Privacy Policy

Instware is a business based in the Republic of Ireland.

Instware is the data controller for personal data collected through this website.

We collect only the personal data that you choose to provide when contacting us through this website or by email. This typically includes:

• Contact form: your name, company (optional), email address, the topics you select and your message.
• Emails to us: your email address and any personal data you include in your message voluntarily.
• Newsletter sign-up: your email address only, if you subscribe to our cybersecurity insights.

If you use our AI Security Advisor, we also process the information you enter into it — such as your organisation name, industry, size, technology environment, compliance obligations, description of your security concerns and any follow-up questions — together with the AI-generated response. See AI Security Advisor below.

Our hosting provider may process limited technical data, such as IP address, browser type and request logs, as necessary to deliver and secure the website. We do not use analytics, advertising or tracking cookies.

We use your personal data for the following purposes:

• To respond to your inquiry.
• To communicate with you about a potential business relationship or requested service.
• To send you a confirmation email when you submit our contact form.
• To send you our cybersecurity insights, if you have subscribed to our newsletter.
• To generate tailored, indicative security recommendations when you use the AI Security Advisor.
• To administer and improve the performance, security, and usability of our website, including preventing abuse of the AI Security Advisor.

We process your personal data on the following legal bases:

• Legitimate interests (Article 6(1)(f) GDPR): to respond to incoming enquiries and manage communications relating to potential services, where this does not override your rights and freedoms.
• Consent (Article 6(1)(a) GDPR): to send you our newsletter when you subscribe. You can withdraw your consent at any time by using the Unsubscribe link under the newsletter sign-up box on this website or by emailing us.
• Steps at your request prior to entering into a contract (Article 6(1)(b) GDPR): to generate AI Security Advisor recommendations when you choose to submit information to it, as a step taken at your request before any potential engagement.
• Legitimate interests (Article 6(1)(f) GDPR): to operate, secure and prevent misuse of the website and the AI Security Advisor, and to store and review Advisor questions and answers to maintain the quality of the service.

We do not sell your personal data. We may share your data with service providers that help us operate our website or communications, where necessary and appropriate, such as:

• Website hosting providers.
• Email providers.
• AI service providers that power the AI Security Advisor, only when you use the Advisor: Lovable AI Gateway, operated by Lovable, which routes requests to the AI model, and OpenAI, which provides the underlying AI model.

Where service providers process personal data on our behalf, they act as our processors under written terms that require them to protect it and use it only for the relevant purpose.

The AI Security Advisor is an optional tool that uses artificial intelligence to generate indicative security recommendations based on the information you provide. When you submit the form or ask a follow-up question, your input is sent through Lovable AI Gateway to OpenAI's AI model so that a response can be generated and returned to you. You are interacting with an AI system, not a person.

• Optional use: you do not have to use the Advisor to contact us or use our services.
• Don't share sensitive data: please do not enter passwords, keys, IP addresses, details of specific vulnerabilities, special category data or other personal data about individuals. Organisation-level information is all the Advisor needs.
• Storage by Instware: we store each question you submit and the AI-generated answer in our website database, and we receive a copy of each by email. We use them to review the quality of the Advisor, prevent misuse and understand the security topics our visitors care about. The Advisor does not ask for your name or email address, so we do not use these records to contact you unless you also send us an enquiry. On your screen, the conversation is cleared when you start a new assessment, reload or leave the page.
• Service providers: Lovable AI Gateway and OpenAI process your input only to generate the response and may keep request records for a limited period for security, abuse prevention and service operation, in line with their own terms. Your input is not used by Instware to train AI models, and inputs sent through OpenAI's business API are not used by OpenAI to train its models under its standard terms.
• No automated decisions: the Advisor does not make decisions that produce legal or similarly significant effects about you. Its output is general guidance only.

If you would like us to review your results, you can choose to share them with us by contacting contact@instware.com.

When you use one of our free security tools, our server runs the check from its own address, not yours (a few ordinary page requests to the website, or public DNS lookups through Cloudflare's DNS service). Each time a check is run, we record:

• What you checked: the tool used, the domain you entered, whether you confirmed you are authorised to test it, and the result (or the error, if the check failed).
• Technical information about your visit: the date and time, your IP address, an approximate location derived from it (country, region, city, postcode area, time zone and approximate coordinates), your internet provider or network, your browser and device type (user agent), your browser language, and the page that referred you.

We store this record in our website database and receive a copy by email. We use it to prevent misuse of the tools (for example, people checking websites they are not authorised to test), to keep the tools working well, and to understand interest in our services so that we can follow up where appropriate. Our legal basis is our legitimate interests (Article 6(1)(f) GDPR) in securing our website, preventing abuse and developing our business. Location is estimated from your IP address by our hosting provider and is approximate. These records are not deleted automatically; we review them periodically and delete those we no longer need. You can object to this processing or ask us to delete a record by contacting contact@instware.com.

Meeting bookings: when you request a meeting through our Contact page, we store your name, email address, optional company, topic and message, the time you chose and your browser's time zone in our website database, and email the details to us and a confirmation to you. We use this to arrange and hold the meeting (steps at your request prior to entering into a contract, Article 6(1)(b) GDPR). Meetings take place on Google Meet, provided by Google. Booking records are not deleted automatically; we review them periodically and delete those we no longer need.

Donations: if you choose to donate to support our free tools, your payment is processed by Stripe, which collects your email address, payment details and billing information directly in its secure checkout. Instware does not see or store your full card details. Stripe acts as an independent controller for payment and fraud-prevention purposes under its own privacy policy and may set its own cookies within the checkout to prevent fraud. We receive the donation amount, date and the email address you give Stripe for your receipt, and keep these as financial records for as long as the law requires.

Some of our service providers, including our hosting provider, Lovable AI Gateway and OpenAI, may process personal data outside the European Economic Area, including in the United States. Where this happens, we rely on appropriate safeguards under Chapter V GDPR, such as an adequacy decision (including the EU–US Data Privacy Framework, where the recipient is certified) or the European Commission's standard contractual clauses.

Enquiries: when you submit our contact form, we store your enquiry in our website database and receive a copy by email. We keep enquiries, and any related email correspondence, only for as long as reasonably necessary to respond to your query, assess potential business engagement, maintain our records, and protect our legal position where required. Enquiries are not deleted automatically; we review them periodically and delete those no longer needed. If there is no ongoing business relationship, we will aim not to keep personal data longer than necessary.

You may contact us at any time to request deletion of your enquiry data, subject to any legal or legitimate need to retain it.

Newsletter: we keep your email address for as long as you remain subscribed. When you unsubscribe on this website, your email address is deleted from our subscriber list straight away. We also receive a one-off email notification when someone subscribes, which we delete when no longer needed. If we manage our mailings in a separate email tool, we remove you from it as well when you unsubscribe.

AI Security Advisor: questions and AI-generated answers are stored in our website database and in our email inbox. They are not deleted automatically; we review them periodically and delete those no longer needed. Because they are not linked to your name or email address, please tell us roughly when you used the Advisor and what you asked if you would like a record deleted (see AI Security Advisor).

Under GDPR, you may have the right to:

• Access your personal data.
• Request correction of inaccurate or incomplete data.
• Request erasure of your personal data.
• Object to certain processing.
• Request restriction of processing.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the Data Protection Commission in Ireland.

To exercise your rights, contact us at: contact@instware.com

If you are not satisfied with how your personal data is handled, you may contact the Data Protection Commission:

This website and the AI Security Advisor are intended for businesses and are not directed at children under 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. The latest version will always be published on this website with the revised date shown at the top.