InstaText

GDPR overview

GDPR implementation is documented in detail. The privacy policy, last updated on 12 April 2026, names InstaText d.o.o., Ljubljana, Slovenia, as the controller and office@instatext.io as the contact for data protection matters. Legal bases are cited section by section, and seven rights are listed: confirmation and information, rectification, erasure, restriction, portability, objection and withdrawal of consent, alongside the right to complain to a supervisory authority, which is not named. Cookies fall into three categories: functional ones need no consent, analytics and marketing ones require consent that can be withdrawn at any time, and the editor itself uses only functional cookies. Google Consent Mode V2 still sends limited aggregated technical data without consent, under Article 6(1)(f). No DPO is named. No Article 27 representative is required, the publisher being established in the EU, and the terms of 5 March 2026 place the service under Slovenian law.

Who owns the data?

Under the terms and conditions last updated on 5 March 2026, you keep full ownership of every text you submit. InstaText receives only a limited, non-exclusive right to process that text to the extent needed to produce the improvement, and the terms state that no other right in your content is claimed or retained. Nothing is licensed for resale, marketing or model training. Ownership runs the other way for the product itself: the software, the technology, the algorithms and the underlying databases remain the property of InstaText d.o.o., so a subscription buys a right to use them, never a share in them.

Reuse rights

Because you keep ownership of what you submit, you may reuse the improved version however you wish, with no further permission from the publisher. On the publisher's side, submitted text is processed in memory and deleted as soon as the improvement is returned: it is never written to a database or to logs, and it is never used to train, fine-tune or improve the models, not even in anonymised or aggregated form. Model training runs on entirely separate infrastructure and uses proprietary datasets only. Technical data is handled separately and does include the date and time of a request, the browser, the type of application, the referring URL, volumes, response times and a truncated IP address, with the full IP address kept for 30 days at most. That technical data can be linked to your account identifier for support, diagnostics, capacity planning and abuse detection, but never to the content of your texts. The legal bases cited are Article 6(1)(b) for the account and the subscription, Article 6(1)(f) for technical data, and Article 6(1)(a) for analytics and marketing cookies. The named recipients are Paddle.com Market Ltd for payments (United Kingdom, company no. 08172165), Google LLC for Analytics and Ads, Microsoft Corporation for Advertising and Meta Platforms Inc. for the Pixel; EU-to-UK transfers rely on the adequacy decision under Article 45, and EU-to-US transfers on the EU-US Data Privacy Framework with standard contractual clauses where required. InstaText itself recommends keeping other people's personal data out of the text you submit. No data processing agreement is published or offered, and no hosting provider is named.

Data retention & training

Hosting summary

The FAQ states that all data is hosted in the EU and transmitted over encrypted connections using TLS 1.2 or higher, on infrastructure protected by a web application firewall and DDoS protection. That is the full extent of the disclosure: no country, no data centre and no hosting provider is named, so the claim cannot be verified independently. In practice the texts themselves never reach a disk anywhere, since they are processed in memory and deleted as soon as the improved version is returned. Transfers outside the EU are identified and framed in the privacy policy: Paddle in the United Kingdom under the adequacy decision of Article 45, and Google, Microsoft and Meta in the United States under the EU-US Data Privacy Framework, with standard contractual clauses where required. One caveat on the public technical record: the domain resolves to 172.67.69.190, a Cloudflare anycast node geolocated in the United States. That describes the content delivery network sitting in front of the site, not where the data lives, and it does not contradict the EU hosting claim.