the personal information we process about you and a copy of your personal information.
- Correction: If you believe that any personal information we process about you is incorrect or incomplete, you can request that we correct or update such information.
- Deletion: You can request that we delete some or all of your personal information from our systems.
- Objection: In some circumstances, you can object to the processing of your personal information for particular purposes (such as for direct marketing purposes or to train our models and algorithms).
- Withdraw Consent: If we are processing your information based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. Please note that if you withdraw your consent, this does not affect the lawfulness of our processing of your personal information before you withdraw consent.
- Restriction of Processing: In some circumstances, you can ask us to restrict the processing of your personal information.
- Portability: You can ask for a copy of your information in a machine-readable format and, in some circumstances, ask that we transmit your personal information to another controller where technically feasible.
If you are not satisfied with how we collect and process your personal information, or how we have handled your request, you may also complain to a data protection authority. For more information, please contact your local data protection authority. Contact details for data protection authorities in the European Economic Area and Switzerland are available here.
California Rights
If you are resident in California, you have the following rights under California law:
- Right To Know: You can request information about the personal information we have collected, used and disclosed for business purposes over the past twelve (12) months, including the specific pieces of personal information we have collected.
- Right to Delete: You may also request that we delete personal information we have collected from you, subject to certain exceptions.
Instabase does not discriminate against you for exercising your rights or offer you financial incentives related to the use of your personal information. Instabase also does not sell personal information or share personal information with third parties for their direct marketing purposes. We may provide third parties with certain personal information to provide or improve our products and services, for example to deliver products or services at your request. In such cases, we require those third parties to handle the information in accordance with applicable laws and regulations.
How to Exercise Your Rights
If you are seeking to exercise your rights under data protection laws, or if you are an authorised agent wishing to exercise rights on behalf of someone else, please contact us at privacy@instabase.com. We will respond to any requests we receive in accordance with our obligations under applicable privacy and data protection laws.
Please note that we may verify your identity by a method appropriate to the type of request you are making. You may use an authorised agent to submit a request on your behalf, but we may require the authorised agent to provide evidence that they are authorised to act on your behalf and may still contact you to confirm your identity and that the request was submitted with your permission. Please note that in some circumstances, we may not be able to fully comply with your request, such as if we are unable to verify your identity or identify you in our systems.
As noted above, in some cases we may process your personal information on behalf of our customers in connection with the Services, in which case we are a processor or service provider of your personal information. If we are a processor or service provider of your personal information (not a controller), please contact the relevant customer with your rights request. If you have any questions about your rights, please contact us at privacy@instabase.com.
Our Policy Towards Children
The Services are not directed to or intended for use by children under the age of 18. If you are a child under 18, please do not attempt to register for the Services or send us your personal information. If a parent or guardian becomes aware that their child has provided personal information to us, please contact us at privacy@instabase.com. If we become aware that a child under the age of 18 has provided us with their personal information, we will remove such information from our files.
Contact Us
If you have any questions or concerns about this Services Privacy Policy or our use of your personal information, please email us at: privacy@instabase.com.