Privacy Policy
Last updated
The privacy of your data, and it is your data, not ours, is a big deal to us. This policy explains what personal data Instatus collects, why, who we share it with, and the choices and rights you have. We'll never sell your personal data.
Who we are
Instatus, Inc. ("Instatus", "we") is a Delaware corporation. Our mailing address is 9450 SW Gemini Dr PMB 30900, Beaverton, Oregon 97008-7105, USA. You can reach us about privacy at privacy@instatus.com.
This policy covers instatus.com, the Instatus dashboard, our mobile apps, our APIs and integrations, and instatus.com/now. The Instatus Out macOS app has its own privacy policy.
Two roles: our data and our customers' data
We are the controller of the personal data we collect to run our own business: your account, billing, support conversations, our websites and our marketing. This policy describes how we handle that data.
We are a processor for the data our customers put into Instatus. That includes their status page content, the people who subscribe to their status pages, their on-call contacts and their monitoring data. Our customer decides how that data is used, and our Data Processing Addendum governs how we handle it. If you subscribed to a company's status page, or you're on a customer's team, that company's privacy policy applies, and you should contact them first to exercise your rights. We'll help them respond.
What we collect
Account information. When you sign up, we collect your name, email address, password (stored only as a salted bcrypt hash), and your team or company name. If you sign in with Google, GitHub or single sign-on, we receive your name, email address and an identifier from that provider. You may also add a phone number, profile picture, time zone and language.
Billing information. Payments for self-serve plans are handled by Paddle, our reseller and Merchant of Record. Your card details go directly to Paddle and never touch our servers. We receive your billing contact, country, tax details, plan and payment history.
Usage and device information. When you use Instatus, we log things like IP addresses, browser and device type, pages and features used, actions taken in your team (such as who published an incident), and errors. Our mobile apps also send a push notification token if you allow notifications.
Support and communications. When you write to us, we keep the conversation and the contact details you used. If you subscribe to our newsletter or product updates, we keep your email address and whether you opened them.
Website visitors. Our websites use cookies and similar technologies, described below.
Information from others. If someone invites you to their team, we receive your email address from them. If you join through a referral or affiliate link, we learn which partner referred you.
How we use it, and our legal bases
| Purpose | Legal basis under the GDPR |
|---|---|
| Providing the Service: creating and securing your account, sending notifications and alerts, and processing payments | Performance of our contract with you |
| Sending service messages, such as security alerts, billing notices and changes to our policies | Performance of contract and legitimate interests |
| Support, troubleshooting and improving Instatus | Legitimate interests in helping you and making a better product |
| Keeping Instatus safe: preventing fraud, spam and abuse, and enforcing our Terms and Acceptable Use Policy | Legitimate interests, and legal obligations |
| Marketing emails and product updates | Consent where required, otherwise legitimate interests. You can unsubscribe at any time. |
| Website analytics and advertising measurement | Consent where required, otherwise legitimate interests |
| Accounting, tax and legal compliance | Legal obligations |
We don't make decisions about you that have legal or similarly significant effects based solely on automated processing.
AI features
Instatus uses AI providers to translate, summarize and draft content and to detect abuse. Some of this happens automatically as part of the Service, for example refreshing an incident's summary when the incident changes, which sends its updates, timeline and responder names to the provider. Other features run only when you use them. See our subprocessors page for what each provider does. We don't use your data to train AI models, and our AI providers are contractually prohibited from doing so.
Who we share it with
We'll never sell your personal data, and we won't use your name or your company's name in marketing without your permission. We only share personal data:
- With service providers that help us run Instatus, such as hosting, email delivery, payments and support tools. They may only use it to provide their services to us. See our subprocessors.
- With integrations you turn on, such as Slack or PagerDuty, when you ask us to.
- With your team. Team members and owners can see your name, email address, role and activity in that team.
- Publicly, when you publish. Content you post on a public status page is public.
- For legal reasons, when required by a valid legal process (see law enforcement), or to protect the rights, property or safety of Instatus, our customers or others.
- In a business transfer. If Instatus is involved in a merger or acquisition, we'll notify affected users before their personal data becomes subject to a different privacy policy.
Cookies
We use a small number of cookies and similar technologies:
- Necessary cookies keep you signed in, remember your language, settings and cookie choices, and protect forms from bots (hCaptcha). Our Help Scout support chat remembers your conversations with us. These are needed for the Service to work, so they are always on.
- Analytics cookies (Google Analytics, loaded through Google Tag Manager) help us understand how our websites are used.
- Marketing cookies (Meta Pixel and our Rewardful affiliate program) help us measure our advertising and credit referral partners.
Your choices. On instatus.com, including Help and Now, and in the dashboard:
- If you visit from the European Economic Area, the UK or Switzerland, analytics and marketing cookies stay off until you choose. On your first visit we ask once, with Reject and Accept side by side, and you can also choose each category on its own.
- Elsewhere they are on by default, and you can turn them off at any time.
- Your privacy choices, in the help widget and in our website footer, reopens your cookie choices so you can change or withdraw your consent whenever you like. Withdrawing consent doesn't affect anything that happened before.
- If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing and keep marketing cookies off in that browser.
We save your choice in a cookie for six months, and it applies to instatus.com and the dashboard.
Instatus status pages don't use marketing cookies of ours. A customer may add their own analytics to their status page, under their own privacy policy.
You can also block or delete cookies in your browser settings, and opt out of Google Analytics with Google's opt-out add-on. Blocking necessary cookies may stop parts of Instatus from working.
How long we keep it
- Account data for as long as your account is open. When you delete your account, we delete it from our active systems within 30 days and from backups within 60 days.
- Content you delete while your account is active is removed within 30 days.
- Billing records for as long as tax and accounting laws require, typically up to 7 years.
- Support conversations for as long as they help us support you, and we delete them on request.
- Team activity logs for as long as the team exists, so owners can review who changed what.
- Marketing contacts until you unsubscribe.
Security
We protect personal data with encryption in transit, encryption at rest for our primary database and backups, multi-factor authentication, access controls and monitoring. Read more in our security overview. If a breach affects your personal data, we'll notify you and the relevant authorities as the law requires.
International transfers
We're based in the United States and store data primarily in the United States. Our team works remotely from several countries, and our service providers may process data in the countries listed on our subprocessors page. When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and the UK and Swiss equivalents, together with additional safeguards where needed.
Your rights
Wherever you live, you can ask us to access, correct, export or delete your personal data, and you can stop marketing emails at any time. Many of these things you can do yourself in your account settings. Depending on where you live, you may also have these rights:
EEA, UK and Switzerland. You can access, correct, erase, restrict or port your personal data, object to processing based on legitimate interests, and withdraw consent at any time without affecting earlier processing. You can also complain to your local data protection authority, although we'd appreciate the chance to help first.
California and other US states. Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws can request to know what personal data we collect and how we use and disclose it, and to access, correct, delete and receive a copy of it. In the last 12 months we collected the categories described in What we collect: identifiers, commercial information, internet activity, approximate location from IP addresses, and professional information, for the purposes and recipients described above. We don't sell personal data for money. Our use of advertising cookies such as the Meta Pixel may count as "sharing" or "targeted advertising" under these laws; you can opt out with Your privacy choices on our websites, by sending a Global Privacy Control signal from your browser, or by emailing us. We don't collect sensitive personal information for the purpose of inferring characteristics about you. We won't discriminate against you for exercising your rights, and you may use an authorized agent.
Brazil, Canada, Australia and elsewhere. You have the rights given by your local law, such as Brazil's LGPD, Canada's PIPEDA and Australia's Privacy Act, and we'll honor them.
To make a request, email privacy@instatus.com. We may need to verify your identity, usually by confirming the email address on your account. We'll respond within 30 days, or sooner if the law requires. If we can't do what you ask, we'll explain why. If you disagree with our response, you can appeal by replying to it, and we'll review it again.
If your request is about data a customer controls, such as a status page subscription, we'll forward it to that customer and help them respond. You can always unsubscribe from a status page using the link in any notification.
Law enforcement
Instatus won't hand over customer data to law enforcement unless a court order or other legally binding process requires it. We reject requests that don't have one. Unless we're legally prohibited, we'll notify affected customers before we respond.
Children
Instatus is a service for businesses and isn't directed at children. We don't knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we'll delete it.
Google API Services
Instatus's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Changes
We'll update this policy as Instatus changes. Every version has a "last updated" date, and we record changes on our policy updates page. If we make a material change, we'll email account owners before it takes effect.
Contact
Questions or requests about privacy can go to privacy@instatus.com, or by post to Instatus, Inc., 9450 SW Gemini Dr PMB 30900, Beaverton, Oregon 97008-7105, USA.