Instantly

GDPR overview

GDPR is addressed explicitly and in detail. Section 14 of the privacy policy, dedicated to European data subjects, lists the lawful bases relied on (contract performance, legitimate interest, legal obligation, vital interests, consent) and recalls the right to complain to a local supervisory authority. International transfers rely on EU Standard Contractual Clauses, the EU-U.S. Data Privacy Framework, the UK-U.S. Data Bridge and adequacy decisions. A public Data Processing Agreement, incorporated by clause 6.6 of the terms, carries the SCCs and a UK addendum, publishes the subprocessor list and grants 15 days' notice and a right to object before any new subprocessor is added. The Article 27 EU representative is EDPO, Avenue Huart Hamoir 71, 1030 Brussels, with EDPO UK Ltd for the United Kingdom; the privacy contact is privacy@instantly.ai. One caveat: campaign-level compliance is contractually left to the customer.

Who owns the data?

Clause 6.3 states that the subscriber retains all right, title and interest in its Subscriber Data. In return, the customer grants Instantly a non-exclusive, worldwide, royalty-free licence to access and use that data to deliver the service, and to compile de-identified, aggregated and anonymised data to improve it; this second licence is perpetual and irrevocable. Clauses 6.4 and 6.5 go further: Aggregated Data belongs to Instantly, which may publish it where the law allows and the customer is not identified, and Performance Data belongs to Instantly for any lawful purpose. Under the DPA, Instantly is the processor and the customer the controller.

Reuse rights

Customers keep ownership of what they upload, but their freedom to reuse what comes out of the platform is deliberately narrow. Clause 6.2 forbids using the service to prepare, validate or package Subscriber Data for any data resale activity, and clause 6.3 states that no licence is granted to resell, license, rent, transfer or otherwise commercialise Outputs, Performance Data, Aggregated Data, Third-Party Data, Visitor ID Information or any other data made available through the service. In practice, the data serves the customer's own outreach and nothing else: reselling it or packaging it into a product sold on is out of bounds. Before any upload, the customer must have obtained every consent and right required from third parties, and an output containing EU or UK personal data may only be processed with valid consent or another lawful basis. Clause 4.3(a) adds that every AI output must be reviewed before use, the customer remaining solely responsible for its content, legality and accuracy.

Data retention & training

Hosting summary

Section 11 of the privacy policy, headed Storage of Information in the United States, states without qualification that information used in the services is generally stored in the United States. Accessing the platform from abroad therefore means the data travels to servers located in the United States, where it is processed and kept. The same section warns explicitly that this information may be subject to lower protection standards than those of the user's own country, naming the European Union. Transfers from the EU and the UK are framed by adequacy decisions, EU Standard Contractual Clauses, the EU-U.S. Data Privacy Framework, the UK-U.S. Data Bridge and consent. No alternative hosting region (EU, UK or APAC) is offered or even mentioned. Subprocessors and their locations are published on an external trust page referenced in section 8.2 of the DPA. No hosting certification (SOC 2, ISO 27001) is claimed on the public site; the DPA merely contemplates such reports in an audit context. The front end is served behind Cloudflare.