Last updated: October 20, 2026
This Privacy Policy explains how InstaCrax collects, uses, shares and protects your personal data when you use the website and web app at https://instacrax.com (the "Platform"). We have tried to write it in plain English. If something is unclear, email us at instacrax.app@gmail.com.
1. Who we are (the data controller)
The Platform is operated by InstaCrax ("InstaCrax", "we", "us", "our"), based in Italy.
- Address: Salerno, Italy
- Email: instacrax.app@gmail.com
For the personal data described in this policy, we are the "data controller" under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended).
We have not appointed a Data Protection Officer because the law does not require one for our activity. You can contact us about any privacy question at the email above.
2. Who this policy applies to
This policy applies to:
- Members - people who create an account, subscribe and run a sales page at instacrax.com/username.
- Buyers - people who buy a PDF course from a member's sales page.
- Visitors - anyone who browses the Platform.
Important for buyers: when you buy from a member's sales page, the member is the seller and InstaCrax is the technology platform. We process your data to run the checkout and deliver the PDF, and we share some of it with the seller (see Section 5). The seller then uses that data under their own responsibility.
3. What personal data we collect
- Account data (members): email address, username, display name, bio, logo or profile image, the store you chose, the price you set for your PDF, quiz answers used to suggest a store, and login/authentication data.
- Age and guardian data (members): confirmation that you are at least 16, and, if you are under 18, confirmation that a parent or legal guardian has given consent [and the parent or guardian's name and email - confirm whether collected].
- Payment and payout data: payments and payouts are handled by Stripe. Stripe collects your card details, bank details and, for members who receive payouts, identity verification data (for example ID documents and date of birth). InstaCrax does not see or store full card numbers. We receive limited information from Stripe, such as your Stripe customer or account ID, subscription status, payment status, amount, currency, date, the last digits and brand of the card, and whether your payout account is verified.
- Buyer and order data: buyer email address, order number, product purchased, price, date and time, payment status, download link status and the seller (member) involved.
- Community messages: messages and other content you post in the community chat, with the time they were posted.
- Video progress: which videos you have watched and how far you got, so the dashboard can show your progress.
- Consent records: records of the checkboxes you tick (for example the consent to immediate access and the waiver of the 14-day withdrawal right), the version of the text you accepted and the date and time.
- Usage analytics: information about how the Platform is used, such as pages visited, referring website, device and browser type and approximate location (country or city). See Section 6.
- Technical logs: IP address, date and time of requests, browser and device information and error logs, created automatically by our hosting and database providers for security and troubleshooting.
- Messages you send us: if you email us, we keep your email address and the content of the conversation.
We do not ask for special categories of data (such as health, religion or political opinions). Please do not post this kind of data in the community chat.
4. Why we use your data and our legal basis
Under the GDPR, every use of personal data needs a legal basis. Here is what we do and why.
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and manage your account, let you log in, show your sales page | Account data, technical logs | Performance of a contract (Art. 6(1)(b)) |
| Provide the subscription: dashboard, video library, community chat, progress tracking | Account data, video progress, community messages | Performance of a contract (Art. 6(1)(b)) |
| Process subscription payments and automatic renewals | Payment data (via Stripe), account data | Performance of a contract (Art. 6(1)(b)) |
| Connect your Stripe account and send buyer payments to you | Account data, payout data (via Stripe) | Performance of a contract (Art. 6(1)(b)) |
| Process a buyer's purchase, deliver the PDF by download and email, notify the seller | Buyer and order data | Performance of a contract (Art. 6(1)(b)) |
| Send transactional emails (account, receipts, renewal reminders, order confirmations, download links) | Email, order and account data | Performance of a contract (Art. 6(1)(b)) and legal obligation where a confirmation is required by law (Art. 6(1)(c)) |
| Keep accounting, tax and order records | Order, payment and invoice data | Legal obligation (Art. 6(1)(c)) |
| Record your consent to immediate access and waiver of the withdrawal right | Consent records | Legal obligation (Art. 6(1)(c)) and legitimate interest in proving it (Art. 6(1)(f)) |
| Check age and parental or guardian consent | Age and guardian data | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Moderate the community, enforce our Terms, prevent fraud, chargeback abuse and unauthorised sharing of content | Account data, community messages, order data, technical logs | Legitimate interest in keeping the Platform safe and protecting our content (Art. 6(1)(f)) |
| Handle disputes, chargebacks and legal claims | Order, payment and account data | Legitimate interest in defending our rights (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) |
| Keep the Platform secure and fix errors | Technical logs | Legitimate interest (Art. 6(1)(f)) |
| Measure traffic with Vercel Analytics (cookieless, aggregated) | Usage analytics | Legitimate interest in understanding and improving the Platform (Art. 6(1)(f)) |
| Reply to your messages and requests | Email and message content | Performance of a contract or pre-contractual steps (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have balanced our interest against your rights. You can object at any time (see Section 10).
We do not send marketing emails unless you have agreed to receive them. [If newsletters or marketing emails are added later, update this section.]
We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
5. Buyers' data and sellers
When a buyer purchases a PDF from a member's sales page:
- InstaCrax processes the buyer's email and order data to run the checkout (through Stripe), deliver the PDF and send the download link by email.
- InstaCrax shares the buyer's email and order details with the member who made the sale, so the member can see their sales, give customer support and meet their own legal and tax obligations.
- The member uses that data as an independent controller and is responsible for using it lawfully. Members may not use buyer data for spam or for any purpose that is not allowed by law.
- Stripe processes the buyer's payment data under its own privacy policy.
6. Cookies and analytics
- Only strictly necessary cookies and local storage: we only use cookies or local storage that are strictly necessary for the Platform to work, for example to keep you logged in (Supabase login session), keep your session secure and protect the checkout (Stripe checkout security). They do not need consent because the Platform cannot work without them.
- Vercel Analytics (cookieless): we use Vercel Analytics to count visits and see which pages are popular. It does not use cookies, does not store personal data in your browser and does not track you across websites. Visitors are counted using an anonymous hash created from the incoming request, which resets every day. It works on aggregated data.
- No analytics, advertising or profiling cookies: we do not use analytics, advertising or profiling cookies. Because we only use strictly necessary cookies and cookieless analytics, no cookie consent banner is required.
- Embedded videos: videos in the members' video library are hosted on Google Drive and embedded in the members' dashboard. When you play them, your browser connects to Google, which receives technical data such as your IP address and may set its own cookies under Google's policies. [Check with a technical adviser whether Google Drive embeds set non-essential cookies and whether they should be placed behind consent.]
- Managing cookies: you can delete or block cookies in your browser settings. If you block strictly necessary cookies, some parts of the Platform (such as login and checkout) may not work.
7. Who we share data with (service providers)
We use trusted service providers ("processors") who process data on our behalf, under contracts that require them to protect it:
| Provider | What it does for us | Data location / notes |
|---|---|---|
| Supabase | Database, user authentication, file storage (for example logos and profile images) | Our project is hosted in the EU (Frankfurt, Germany). Supabase is a US company, so some access for support or operations may come from outside the EU. |
| Stripe | Payments, subscriptions, Stripe Connect payouts to members, identity checks | EU and US. For some activities (for example identity verification, fraud prevention and its legal obligations) Stripe acts as an independent controller under its own privacy policy. |
| Resend | Sending transactional emails (confirmations, receipts, download links) | US |
| Vercel | Website hosting, technical logs and Vercel Analytics (cookieless) | Global infrastructure, US company |
| Google (Google Drive) | Hosting and streaming of the member video library | Global, US company |
We may also share data:
- with members, as described in Section 5;
- with professional advisers such as an accountant or lawyer, who are bound by confidentiality;
- with public authorities, courts or law enforcement when the law requires it;
- with a buyer of the business, if InstaCrax is sold or transferred, under the same protections described here.
8. International data transfers
Some of our providers are based in, or access data from, countries outside the European Economic Area (EEA), especially the United States. When this happens, we make sure the transfer is protected by one of the safeguards allowed by the GDPR, such as:
- the EU-US Data Privacy Framework, for US companies that are certified under it; or
- the Standard Contractual Clauses approved by the European Commission, together with additional measures where needed.
You can ask us for more information about these safeguards by emailing instacrax.app@gmail.com.
9. How long we keep your data
We keep personal data only for as long as we need it:
| Data | Retention period |
|---|---|
| Account data (profile, store, price, quiz answers) | While your account is active, then deleted within 30 days after you delete your account or we close it (backups are overwritten within a further [30] days) |
| Community messages | While your account is active, unless removed earlier by you or by moderation; then deleted or anonymised with your account |
| Video progress | While your account is active |
| Order, payment, invoice and tax records (members and buyers) | 10 years, as required by Italian law (Article 2220 of the Italian Civil Code and tax rules) |
| Consent records (withdrawal waiver) | For as long as the related order or subscription records are kept (10 years), to prove consent if needed |
| Technical logs | Normally up to [90] days, unless needed longer to investigate a security incident |
| Emails and support requests | Up to 2 years after the conversation ends, unless needed longer for a dispute |
| Data needed for a dispute, chargeback or legal claim | Until the matter is fully closed and any limitation period has expired |
10. Your rights
Under the GDPR you have the right to:
- Access - get a copy of your personal data and information about how we use it.
- Rectification - correct data that is wrong or incomplete. You can edit most profile data yourself in the dashboard.
- Erasure ("right to be forgotten") - ask us to delete your data, unless we must keep it (for example tax records).
- Restriction - ask us to limit how we use your data in certain situations.
- Data portability - receive data you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another provider.
- Object - object at any time to processing based on our legitimate interest. We will stop unless we have compelling legitimate grounds or need the data for legal claims.
- Withdraw consent - where we rely on consent, you can withdraw it at any time. This does not affect processing done before.
- Not be subject to automated decisions with legal or similarly significant effects. We do not make such decisions.
To use any of these rights, email instacrax.app@gmail.com from the email address linked to your account. We may ask you to confirm your identity. We will reply within one month. This can be extended by two more months for complex requests, and we will tell you if that happens. Using your rights is free, unless a request is clearly unfounded or excessive.
11. Right to complain
If you think we have used your data unlawfully, you have the right to lodge a complaint with a data protection supervisory authority. In Italy, this is the Garante per la protezione dei dati personali (https://www.garanteprivacy.it). If you live in another EU country, you can also complain to the authority in your country. We would appreciate the chance to resolve your concern first, so please contact us.
12. Minors
- You must be at least 16 to create an account. If you are 16 or 17, you need the consent of a parent or legal guardian.
- We do not knowingly collect data from children under 16. If we learn that someone under 16 has created an account, we will close it and delete their data, except data we must keep by law.
- If you are a parent or guardian and believe your child under 16 has given us personal data, contact us at instacrax.app@gmail.com.
13. How we protect your data
We use technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls, secure authentication through Supabase and payment processing through Stripe so that we never handle card numbers. No system is 100% secure. If a data breach is likely to put your rights at risk, we will notify the Garante and, where required, you, as the GDPR requires.
14. Changes to this policy
We may update this policy, for example if we add new features or providers. We will change the "Last updated" date at the top. If the changes are important, we will tell you by email or with a notice on the Platform before they take effect.
15. Contact
InstaCrax
Address: Salerno, Italy
Email: instacrax.app@gmail.com