Privacy Notice

Instrumento LLC, an Arizona limited liability company

Effective date: August 18, 2026 · Version 2.0.1

1. The two roles this notice covers

Instrumento handles personal information in two distinct roles, and your rights and our responsibilities differ depending on which role applies. This notice is organized around that distinction, because a single undifferentiated list would misdescribe both.

Instrumento as controller. For some information, Instrumento decides why and how it is processed. This covers visitors to our website, people who contact our sales team, and the people who administer and use customer accounts.

Instrumento as processor (service provider). For the data a customer organization brings into the platform — program data, survey responses, participant and beneficiary information, imported datasets, reports — the customer decides why and how it is processed. We process it on the customer's documented instructions under the data processing terms of that customer's agreement, and we do not use it for our own purposes.

If you are a program participant, a survey respondent, or otherwise a person whose information a customer organization has entered into Instrumento, the organization you interacted with is responsible for that data. Section 4 explains what that means for your rights.

2. Instrumento as controller

2.1 Website visitors

When you browse instrumento.io we process:

Technical data — IP address, browser and device information, pages viewed — as needed to serve the site, keep it secure, and diagnose errors.
Error monitoring — we use Sentry to capture application errors. Session replay, which records anonymized interaction traces to help us reproduce bugs, runs only if you consent to it in the cookie banner. Text is masked and media is blocked in replays.
Analytics — only with your consent, as described in the Cookie Notice. Without consent, no analytics events are sent.

The legal basis is our legitimate interest in operating and securing a public website, and consent where the Cookie Notice says consent is asked for.

2.2 Sales contacts

When you submit the contact or contact-sales form, we process the information you provide — name, work email, organization, role, and what you tell us about your needs — to respond to your inquiry and follow up on it. Submissions are delivered to our team by email through Resend, Inc., our transactional email provider. Submitting a form does not subscribe you to marketing.

The legal basis is our legitimate interest in responding to inquiries we are asked to respond to, and taking pre-contractual steps at your request.

2.3 Customer administrators and users

When your organization provisions you an Instrumento account, we process:

Account data — name, email address, authentication identifiers (including your Google identifier if you sign in with Google), language preference, and role within your organization.
Security and audit data — sign-in events, session records, and audit logs of actions taken in the platform. Audit records are retained on the schedule in our data-retention policy (categories range from 30 days for system noise to longer windows for security-relevant events), and are kept because your organization and we both need an answer to "who did what".
Policy acceptances — when you activate an invited account, we record which version of the Privacy Notice and the Acceptable Use & Responsible AI Policy you saw, with a timestamp and a content hash. This is the record that the policies were put in front of you; we collect no additional telemetry with it.
Billing contacts — for the people our customers designate, business contact details and billing history. Payment cards are processed by Stripe; we never hold full card numbers.

The legal basis is the performance of our contract with your organization, our legitimate interest in securing the service, and legal obligations where they apply.

2.4 What we do not do

We do not sell personal information. We do not use the personal information described in this section for third-party advertising. We do not use it to train machine-learning models.

3. Instrumento as processor: Customer Data

"Customer Data" is everything a customer organization brings into the platform: datasets and spreadsheets, form and survey responses, participant and beneficiary records, connected data sources, media, and the reports and analyses generated from them.

For Customer Data:

The customer is the controller. The customer determines the purposes, the lawful basis, and whether the notices and consents its own participants require have been given. Instrumento cannot know, and does not decide, why a youth program collects attendance or what a funder requires a grantee to report.
We process on documented instructions. Using the platform's features is the instruction. The customer's agreement and its data processing terms define the boundaries; we do not process Customer Data for our own purposes.
Customer Data may include children's and sensitive data. Instrumento serves nonprofits and program-evaluation organizations. Their datasets can lawfully include information about children and students, health and disability information, and other special categories. Whether laws such as COPPA, FERPA, or LGPD Article 14 apply, and what they require, is the customer's determination for the customer's programs; our platform-level commitments for such data (no sale, no advertising use, no model training) are stated in Section 5 and in the customer's agreement.
AI processing is a customer-controlled feature. When a customer uses AI features, the relevant Customer Data is sent to the AI subprocessors listed on our Subprocessor List to produce the requested output. Customers can disable AI processing per dataset and exclude individual columns from AI access — these controls exist in the product today. High-entropy identifiers are redacted from AI prompts.
We do not train models on Customer Data. Instrumento builds no models from Customer Data. Our AI subprocessors process inputs to provide the service; the contractual commitments each vendor makes about retention and training are recorded in our vendor agreements. [TODO_LEGAL_AI_VENDOR_TERMS: verify and summarize each AI vendor's current API data-use and retention commitments before making vendor-specific public claims.]

3.1 Rights requests about Customer Data

If a customer organization holds your information in Instrumento, direct access, correction, or deletion requests to that organization — it controls the data and is the party able to act on your request in context. If you contact us instead, we will refer your request to the organization and assist it as its agreement with us requires. Where the law requires us to act directly, we will.

4. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or port personal information, to object to processing, and to withdraw consent — under the GDPR (EEA), UK GDPR, Swiss FADP, LGPD (Brazil), and US state privacy laws that apply to you.

For information where Instrumento is the controller (Sections 2.1–2.3), exercise these rights by writing to privacy@instrumento.io. We will respond within the time the applicable law allows. You may also complain to your supervisory authority.

For Customer Data, see Section 3.1: your request usually belongs with the organization that collected your information.

Account holders can export their organization's data through the product's export features, and can request deletion of their individual account at instrumento.io/delete-account. Deleting an individual account removes and de-identifies that person; it does not delete a customer organization or its data, which are governed by the organization's agreement.

5. Children and student data

Our website and sales channels are directed at organizations, not at children, and we do not knowingly collect personal information from children through our own website or marketing.

The platform is different, and we say so plainly: customer organizations may lawfully submit program data about children and students as described in Section 3. For that data we act only on the customer's instructions, and we do not sell it, use it for advertising, or use it to train models. Responsibility for parental notices, consents, and the applicability of child- and student-data laws rests with the customer that collects the data.

6. Where data goes

Hosting and storage. The application is hosted on Render; the database is operated by PingCAP (TiDB Cloud) on AWS infrastructure in the United States (us-west-2, Oregon); uploaded files are stored in Cloudflare R2 in Cloudflare's Eastern North America region.
Subprocessors. The current list of vendors that process personal data on our behalf, what each receives, and each one's transfer mechanism is published and maintained at instrumento.io/legal/subprocessors. That page, not this one, is the authoritative vendor list, and it records where a transfer mechanism is still under review.
International transfers. Data is processed in the United States. Where data originates from jurisdictions that restrict international transfers, we rely on the transfer mechanisms recorded on the Subprocessor List for each vendor. [TODO_LEGAL_TRANSFERS: several mechanisms are marked "Under review" on the Subprocessor List; counsel to confirm each before this section can name them unconditionally.]

7. Security and retention

Data is encrypted in transit (TLS). Access to production systems is restricted and audited. Passwords are stored only as Argon2id hashes. A fuller description of our current practices — stated as what we do today, not as certifications we hold — is at instrumento.io/security.

We retain personal information only as long as needed for the purposes above. Operational retention windows (audit-log categories, deleted-account handling with a 30-day soft-delete window, demo-lead expiry) are defined in our internal data-retention policy and enforced by scheduled jobs. Customer Data is retained for the customer's subscription term and deleted or returned per the customer's agreement.

8. Changes and contact

We will update this notice when our practices change, with a new version number and effective date. Material changes affecting customer accounts are announced in the product.

Instrumento LLC, an Arizona limited liability company Mailing address (correspondence only): 5 Union Square West #1396, New York, NY 10003, USA Privacy: privacy@instrumento.io · General: info@instrumento.io