1. Data we collect
We keep the dataset as small as the product allows. Everything below is collected either because you entered it yourself or because it is technically required to deliver the service.
- Account data: first name, last name, email address and a hashed password.
- Order data: the number of credits ordered, currency, promo code used, chosen payment method and invoice status.
- Content data: the prompts you write, the games generated from them and the versions you keep.
- Technical data: IP address, browser type, device type and error diagnostics.
2. Why we process it
We process your data to create and secure your account, to fulfil credit orders and issue invoices, to generate and store your games, to prevent fraud and abuse of the generation service, and to comply with accounting and tax obligations.
We never sell personal data and we do not use your private prompts to advertise to you.
3. Legal bases
Depending on the situation, we rely on the performance of a contract (delivering credits and generated games), our legitimate interest (security, abuse prevention, product reliability), a legal obligation (bookkeeping) or your consent (non-essential cookies).
4. Payment data
Bank transfer is currently the only enabled payment method. We receive the payment reference, the amount and the payer name from our bank. We never see or store full card numbers; when card, PayPal and Stripe checkout become available, the card data is handled entirely by the payment provider.
5. AI generation
Prompts are sent to model providers to generate the artwork, mechanics and audio of your game. Providers act as processors and are contractually forbidden from using your prompts for their own purposes.
Games you publish to Discover, including their title, cover and description, become publicly visible. Drafts stay private.
6. Retention
Account and content data is kept while your account exists and for 30 days after deletion so it can be restored on request. Invoices and order records are kept for the statutory accounting period. Technical logs are kept for up to 12 months.
7. Your rights
You can request access, correction, deletion, restriction, portability or object to processing at any time by writing to [email protected]. We answer within 30 days and you may complain to your local data protection authority.
8. Security
Data is encrypted in transit, passwords are stored using modern one-way hashing, and access to production systems is limited to the people who need it. If a breach ever affects you, we notify you and the regulator without undue delay.
9. Contact
INSTAWEB LTD is the data controller. Questions about this policy can be sent to [email protected] or by post to our registered office. We update this page whenever our processing changes and always revise the date at the top.