Privacy Policy
Last updated: August 29, 2026 · Committed to zero public training on user data
📋 1. Information We Collect & Store
- Authentication & Account Data: Authentication is powered by Clerk. We store your Clerk User ID and primary email address to manage your account status, persona library, digital credit ledger, and prepaid plan tier.
- Uploaded Reference Assets: Images you provide for digital wardrobe try-on (Dressé), styling anchors, or facial consistency anchors are uploaded to managed cloud object storage (Cloudflare R2) and indexed in our cloud database (Turso / libSQL) to enable your studio workspace.
- Studio Prompts & Generations: Text prompts, styling parameters, camera settings, aspect ratios, seeds, and generated output media are stored in your account history to provide studio access and gallery viewing.
- Technical & Log Data: We log standard technical request metadata (such as IP addresses, user-agent strings, and request timestamps) on our servers solely for security diagnostics, anti-abuse firewalling, and API rate-limiting enforcement.
- Cookies & LocalStorage Technologies:
- Essential Session Cookies: Set strictly by Clerk (`__session`, `__client_uat`) to securely maintain your authenticated state across browser sessions.
- Browser LocalStorage: We store non-sensitive client preferences directly in your browser's `localStorage` (such as `ui:theme:v1` for light/dark mode, `ui:accent:v1` for interface color accents, and `instadna_consent_terms_version` for legal consent state). We do not use `localStorage` for cross-site tracking.
- Zero Advertising Pixels: InstaDNA does not load Google Analytics, Meta Pixel, Hotjar, or third-party marketing tracking scripts.
- Storage Architecture & Tier Retention: Uploaded assets and generated media are stored in managed cloud object storage (Cloudflare R2) and cloud databases to provide your studio history. Assets are access-controlled within the InstaDNA application, with asset URLs that may function as unlisted bearer links where applicable (accessible without an active login session if the exact unguessable UUID string is known). InstaDNA maintains storage subject to user tier retention windows (7 days for Free tier, 14 days for Nano/Starter tiers, 30 days for Creator tiers, permanent for Studio tiers), after which underlying storage files are pruned while preserving your prompt and styling generation history. Users are strongly encouraged to download and maintain local copies of their generated media.
- No Model or LoRA Binary Hosting: InstaDNA does not host, store, or distribute machine learning foundation model checkpoints, weights, or LoRA binaries on its servers.
- Zero Public Foundation Model Training: InstaDNA does not use your uploaded reference photographs or private persona configurations to train its own public models. External third-party compute providers process data in accordance with their respective applicable terms, enterprise agreements, and privacy policies.
⚙️ 2. How Your Data Is Processed & External AI Infrastructure
Service Operations: Your account information is used to authenticate sessions, maintain Persona DNA configurations, manage credit transactions, and protect infrastructure against automated abuse.
External AI Compute & Inference Transmission: To generate requested synthetic media or perform prompt analysis, your prompts, reference images, and styling parameters are securely transmitted over TLS to authorized third-party cloud compute providers (specifically Google Cloud Vertex AI / Gemini infrastructure and BytePlus Ark / SeedDream inference clusters). These upstream compute providers process your inputs strictly to execute the requested inference computation and return the synthesized image to your studio, in accordance with their respective applicable terms, enterprise agreements, and privacy policies.
💳 3. Payment Information & Exclusive Payment Processor (Razorpay)
Payments and prepaid plans are processed exclusively through Razorpay Software Private Limited ("Razorpay") for transactions in Indian Rupees (INR) via UPI, NetBanking, Debit/Credit Cards, and Wallets.
When you purchase a prepaid plan or credit pack, your payment details (such as card numbers, CVVs, and banking credentials) are collected directly by Razorpay through their secure checkout interface. InstaDNA never receives or stores your credit/debit card numbers, CVVs, or NetBanking passwords on its servers. Razorpay transmits transaction verification identifiers (`order_id`, `payment_id`, `signature`) to our backend solely to confirm successful payment and credit your account balance.
🗑️ 4. Data Protection Framework, User Rights & Erasure (DPDP Act & Rules)
Indian Data Protection Framework (DPDP Act 2023 & Rules 2025): In alignment with the principles of the Digital Personal Data Protection Act, 2023 and the phased notification of the DPDP Rules, 2025, InstaDNA processes personal data (such as account identifiers, technical logs, prompts, and uploaded reference images) on the lawful basis of your informed consent and specified purpose—strictly to deliver our AI creation service, maintain studio continuity, and execute requested image synthesis.
Third-Party Infrastructure Processors: To provide the service, personal data is processed by specialized external infrastructure processors under respective service contracts: (a) Clerk (Session authentication & identity security); (b) Cloudflare, Inc. / R2 (Media object storage via unlisted bearer links); (c) Google Cloud Platform / Vertex AI & BytePlus Ark (External AI compute & inference execution); and (d) Razorpay Software Private Limited (Domestic Indian payment processing). Each third-party processor processes data strictly to perform its contracted technical function in accordance with applicable terms and security practices.
User Rights & In-App Asset Removal: You retain continuous control over your creative outputs and can delete individual generated photos and persona records directly from your studio interface at any time.
Full Account Deletion & Erasure: To request complete account erasure, email our privacy desk at privacy@theinstadna.com or support@theinstadna.com. Upon verification of your account ownership, we will permanently delete your Persona DNA configurations, reference uploads, and generation database records.
Protection of Children's Data: InstaDNA is strictly restricted to users aged 18 and above. We do not knowingly collect, track, or process personal data of individuals under 18 years of age. If we become aware that personal data of a minor has been uploaded, it will be deleted immediately upon discovery or notification.
Legal Retention Exceptions: Certain limited records (such as financial credit transaction reference IDs and IT Rules compliance audit logs) may be retained for legally mandated periods where required for tax compliance, fraud prevention, or law enforcement reporting obligations.
Note on Commencement: Operational data protection practices (in-app deletion, access control, and privacy contacts) are currently active. Formal statutory compliance mechanisms under the DPDP Rules, 2025 are being phased in accordance with the statutory commencement timeline notified by the Government of India.
📬 5. Contact Privacy Office & Grievance Redressal (IT Rules 2021)
For privacy inquiries, data deletion requests, or formal statutory complaints under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, contact our Grievance Officer:
- Government or Court Orders (Rule 3(1)(d)): Actioned as soon as possible and in any case within 3 hours upon receipt of actual knowledge via court order or authorized government notification.
- Bodily Privacy & Non-Consensual Imagery (Rule 3(2)(b)): Actioned expeditiously and access disabled within 2 hours of receipt of a prima facie valid complaint.
- Specified Prohibited Content Removal (First Proviso to Rule 3(2)(a)(i)): Removal requests for information prohibited under Rule 3(1)(b) (other than Rule 3(2)(b) and Rule 3(1)(d)) are actioned within 36 hours.
- General Grievances (Rule 3(2)(a)(i)): Acknowledged within 24 hours and resolved within 7 days from receipt.