Privacy Policy

1. Who is responsible for the processing?

Instant Process, with its registered office at Doelenstraat 118, 2611 NW, Delft, registered in the Commercial Register under Chamber of Commerce number 42140557, is the data controller for the personal data it processes for its own business operations and the provision of its services. Instant Process operates a platform for modelling, visualising, analysing and managing business processes (hereinafter: ‘the platform’).

If you have any questions regarding privacy or the processing of personal data, please contact us at info@instantprocess.nl.

Instant Process processes personal data with due care and in accordance with the General Data Protection Regulation (GDPR).

2. What personal data does Instant Process process, and where does it come from?

The personal data that Instant Process processes depends on how a person comes into contact with Instant Process and on the features used. This may include, amongst other things, name, email address, account, login and identification details, organisation and team details, details of the chosen subscription, contact and communication details, quotation, contract and customer details, invoice, payment and administrative details, and technical details such as IP addresses, browser, device, session and log data.

Instant Process may also process data relating to the use of its website and platform. Within the platform, process models, comments, project data and other user content may be processed. Where such data contains personal data, that personal data will also be processed. When using AI functionalities, prompts, texts, process information and other data provided by the user may be processed, amongst other things.

Personal data may be obtained directly from the data subject, for example when creating an account, taking out a subscription, making a payment, subscribing to the newsletter or getting in touch.

Instant Process may also receive personal data indirectly. This may occur, for example, when a business customer, employer or other organisation designates an individual as a user of the platform or provides that person’s details in connection with the performance of an agreement. In addition, Instant Process may receive personal data when a user on the platform includes data relating to other individuals in user content.

3. For what purposes and on what legal basis does Instant Process process personal data?

Instant Process processes personal data for the purposes of creating and managing accounts, granting access to the platform, entering into and performing agreements, invoicing and payments, financial administration, customer and relationship management, communication, support, security, access control, fraud prevention, error detection and technical management, and monitoring, troubleshooting and improving the AI functionalities. In addition, Instant Process processes personal data to the extent necessary to comply with legal and administrative obligations.

Instant Process sends a newsletter to people who subscribe to it via the website or when creating an account. For the newsletter, Instant Process processes the email address and, for a subscription made when creating an account, the first name and last name. This processing is based on the consent of the data subject. Every newsletter contains a link to unsubscribe.

Instant Process records, per signed-in user, how the platform is used: which parts of the platform the user opens and for how long, when the user signs in and how long sessions last, how many processes the user creates, edits, deletes and exports and whether a process is edited by typing, through the AI assistant or through a tool and how many comments and preview links the user creates. Instant Process uses these records to understand and improve the use of the platform. This processing is based on the legitimate interest of Instant Process in improving its services (Article 6(1)(f) GDPR). The records contain no keystrokes, no page content and no process content. A process is recorded only as a code computed with a secret key, from which the process cannot be identified. They are stored on Instant Process's own servers in the European Union and are shared with no third party. Records that identify a user are deleted after ninety days. Aggregated figures that no longer relate to an individual user are kept. In the first thirty days after an account is created, these records also include onboarding events: which steps of the tutorial the user reaches or stops at, the first project created and its template, the first compile error and the time until the first error-free compile, the first message to the AI assistant and whether a suggested prompt sent it, and which link opened the documentation from the editor. The Record my activity switch in the account settings stops this recording, including the onboarding events, and deletes the identified records already held for that user, including trial records linked to the account as described in section 11.

Depending on the purpose, the processing is based on the performance of an agreement or on taking steps prior to entering into an agreement, a legal obligation, a legitimate interest of Instant Process, or the consent of the data subject.

Where Instant Process invokes a legitimate interest, this relates, for example, to its interest in providing secure and properly functioning digital services, sound business operations, the prevention of misuse and fraud, or the maintenance of business relationships.

Where consent forms the legal basis, such consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of any processing carried out prior to the withdrawal.

The provision of personal data may be necessary for the creation or use of an account, the conclusion or performance of an agreement, the making of a payment, or compliance with a legal obligation. If the personal data required for these purposes is not provided, Instant Process may not be able to conclude or perform the relevant agreement.

4. Personal data in user content and AI functionalities

The platform is primarily intended for modelling, visualising, analysing and managing business processes, and is not specifically designed for the processing of personal data. However, users may themselves include personal data in, for example, process models, process descriptions, comments, imported files, chat messages or other user content.

Instant Process uses an external AI provider for its AI functionalities. Data that a user deliberately submits to this functionality, such as prompts, process information, text or data from imported files, may be processed via that AI provider’s infrastructure.

Instant Process records each interaction with its AI functionalities, including the prompts, the process information and the AI output, to monitor, troubleshoot and improve those functionalities. A recording is not linked to an account, a user or a chat session. Email addresses and access tokens are masked before a recording is stored. Recordings are stored with Scaleway in the Amsterdam region (nl-ams) and deleted after 30 days.

Where a business customer determines which personal data is processed within the platform and for what purpose, and Instant Process processes this personal data exclusively on behalf of that customer, Instant Process acts as the data processor in respect of that personal data and the customer as the data controller. The relevant arrangements are set out in the data processing agreement within Instant Process’s general terms and conditions.

This privacy policy essentially describes the processing operations for which Instant Process itself is the data controller.

5. With whom is personal data shared?

Instant Process may engage external parties in the course of its business operations and service provision. Personal data may, where necessary, be shared with hosting, cloud and infrastructure providers, AI providers, payment service providers, CRM suppliers, suppliers of accounting and administration software, backup and IT service providers, external technical suppliers, bookkeepers, accountants, administrative service providers, legal advisers and other professional service providers.

Among other things, Instant Process uses a CRM system for customer and commercial processes. The platform is primarily hosted via an external hosting environment in the Netherlands.

That hosting environment is Scaleway, in the Amsterdam region (nl-ams). Instant Process uses Scaleway Generative APIs, in the same Scaleway environment in the European Union, for its AI functionalities. Instant Process uses HubSpot, in its data centre in the European Union, to manage newsletter subscriptions and send the newsletter. Instant Process uses Google Ads, a service of Google Ireland Limited, to measure whether its advertisements lead to the creation of an account. Google acts as a processor for this measurement. It takes place only after the visitor has given consent, and Instant Process sends Google no name, no email address and no account details for it.

Where a third party processes personal data on behalf of Instant Process, arrangements will be made where necessary regarding, amongst other things, confidentiality, security and processing solely on behalf of Instant Process.

6. Transfer outside the European Economic Area

Depending on the suppliers, technical infrastructure and sub-processors used, personal data may be processed outside the Netherlands and possibly outside the European Economic Area. This may be particularly relevant in the case of certain AI, cloud or other technical service providers.

Where personal data is transferred outside the European Economic Area, Instant Process ensures that there is a valid legal basis for such a transfer, for example an adequacy decision by the European Commission, approved standard contractual clauses or another legally permissible safeguard.

Insofar as Instant Process is the data controller for the processing in question, a data subject may request further information via info@instantprocess.nl regarding the applicable legal basis for the transfer and, where available and required by law, regarding the appropriate safeguards used in that context.

7. How long is personal data retained?

Instant Process does not retain personal data for longer than is necessary for the purpose for which it was collected, unless a legal obligation or a legitimate interest justifies longer retention.

Account data is, in principle, retained for as long as the account remains active and, thereafter, for as long as it is necessary for administrative, security, evidential or dispute resolution purposes. Invoice and administrative data is retained for the duration of the applicable statutory retention periods. Customer communications and CRM data are retained for as long as is reasonably necessary for customer and relationship management, the provision of evidence, and the resolution of enquiries or disputes. Newsletter subscription data is retained until the data subject unsubscribes. Activity records that identify a signed-in user, and trial journeys recorded with consent, are deleted after ninety days. Technical and security data are retained for as long as is necessary for security, monitoring, fault-finding and incident management. Recordings of interactions with AI functionalities are deleted after 30 days.

User content may be deleted by the user and will be deleted following the termination of the account or the agreement in accordance with the applicable contractual and technical retention periods. Data may remain temporarily in backups after deletion until it is overwritten or deleted in accordance with the regular backup cycle.

8. Security

Instant Process takes appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, destruction or any other unlawful processing.

The nature of the security measures is determined, amongst other things, by the nature and scope of the processing, the technology used and the potential risks to data subjects.

9. Automated decision-making

Instant Process’s AI functionalities can automatically analyse data and, based on this, generate suggestions, analyses or other output.

Instant Process does not, for its own purposes, make any decisions based solely on automated processing which produce legal effects concerning data subjects or which otherwise significantly affect them.

Where a business customer has personal data analysed within the platform and makes decisions on that basis, that customer is responsible for assessing whether automated decision-making or profiling within the meaning of the GDPR is taking place, and which obligations apply in that regard.

10. Rights of data subjects

Insofar as Instant Process acts as the data controller, a data subject may, depending on the circumstances, request access to their personal data, the rectification of inaccurate personal data, the erasure of personal data, the restriction of processing or the transfer of personal data. In eligible cases, a data subject may also object to processing or withdraw consent previously given.

A request may be submitted via info@instantprocess.nl. Instant Process may request additional information where necessary to verify the identity of the applicant and will, in principle, respond within one month of receiving the request. In cases where the GDPR permits, this period may be extended by up to two months, in which case the data subject will be notified of this within one month of receipt of the request.

Where a request relates to personal data that Instant Process processes solely as a data processor on behalf of a business customer, that customer is, in principle, responsible for dealing with the substance of the request.

11. Cookies

The Instant Process website and platform may use cookies and similar technologies that are necessary for the functioning, security and management of the online environment. Where non-essential cookies or similar technologies are used that require consent, consent will be sought in advance.

The Instant Process cookie notice explains which cookies are set, what they are used for, how long they are stored, and how a visitor can change their preferences.

With the visitor's consent, Google Ads sets conversion cookies on the website and the platform, including _gcl_aw and _gcl_au. These cookies record that a visitor arrived through an advertisement and are used to measure whether that visit leads to the creation of an account. They are not used for personalised advertising. Instant Process stores the consent choice itself in the cookie ip-consent for 180 days. Without consent, no Google Ads cookie is set and no Google Ads script is loaded. Consent can be withdrawn at any time through the Cookie preferences link at the bottom of the website.

The trial editor records onboarding events of its visitors: which steps of the tutorial a visitor reaches or stops at, when editing starts, the first compile error and the time until the first error-free compile, the first message to the AI assistant and whether a suggested prompt sent it, which link opened the documentation from the editor, a completed export and a click towards signing up. Instant Process uses these events to improve the onboarding of new users, is the only party that keeps them, and shares them with no third party. The trial editor shows its own cookie banner, which writes the same ip-consent cookie as the website.

Without consent in ip-consent, a trial event is recorded anonymously. It holds the event, the date without a time of day, and for the time until an error-free compile only a coarse range such as two to five minutes. It holds no name, no email address, no account, session or device identifier and no IP address, and cannot be related to a person.

With consent in ip-consent, the trial editor records the visitor's journey: each event holds an identifier of the browser tab's trial session, its exact time and the exact time until an error-free compile, so one visitor's path through the trial can be followed. When that visitor signs up for an account from the same browser tab, the recorded journey is linked to the new account and from then on forms part of the per-user activity records of section 3: it is deleted after ninety days, and the Record my activity switch stops and deletes it. A journey that is never linked is deleted after ninety days.

With the same consent in ip-consent, the trial editor stores a random visitor id in the browser. The platform keeps a one-way hash of that id for 90 days after the last visit, to tell new visitors from returning ones. The hash is linked to no account, name, email address or IP address. Without consent, no visitor id is stored.

12. Complaints and changes

Any data subject who believes that Instant Process is not processing personal data in accordance with the GDPR may contact us at info@instantprocess.nl. In addition, the data subject has the right to lodge a complaint with the Dutch Data Protection Authority.

Instant Process may amend this privacy policy should there be changes to its business operations, the platform, the suppliers it uses, AI functionalities, data processing or applicable laws and regulations. The most up-to-date version will be made available via the website or the platform.