Privacy Policy

Kajal Gupta, trading as InstanceHub, is the Data Fiduciary responsible for your personal data.

Email: support@instancehub.in
Phone: +91 83684 72620

We only collect what we need to sell and activate instance access:

• Account details - your name, email address and phone number, provided when you register. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Password - stored only as a bcrypt hash. We never store or have access to your actual password.
• Order and payment records - the plan you bought, the term, the amount, any coupon used, and the payment and order identifiers returned by Razorpay.
• Enquiries - the name, email, optional phone number and message you send through our contact form.
• Verification codes - one-time codes sent to your email, stored hashed and deleted after use or expiry.
• Technical data - your IP address is processed transiently to apply rate limits and prevent abuse. It is not stored in our database.

We do not collect or store your card, UPI or bank details. Payments are handled entirely by Razorpay on their own systems.

• To provide what you bought - creating your account, verifying payment, activating access and sending credentials. This is necessary to perform our contract with you.
• To contact you about your order - verification, confirmation, approval and rejection emails. These are service messages, not marketing.
• To answer your enquiries - on the basis of the consent you give by submitting the form.
• To keep the service secure - rate limiting, captcha and fraud checks, on the basis of our legitimate interest in preventing abuse.
• To keep financial records - retained where required by Indian tax and accounting law.
• Analytics - only if you accept cookies. See section 5.

We do not sell your personal data, and we do not use it for advertising.

Only the service providers we need to run the business:

• Razorpay (payments) - receives your name, email and phone number to process the transaction.
• PayPal - used by Razorpay to complete payments made in US dollars. If you pay in dollars, you are taken to PayPal to authorise the payment and they receive the details you give them there. PayPal is based in the United States, so paying this way involves your data being processed outside India. Paying in rupees does not involve PayPal at all.
• Resend (email delivery) - receives your email address and the content of our messages to you.
• Meta (WhatsApp) - only if you turn on WhatsApp updates. Meta then receives your phone number and the content of those messages in order to deliver them. Meta is based in the United States, so this involves your data being processed outside India. You can turn WhatsApp updates off at any time from your dashboard, and we will stop sending them immediately. Leaving them off means Meta receives nothing about you from us.
• Google Analytics - receives usage data only if you accept cookies.
• Cloudflare - provides the captcha on our contact form, our DNS, and privacy-preserving website analytics that does not identify visitors.
• Oracle Cloud Infrastructure - hosts our servers and encrypted database backups, in the Hyderabad region in India.

Some of these providers may process data outside India. We may also disclose data where we are legally required to do so.

We use a small number of strictly necessary cookies to keep you signed in and to protect forms from abuse. These are required for the site to function and cannot be switched off.

We also use Google Analytics to understand how the site is used. Analytics does not load at all until you accept it - if you decline, or have not yet chosen, no Google scripts are loaded and no analytics cookies are set. You can change your choice at any time using the Cookie settings link in the footer.

Separately, we use Cloudflare Web Analytics for basic visitor counts. It sets no cookies, stores nothing on your device and does not build a profile or identify you, so it runs whatever your cookie choice - there is nothing on your device for you to consent to. It records aggregate figures such as page views, the site that referred you, your country and your device type.

We also keep our own anonymous counters - for example, how many people viewed the plans page on a given day, and how many completed a payment. These are plain totals. No identifier of any kind is recorded against them: not your account, not your IP address, not a session. They cannot be traced back to any individual and are used only to see where our own checkout is confusing.

We store your theme preference (light, dark or follow your device), your cookie choice, and the contents of your shopping cart in your browser's local storage. These never leave your device - your cart is only sent to us when you start a payment, and even then we re-read every price from our own records rather than trusting what your browser sent.

We also set one strictly necessary cookie, named ih-cur, which records whether you are viewing prices in rupees or dollars. Unlike the items above, this one is sent to our server with each request, because the currency you are shown has to be the currency you are charged - deciding that in your browser alone would let the price on screen differ from the amount taken. It holds nothing but the text INR or USD, identifies nobody, and is not used for analytics or advertising. It lasts a year, and clearing your cookies simply returns you to rupees.

• Account details - while your account exists, and then as needed for our records.
• Order and payment records - retained as long as Indian tax and accounting law requires, even after an account is closed.
• Enquiries - up to 24 months after they are closed.
• Verification codes - deleted on use, or within 10 minutes of being issued.
• Database backups - kept for 14 days on a rolling basis.

You can ask us to:

• tell you what data we hold about you and how we use it;
• correct anything inaccurate or incomplete;
• delete your data, where we are not required to keep it (payment records generally must be kept);
• withdraw a consent you previously gave, including for analytics;
• nominate someone to exercise these rights if you are unable to.

Email support@instancehub.in from your registered email address and we will respond within 30 days. There is no charge.

Traffic is encrypted with HTTPS. Passwords are hashed with bcrypt and verification codes are hashed. The database is not reachable from the internet. Forms are rate limited and protected by a captcha. Backups are encrypted at rest. Access to production is restricted to the proprietor.

No system is completely secure. If a breach ever affects your data, we will notify you and the Data Protection Board of India as required.

This service is intended for business use and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has registered, contact us and we will delete the account.

If you are unhappy with how we handle your data, contact our Grievance Officer:
Kajal Gupta, Grievance Officer
support@instancehub.in

We aim to acknowledge complaints within 48 hours and resolve them within 30 days. If you remain dissatisfied, you may complain to the Data Protection Board of India.

If we change this policy we will update the date above, and where the change is significant we will ask for your cookie choice again.