Privacy Policy

Privacy Policy

Instabridge Sweden AB. This Privacy Policy has two parts and two annexes: Part A applies to all Instabridge services; Part B applies to Nova Agent OS in addition to Part A; Annex A is the supplemental CCPA notice; Annex B covers people who do not hold an Instabridge account. 

PART A – INSTABRIDGE PRIVACY POLICY

EFFECTIVE DATE: 2026-11-12

About this Privacy Policy

We value your privacy and want to be accountable and fair to you, as well as transparent with you with regard to our processing of your personal data. This Privacy Policy therefore provides comprehensive disclosure of potential scenarios in which personal data may be collected, used, or shared. This is intended to ensure transparency and to cover all relevant circumstances. We nonetheless make every effort to minimise the collection and use of personal data, and we rely on aggregate and/or de-identified data wherever possible.

General Information

Instabridge, a Swedish company, provides intermediary services primarily consisting of transmission of access to a communication network (as defined in the EU’s Digital Services Act (“DSA”). The regulatory framework for the Services (defined below) consists principally of the DSA and the General Data Protection Regulation (“GDPR”) as well as various legal acts ancillary to DSA and GDPR as well as local laws and regulations that are applicable in jurisdictions where the Services are provided. The Privacy Policy reflects our commitments and undertakings as further outlined below.

If you reside within or outside the European Union, European Economic Area and Switzerland (“Europe”), you are entering into the Terms of Service with Instabridge Sweden AB and the terms of this Privacy Policy apply to you.

For information on our processing of personal information that is subject to the California Consumer Privacy Act (“CCPA”), please see Annex A – Supplemental CCPA Privacy Notice.

This Privacy Policy (“Privacy Policy”) describes how and when we may collect, use, secure, and share personal information collected in connection with our mobile applications, websites, content, products, and any related services (collectively, the “Services”), and your choices regarding our processing of that information. For the purposes of this Privacy Policy, “Instabridge”, “we”, “us”, or “our” refers to Instabridge Sweden AB, company reg. no. 559246-0538, and its subsidiaries, representatives, and affiliates including, our websites,  applications, and other offerings that link to this Privacy Policy or otherwise make it available to you. We are the data controller of the personal data that we collect from you when using the Services, except if explicitly stated otherwise in this policy. Where another controller arrangement applies, this will be explained in the relevant section of this Privacy Policy, including in relation to rewarded offers after opt-in.

Nova Agent OS. This Privacy Policy also covers Nova Agent OS, our cloud computer and AI agent service. Part B of this Privacy Policy applies to Nova Agent OS in addition to Part A, and prevails for Nova Agent OS where they differ. Where Part B says that an organisation is the controller for a work account, we process that account’s data as the organisation’s processor, and Part A does not apply to it.

If you provide us with personal information about someone else, you hereby confirm that they are aware that you have provided their personal information to us, and that they consent to our use of their personal information according to this Privacy Policy.

This paragraph does not apply to Nova Agent OS. Part B, section B5, explains how we handle information about other people that appears in your Nova Agent OS content.

Please read this Privacy Policy carefully. This document contains a policy statement regarding our collection, use and processing of personal data, with whom we may share your personal data and your rights in relation to your personal data. It also tells you what to expect when we collect and use personal data about you that you share with us when using our Services.

Please note that this notice does not apply to third party products or services or the practices of companies that we do not own or control, including other companies you may interact with, in or through Instabridge. We will not be responsible or liable for: (i) the availability or accuracy of such third-party apps or sites (ii) the content, products or services on or availability of such third party apps or sites; or (iii) your use of any such third party apps or sites.

We may update the Privacy Policy from time to time by posting a new version on instabridge.com with an updated date (the “Effective Date”). Your continued use of the Services after the Effective Date will be an acknowledgement of your acceptance of the amended Private Policy and our updated practices. If we make material changes to our privacy policy, we will notify you and ask you to confirm your consent.

If there is any difference between the English version and any other language version of this Privacy Policy, the English version will apply (to the extent permitted by applicable law or regulation).

Information We May Collect and How We Collect It

We may collect various types of personal information, including information you provide or make available to us directly, information collected from your devices (including on web and mobile), and information collected from other sources, such as social networking sites. Some of this information may be considered “personal information” or “personal data” under applicable laws or regulations. We collect this information for various purposes including to provide and improve our Services to you.

Types of Data Collected

Personal Information you provide:

If you decide to create a user account on Instabridge, we will request certain personal information from you, which may include

• your name,  username, password, and email address.
• In the event that you choose to log in using your credentials from a third-party app (such as Facebook or Google), you give us permission to obtain your authentication information, such as your username, email address, and encrypted access credentials. Additionally, we may gather other personal information that is accessible through your third-party app account, such as your country and hometown, date of birth, and networks.

You also provide us with personal information directly when you:

• Communicate with or contact others using our Services, “invite a friend,” “share this page,” or use other similar features;
• Contact us, including for customer or technical support;
• Participate in Instabridge offers, contests, or special events;
• Subscribe to newsletters or sign up to hear about current or upcoming products; and/or
• Complete surveys offered by us or on our behalf.

Depending on how you choose to use the Services, you may provide us with the following types of personal information:

Contact information such as your first and last name, username or handle, third-party service ID, email address, phone number, home address, billing address, and other contact information;

Biographic and demographic information such as your date of birth, gender, and time zone.

Transaction information such as purchase or payment information; and/or

Other information such as profile information you choose to share (for example, when you connect with our Services through social features).

Contact and address book data – specific to Instabridge Caller ID & Spam Block

With your explicit permission, we access your device address book to provide features such as caller ID, reverse lookup, contact management, and related tools. This may include:

contact names, nicknames, labels, and groups;

phone numbers;

photos stored with contacts;

notes or other contact metadata you store.

Personal Information Collected or Generated When You Use our Services:

When you access or use our Services, we collect personal information from and about you and the device(s) you use. This may include the following personal information:

IP address, unique device identifiers, advertising identifiers, device serial numbers, and similar direct and indirect identifiers;

Device information such as hardware model, device software platform/OS and firmware, mobile carrier, preferred languages, device motion information, mobile network information, browser type and version, Internet service provider, applications installed on your device, default communication and browsing applications;

Internet activity such as referring/exit pages and URLs, or clickstream information, eSIM usage;

BSSID and SSID (Wi-Fi network name), eSIM provisioning identifiers, SIM card identifiers (IMEI), MAC address of access point, signal level, captive portal login steps and other technology on the devices you use to access the Service;

Approximate location inferred from IP address, and/or precise location derived from GPS data;

In-app purchase information;

Use and app settings, diagnostic data, and other information as reasonably required to offer and enhance our Services, including network and internet performance; and/or

Inferences, such as those drawn from any of the personal information we collect, to better understand your preferences.

Data from connected third-party channels

If you have connected your user account with us to a third party application, we may receive similar information related to your interactions with the Service from such channels.

Wifi map and location information

If you use the Wifi Map or Wifi List feature, we will ask for your consent to use your precise location to enhance the accuracy of the feature.

Browser recommendation feature

In the in-app browser, we use browsing history data to enhance your experience by providing you with tailored browsing recommendations. During your use of the browser, your browsing history is processed to generate recommended sites to visit. The browsing recommendations we show to you are stored in a secure database and are accessed only by our servers in an automated manner to make sure we show new and relevant recommendations. Access to the browsing recommendation data is strictly limited, and we keep the amount of data stored to the minimum required for feature function (data is anonymised, obfuscated, deleted or aggregated after 7 days). Browsing history is not stored. Anonymised, aggregated recommendation data may be processed and analysed to help us improve our product, resolve issues and provide a better user experience.

Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. Please note that we do not respond to or honor DNT signals or similar mechanisms transmitted by web browsers.

Opt-Out Option Browsing History

You have the option to opt out of having your search and browser history stored and processed. If you choose to opt out:

• Your account will not be synced across devices.
• Your account cannot be restored if you remove and later reinstall the app.

If you have any questions or wish to change your data preferences, please contact us at privacy@instabridge.com.

Caller identification (Call, messaging, and address book data; Data about your contacts, callers, and other individuals)

If you use the caller or caller id feature provided with our Services, we collect information from your device address book and about your calls to provide call logs. The information collected includes, such as phone number, name if it exists in your contacts, and call duration, call time and date, call duration and number of calls. This information is stored and processed locally on your device. In addition, we also collect the number of calls as well as call time and duration for the purposes of monitoring fair use, product development, resolving issues and providing a better user experience.

To provide caller ID and related features, we may process data that relates to people who are not users of the Services, including:

• phone numbers, names, photos, and labels contained in your address book;
• how you and other users label or classify a number (for example “Mom”, “Bank”, “Spam”);
• spam reports, reputation signals, and spam-related classifications for specific numbers;
• information from public sources that links phone numbers to individuals or organisations.

We treat this type of information with particular care and provide mechanisms for individuals to exercise their rights where applicable (see Section 11).

VPN service

When you use our VPN service, we only keep the following usage data associated with your account:

• Total amount of bytes transferred in a 30-day period; and
• Timestamp of your last activity on our VPN network.

This data is used to enforce free tier limitations, prevent abuse and remove inactive accounts.

The following data is not stored by our VPN service:

• Source IP;
• Sites you visited; and
• Historical record of VPN sessions.

When you are actively connected to a Instabridge server through our VPN service, the following is stored in our server’s memory for the duration of your connection:

Data discarded when you disconnect from our VPN service:

• OpenVPN/IKEv2 username;
• Time of connection; and
• Amount of data transferred.

Data is stored in a central location:

• Number of parallel connections at any given time to prevent rampant abuse and account sharing; and
• A counter is incremented that stores the total number of bytes downloaded/uploaded in a 30 day period.

Anything that is not mentioned above is not stored by our VPN service.

Our bespoke system eliminates the need to store session data about your use of the VPN service in a permanent database entirely. This data resides only in the server’s memory while you’re connected, and is immediately discarded by the VPN server when you disconnect. Since it doesn’t get logged into a permanent database, there is nothing to delete.

AI Recommendations & Personalisation (Optional Feature)

If you enable AI Recommendations & Personalisation (“AI Feature”), we process certain information you choose to share to provide more relevant, contextual recommendations and answers in the Instabridge app. This feature is optional and can be turned off at any time.

AI chat. The AI Feature includes an AI chat, where you can ask questions and get answers, suggestions and help with tasks in the app. When you use the chat we process the messages you type and any content you attach, the answers the chat gives you, your chat history, and the context categories you have enabled below. You are talking to an AI system, not a person, and the chat says so when you start it; its answers can be wrong or incomplete, so check anything important before you rely on it. The chat is for people aged 18 or over. We process your chat messages and history to provide the chat you asked for (GDPR Art. 6(1)(b)), and the context categories only with your consent per category (Art. 6(1)(a)), which you can withdraw in Settings at any time. 

Data you can choose to share for AI personalisation (opt-in per category)

We process AI Feature data based on your consent (GDPR Art. 6(1)(a)) for each category you enable. You can withdraw consent at any time in Settings.

You can opt in separately to each category below. We only process the categories you have enabled:

gps location: current GPS coordinates for location-based recommendations.

location history: places visited and travel patterns for personalised recommendations.

installed apps: installed app names to infer interests for recommendations.

recently opened apps: recently used apps to tailor responses to your current context.

browser history: websites visited (e.g., domains or URLs depending on your selection) to infer interests.

search history: search queries to tailor responses.sms history:

text messages/communications (content and/or metadata, depending on your selection) used only to provide context in AI responses.

call history: call records (metadata) used only to provide context in AI responses.

photo metadata: photo timestamps and location metadata used only to provide context in AI responses.

responses and feedback: your prior AI interactions and feedback used to improve your future AI experience.

other: other information you explicitly choose to provide for personalisation (described at the time you opt in).

Personal Information Collected Using Cookies and Similar Technologies

We and our partners use various tools to collect personal information when you visit our sites and Services, including cookies, pixels, software development kits, advertising identifiers, and other similar technologies. Some of these technologies store information in the browser or on your device. Other technologies may use network-related or other information to recognize your device (e.g., IP address). Our Services use these technologies, for example, when you first request a web page, and information is then stored on your computer or other device so the website or app can access information when you make subsequent requests for pages from that Service.

Examples of Cookies we use on our website and their purposes:

At any time, you can control the use of cookies by adjusting the settings on your browser. However, if you choose to disable some or all cookies, please note that by blocking any or all cookies, you may not have access to certain features, content, or personalization available through our Services.

• Functional cookies: We use functional cookies to operate certain functions of the website in accordance with your choices, meaning that when you continue to use or come back to the website, the site will be provided as you have previously requested, e.g. remembering your username and customization of the website.
• Analytics cookies: We use analytics cookies to analyse how the website is accessed, used or is performing. We use the information to maintain, operate and improve the website.
• Third party cookies: We may allow our partners to use cookies on the website for the same purposes identified above. We may also use service providers acting on our behalf to use cookies for the purposes identified above.
• Security Cookies: We use security cookies for security purposes.
• Advertising Cookies: advertising cookies are used to serve you with advertisements that may be relevant to you and your interests.

If you have any questions or comments about our use of cookies, please contact privacy@instabridge.com.

Other personal information collected using tracking technologies

Depending on the Services you use and your consent settings, we and our partners may also use these technologies to gather information about how you view and use our Services and content, and to connect your activity with other personal information we store about you. Some of these partners include:

Google Analytics. For more information about how Google uses your personal information (including for its own purposes, e.g., for profiling or linking it to other information), please visit Google Analytics’ Privacy Policy. To learn more about how to opt-out of Google Analytics’ use of your information, please click here.

How we store your personal information

We store your personal information on industry standard servers, including through the use of the following third parties:

Firebase and Google Cloud, owned by Google, who is a Service Provider. The data we store and otherwise process about you will be stored on servers hosted by Google Cloud.

Amplitude, who is a Service Provider, and their service provider Amazon Web Services, which acts as a subprocessor.

Singular. Singular is a Service Provider, and data that they process on our behalf is hosted by their service providers Amazon Web Services, Inc. and Snowflake, Inc,  which act as subprocessors.

CrispChat. Crisp IM SAS is a Service Provider, and data that they process on our behalf is hosted by their service providers Amazon Web Services, Inc. and DigitalOcean LLC,which act as subprocessors.

Payment data is hosted by Stripe Payments Europe, Ltd, which is a Service Provider.

eSIM, call, text and data usage data for Instabridge Mobile is processed and hosted by OXIO, Inc, which is a Service Provider.

The providers that store and process Nova Agent OS data are listed in Part B, section B8.

Legal Basis for Processing Personal Information

Our legal basis for collecting and using your personal information will depend on the type of information and the context in which we collect it. In general, we collect personal information from you only:

• Where we have your consent to do so, such as before we use or share your information for advertising that is targeted based on your browsing history, online behaviour, or other personal information that we or third parties may have collected about you. If you consent to our use of your personal information for any purpose, you have the right to withdraw consent at any time by contacting us, as explained above;
• Where we need it to perform a contract with you;
• Where it is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. We have a legitimate interest in processing your personal information, for example, for the following purposes:
• Product and Service development, management, delivery, and enhancement;
• Fraud detection and prevention;
• Network and system security and performance;
• General corporate operations;
• Compliance with applicable foreign laws;
• Communications regarding your purchases or customer service requests; and
• Where we have a legal obligation to collect personal information from you or may otherwise need it to protect your vital interests or those of another person.

If you have questions about the legal basis on which we collect and use your personal information, please contact us at privacy@instabridge.com.

How We Use Personal Information

To manage our relationship and provide the Services in a satisfactory and error free manner, we need to process your data, including personal data. For example, we process your data when you create an account, if you contact our customer support team, for maintenance of the app, and for marketing purposes. If you do not provide us with certain personal information, we will not be able to provide you with the Services. Please find more detailed information on how we process your data when we manage our relationship, below.

We may use the personal information we collect for a number of business and commercial purposes, including to:

Perform internal operations necessary to develop, provide, maintain, and improve our Services, including troubleshooting, providing customer and technical support, and conducting data analysis, testing, and research;

Understand how you interact with our Services and personalise the product experience and content (including advertising and messaging campaigns), as well as offer discounts or personalised pricing in accordance with applicable law;

Show caller contact information (phone number, name) during calls using the call feature or the caller id functionality. This is only to the extent of showing eg contact name and number on the screen, in addition to call information (number of calls, ingoing/outgoing call, duration).

Managing your incoming and outgoing calls when you use the call logs or caller id functionality.

To show you personalised ads when you use our Services. Depending on your consent choices, we may use identifiers and cookies to provide you with tailored ads. We work with third-party advertising networks/service providers to provide personalised ads, including but not limited to Google, Meta, Unity, and Adjoe. These third-parties collect and use personal information about your use of the Service, and depending on your consent settings, the use of other websites and services, in order to serve you with ads and content tailored to meet your preferences and likely interests. This data is also used to understand the effectiveness of ads.

Maintain the safety, security, and integrity of our Services, for example by authenticating users and providing account security, and fraud detection and prevention;

To initiate an eSIM purchase or installation, provisioning identifiers (for example, eSIM profile IDs or other provisioning tokens) and necessary purchase information is shared with the carrier or provisioning vendor that completes activation;

Send you news and/or marketing communications (by email, or in-app notification) subject to your marketing preferences and choices, including information about Instabridge or third-party offerings we think may be of interest to you;

Administer contests, surveys, and sweepstakes you enter, notify contest winners, and award prizes;

Fulfil a purchase or send you order confirmations or other requested product or Service information;

Facilitate your communication with friends and other users, and enable features that allow you to share information with other people (for example, if you choose to use friend invite features); and/or

Comply with legal requirements and/or investigate or address claims or disputes relating to your use of the Services.

Further information with regard to ads personalisation

We display ads in Instabridge apps to help keep the product free and to support maintenance and development costs. By allowing us to process your personal data for personalised advertising, you help support Instabridge and allow us to continue providing and improving the Services.

Please keep in mind that opting out of personalised advertising will not stop all ads from being displayed to you (i.e. opting out does not provide an ad-free experience). You can disable personalised advertising in your device settings. Additionally, you may have the option to opt out of personalised ads from advertisers and ad networks that participate in the Network Advertising Initiative, or adhere to the DAA Self-Regulatory Principles for Online Behavioral Advertising, by using their provided opt-out tools.

How we use data for AI personalisation (purposes)

We use AI Feature data only to: Generate personalised AI responses and recommendations during your session (on-the-fly inference); and maintain and protect the AI Feature, including security, abuse prevention, debugging, and quality assurance. We do not use AI Feature data to train or fine-tune AI models.

The same applies to the AI chat. We use your messages, attachments and the context you enabled only to answer you in that chat, to keep your chat history available to you, and to keep the chat safe and working, including abuse prevention, debugging and quality assurance. We do not use chat content to train or fine-tune AI models, and we do not use it for advertising or share it with advertisers.

Enhanced safeguards for AI feature data (potentially sensitive inferences)

Some AI Feature data (alone or combined) could allow inferences about sensitive information (such as health, religion, or political opinions). We apply enhanced safeguards, including data minimisation, strict access controls, encryption, and purpose restrictions.

Use of aggregated or anonymised data

We may use your non-personal information data in an aggregated and/or anonymised form to share publicly and to third parties, for example, in reports on internet use trends, to partners under agreement with us, or as part of community benchmarking. Data shared in this manner cannot reasonably be used to identify you as an individual. If we create or receive de-identified information, we will not attempt to reidentify such information, unless permitted by, or required to comply with, applicable laws.

How And To Whom We Disclose Personal Information

Subject to your legal rights, we may disclose the information we collect about you, and/or may enable you to share this information, with a third parties in various ways, including:

With vendors, consultants, business partners, payment processors, and other third-party service providers as necessary to carry out work on our behalf and otherwise provide the Services. This includes IT infrastructure companies that facilitate our provision of the Services to you; and other third party service providers, such as hosting providers or other IT service providers for the purpose of providing the Service or tracking your use of the Service (listed under “How We Store Your Personal Information” above), fraud prevention partners, as well as advertising and survey service providers to help us in our communication with you and to better understand your use of the Service.

With third-party applications if you choose to connect your Instabridge account or use a third-party application to login to Instabridge. You understand and agree that such information may be attributed to your account on the third party application, and that a third party application’s use of personal information collected from you is governed by the third party application’s privacy policies and your settings on the relevant service. Instabridge’s use of such personal information is governed by this Privacy Policy and your Instabridge account settings.

With third-party advertising partners for the purposes of cross-behavioral advertising, where we have your consent to do so. This means that data collected from your activities within the Services may be combined with information from other sources to build a broader profile of your interests. We typically use pseudonymized or aggregated data for these purposes, which does not directly identify you. You may opt out of cross-behavioral advertising by adjusting your account settings. Please note that opting out will not reduce the total number of ads you see, but will result in non-personalised advertising content.

Our advertising partners include: Google Group Companies (Google, LLC; Google Ireland Limited), Meta Group Companies (Meta Platforms Technologies, LLC; Meta Platforms Ireland Limited), InMobi Technology Services Pvt. Ltd., Vungle, Inc., Moloco, Inc, Bytedance Pte. Ltd, Liftoff, Inc

With others who share your device, if you make your Account available to them through that device;

With law enforcement officials, government authorities, or other third parties if we believe your actions are inconsistent with our Terms of Service or other policies, and/or are fraudulent or in violation of applicable law, or as we determine necessary to protect the rights, property, or safety of Instabridge or others;

When we respond to court orders, or legal process, or to establish or exercise our legal rights or defend against legal claims;

With specific third parties if we believe disclosure is required by applicable law, regulation, or legal process. This includes, but is not limited to, when we believe, at our sole discretion, that it is necessary to share personal information in order to investigate, prevent or take actions against illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our Terms of Service, or as otherwise required by law. We may use your personal information without your knowledge or consent where we are permitted or required by applicable law or regulatory requirements to do so;

In some cases, we may enable you to access third-party products or services through our Services. Please note that those products or services are offered by people or companies not affiliated with or controlled by us, and we are not responsible for their actions, their terms, their use of personal information, or their products or services. If you submit your personal information to a third party, that third party’s treatment of your personal information is governed by their privacy policy, which may differ from this Privacy Policy and which we encourage you to review;

We also share personal information with your consent or at your direction. For example, we may share your personal information if you opt in to receiving communications from Instabridge’s business partners.

We may share your personal information with our corporate affiliates.

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, purchase or sale of assets, transition of service to another provider, or other similar corporate transaction, your personal information may be disclosed, sold, or transferred as part of such a transaction.

Rewarded offers and independent controllership after opt-in

If you choose to participate in rewarded offers made available through Adjoe GmbH (“Adjoe”) in our Services, Adjoe may ask you to accept its terms and privacy notice before you participate. After you opt in to Adjoe’s rewarded-offer experience, Instabridge and Adjoe may each process certain personal data as independent data controllers for their own respective purposes related to the rewarded offer.

This may include data needed to attribute and validate your participation in rewarded offers, confirm reward eligibility, prevent fraud, measure campaign performance, and support the operation and security of the rewarded-offer experience. Depending on the offer and your device settings, this may include identifiers and device data, app context data, limited usage data relating to offer completion, attribution data such as click/install timing, reward status, and other information described to you at the time of opt-in.

Instabridge processes this information to operate the rewarded-offer feature in our Services, validate completions, grant rewards, prevent abuse, and maintain the integrity of our offers. Adjoe processes personal data for its own purposes as described in its privacy notice, including attribution, analytics, fraud prevention, and campaign optimization.

Once you have opted in to Adjoe’s rewarded-offer experience, Adjoe’s processing is governed by Adjoe’s own privacy notice in addition to this Privacy Policy. We encourage you to review Adjoe’s privacy information carefully before participating.

Where required by applicable law, we will ask for your consent before enabling this processing. You can also choose not to participate in Adjoe rewarded offers.

Sharing and international transfers of AI feature data

We may share AI Feature data with service providers that help operate the AI Feature (for example, cloud infrastructure and AI processing vendors) acting as our processors under data-processing agreements. If processing involves transfers outside the EU/EEA, we use appropriate safeguards such as Standard Contractual Clauses.

The AI model providers that generate chat answers are reached through our AI gateway Opper (Sweden), which passes requests to DeepInfra or Groq in the USA and creates search data with Microsoft Azure in Sweden. If those providers are unavailable, a request may be answered by OpenAI in the USA as an emergency fallback. Novita AI processes only the feedback you send us about an answer. They act as our processors under data processing agreements that do not allow them to use your data to train their models.

Your Rights and Choices

GDPR applies to collection and processing of personal information for end users in the EU and EEA. In accordance with GDPR and other applicable privacy laws and regulations (including those in the United States) you may have the following rights:

• Access: to obtain confirmation regarding whether we process your personal information, and to obtain a copy of the personal information we have collected about you. (Note that this right only applies to personal information relating to you, and not to any other user or person.)
• Rectification or Correction: to correct your personal information where it is inaccurate, incomplete, or outdated.
• Erasure (deletion): to request that Instabridge deletes your personal information, for example when it is no longer necessary to fulfil the purposes for which Instabridge collected it. This right may be limited to the extent that Instabridge is permitted or required by applicable law to retain your personal information. (Note that if you request deletion of your personal information, you may no longer be able to use or access the Services. If you share devices with someone else who uses the Services, that person may also lose related Account information and access. If you decide to use or access the Services again, Instabridge may consider this a new Account and may collect personal information associated with that Account in accordance with this Privacy Policy.)
• Restriction or objection to processing: to object to Instabridge’s processing of your personal information, or request that Instabridge restricts that processing. Because the personal information that Instabridge collects is generally required to provide the Services to you, if you object to the processing of your personal information, this may have the same effect as requesting deletion of this information. This right may be limited to the extent that Instabridge is permitted or required by applicable law to continue processing the information. (Note that if you object to the processing of your personal information, you and others who use your devices to access the Services may no longer be able to use or access the Services.)
• Portability: to receive a copy of your personal information in a structured, commonly used, and machine-readable format so that you can transmit it elsewhere.
• Request to be informed: to request information about third parties with which your personal information has been shared.
• Request to review: to review decisions taken exclusively based on automated processing if these decisions could affect your data subject rights.
• Request to opt-out of certain processing activities: if applicable, to request to opt out if we process your personal information for “targeted advertising” (as “targeted advertising” is defined by applicable privacy laws),  if we “sell” your personal information (as “sell” is defined by applicable privacy laws), or if we engage in “profiling” in furtherance of certain “decisions that produce legal or similarly significant effects” concerning you (as such terms are defined by applicable privacy laws).

Please note that these rights are not absolute. We may decline requests to exercise your data subject rights if there is a valid reason—such as being unable to verify your identity, the request potentially infringing on a third party’s rights or applicable law, or if fulfilling the request could disrupt our Services or prevent us from providing a requested service

In addition to the rights described above, if we have collected and processed certain types of personal information with your consent, you may withdraw that consent at any time in the manner described when you provided consent. Withdrawing your consent will not affect the lawfulness of any processing conducted prior to then, nor will it affect any processing based on lawful grounds other than consent.

If you are unhappy with our processing of your personal data and/or consider it to be in contrary to applicable legislation you may have the right to lodge a complaint with a competent supervisory data protection authority (“DPA”) (such as with the DPA in your country of residence, the DPA in the country of your place of work or the DPA in the country where the alleged infringement has occurred). In Sweden, the supervisory authority is the Swedish Supervisory Authority for Privacy Protection (“Integritetsskyddsmyndigheten”).

We will cooperate with the appropriate governmental authorities to resolve any privacy-related complaints that cannot be amicably resolved.

To exercise the aforementioned rights please contact us at the following address: privacy@instabridge.com or Instabridge Sweden AB, Box 190, 101 23 Stockholm. In order to ensure that you receive a swift response, please state in your letter your full name and, if applicable, your address, user name and the email address used for registration, and the user id associated with your account.

We may request you provide us with information necessary to confirm your identity before responding to any request you make. Examples of our verification process may include asking you to confirm the email address and account ID we have associated with you.

Only you, or someone legally authorized to act on your behalf in certain jurisdictions, may make a request to exercise the rights listed above regarding your personal information. If your personal information is subject to a law that allows an authorized agent to act on your behalf in exercising your privacy rights and you wish to designate an authorized agent, please provide written authorization signed by you and your designated agent using the information found in “How to Contact Us” below and ask us for additional instructions.

Some laws may allow you to appeal our decision if we decline to process your request. If applicable laws grant you an appeal right, and you would like to appeal our decision with respect to your request, you may do so by informing us of this and providing us with information supporting your appeal.

Data Retention

We will keep your personal data for as long as you have an account in the Services or for as long as we need to keep any personal data to comply with our legal obligations, resolve disputes, or enforce our agreements. After this your personal data will be deleted.

Retention and deletion of AI feature data

AI Feature data is retained for no more than 30 days and is automatically scheduled for deletion. If you disable a category or turn off the AI Feature, we stop collecting that category and delete related AI Feature data according to the same automated schedule, unless a longer period is required by law.

Chat history is kept for 30 days after the last message in a chat, or until you delete the chat, whichever comes first. You can delete individual chats in the app, and deleting your account deletes all of them. Context data used by the chat follows the 30-day rule above and is deleted when you turn a category off. Your ratings of answers are kept for 30 days. Technical records about the chat, such as the number of tokens used, cost and plan, contain no message content and are kept for 13 months.

Data deletion requests

You can request deletion of your data directly through the Instabridge app or by contacting us via email. To request data deletion in the app, go to Account Settings, where you can select the option to delete your account and associated data. Alternatively, you may send an email to privacy@instabridge.com with your deletion request clearly stated, and our team will process your request in accordance with applicable privacy laws. See specific instructions at https://instabridge.com/account-deletion/

Use By Minors

Our Services are designed for a general audience and require all users to be above the minimum age to consent for data processing as a condition of access. By installing or using our Services you represent and warrant to us that you are above the minimum age to consent for data processing in your domicile.

If you are a parent or guardian of a minor, and believe that minor has uploaded personal information in connection with our Services without your consent, or if you wish to review personal information collected from your minor child, or have that information modified or deleted, you may contact us as described in “Contact Us” below. If we become aware that a minor has provided us with personal information in violation of applicable law, we will use reasonable efforts to delete any personal information we have collected, unless we have a legal obligation to keep it.

Nova Agent OS is for people aged 18 or over (Part B, section B12).

The AI Feature, including the AI chat, is for people aged 18 or over in every app that offers it.

International Transfers of Your Personal Data

If you are located in the European Union (“EU”), United Kingdom (“UK”) or Switzerland then we may transfer personal data that we collect from you to third party suppliers and trusted partners located in countries that are outside of the EU and the European Economic Area (“EEA”) (including, but not limited to the USA) or to our partners/related third parties in connection with the above purposes. The same rule applies for users outside the EU/EAA, that is your data may be transferred outside of the country from which it was originally collected. Please be aware that the countries to which we may transfer data may have data protection laws that are different from the laws where you live.

When transferring personal data outside the EU/EEA, we will ensure that the country in which your personal data will be handled has been deemed “adequate” by the EU Commission under Article 45 of the General Data Protection Regulation (“GDPR”) or if your personal data will be transferred to a country which the EU Commission does not consider to have an adequate level of protection for personal data, we will take all necessary steps required under applicable law in order for such transfer of personal information across borders to be compliant with applicable law. We will only transfer your personal data to a country outside the EU/EEA that does not have adequate data protection laws where; (i) the transfer is being safeguarded by the use of Standard Contractual Clauses (SCCs), which have been approved by the European Commission as appropriate safeguards for international transfers under Article 46(2) of the GDPR; or (ii) where applicable, by an adequacy decision adopted by the European Commission under Article 45 of the GDPR.

By installing or using the App or Services, you consent to those transfers of personal information to other countries and to service providers.

You can find further information about the rules on data transfers outside the EU/EEA, including the mechanisms that we rely upon, on the European Commission website (https://ec.europa.eu/info/law/law-topic/data-protection_en).

How to Contact Us

Data controller

Name: Instabridge Sweden AB

Registration number: 559246-0538

Postal address: Instabridge Sweden AB

Box 190

101 23 Stockholm

E-mail address: support@instabridge.com

Data Protection Officer

External Data Protection Officer:

ePrivacy GmbH, represented by Prof. Dr. Christoph Bauer, Burchardstraße 14, 20095 Hamburg

If you have any questions or concerns regarding your data, please contact privacy@instabridge.com. If you wish to communicate directly with our data protection officer (for example, because you have a particularly sensitive concern), please contact them by post, as communication by email may pose security risks. Please indicate in your request that your concern relates to Instabridge Sweden AB

For Nova Agent OS, write to privacy@novaagents.com which reaches the same privacy team (Part B, section B15).

Postal address: Prof. Dr. Christoph Bauer,

Burchardstraße 14,

20095 Hamburg

E-mail address: privacy@instabridge.com

PART B – NOVA AGENT OS PRIVACY POLICY

This Part B applies when you use Nova Agent OS: the cloud computer and AI agent service provided by Instabridge Sweden AB at novaagents.com, novaagentos.ai, novaagent.dev and through the Nova Agent OS applications. It applies in addition to Part A of this Privacy Policy and prevails for Nova Agent OS where they differ. It covers personal accounts, work accounts that an organisation provides, visitors to novaagents.com, novaagentos.ai and novaagent.dev, and information about other people that appears in users’ content.

B1. Who is responsible for your data

Personal accounts. Instabridge Sweden AB, company reg. no. 559246-0538, Box 190, 101 23 Stockholm, Sweden, is the controller for the personal data we process when you use Nova Agent OS with a personal account.

Work accounts. If an organisation, usually your employer, gives you a work account in Nova Agent OS, that organisation is the controller for the work account and everything in it. We process that data on the organisation’s behalf and on its instructions, under the Nova Agent OS Business Terms and Data Processing Agreement. Ask the organisation how it uses Nova Agent OS and how to exercise your rights; its contact is shown in Nova Agent OS.

For every account, including work accounts, we remain the controller for a short list of things that we decide ourselves: sign-in and account records, billing and payment records, security and misuse protection, service logs and usage measurement that contain no content, and records we must keep to meet our legal duties.

Your AI provider. When you sign an agent into your own account with an AI provider, such as Anthropic, OpenAI or Cursor, that provider is a separate controller under your own agreement with it (section B4).

B2. What data we process

Account and sign-in. Your name and email address from your Google sign-in, your account settings, your plan, and the time and version of the notices and choices you accepted.

Your cloud computer and your content. The files on your cloud computer, the software you install, your instructions to agents, agent sessions and their output, notes and settings. This content is yours; we process it only to run Nova Agent OS for you (section B3). It can contain personal data about you and about other people (section B5).

Agent sign-in. When you sign an agent in to your own AI provider account, the sign-in happens in the provider’s own flow and the sign-in token is stored on your cloud computer, in the agent’s own credential file. We do not see your password or token and do not copy it, but the token is part of your cloud computer and can remain in a saved copy of it for up to 7 days; our offsite backups leave it out. The same applies to a GitHub sign-in and to websites you sign in to with the browser on your cloud computer. We record only that an agent is connected and which provider it uses.

Connected services. When you connect a service such as email, calendar, chat, files, code or task tools, we process the access that the service grants and the items that your agents fetch from it on your instruction. Each service is off until you connect it.

Nova Desktop. If you install Nova Desktop on your own computer, it reads and changes files only in the folders you choose, and only when an agent you run needs them. If you allow it for a task, an agent can also use apps and the browser on that computer; it then sees what is on your screen, and that content is sent to your AI provider (section B4).

Sensitive information in your content. We do not ask for information about health, beliefs, sexual life or similar sensitive matters, and Nova Agent OS does not look for it or draw conclusions from it. It can still appear in the files you store and the services you connect, and it is then processed with the rest of your content, including by your AI provider. Keep such information off your cloud computer unless you need it for your own work and are allowed to hold it. You can exclude labels, folders, channels and external senders from a connected source in Settings.

Usage and service data without content. Technical records of how Nova Agent OS runs: event types, timestamps, error codes, IP address, browser and device type, which features you use, the number of agent runs, tokens and tool calls and their cost, and, for every connection your cloud computer makes to the internet, the destination and time but not what was sent. We also keep the record of each action an agent asked to take and what you, a saved choice or our automated reviewer decided. These records are designed to contain no content of your files, sessions or messages, and a test fails our build if content reaches them.

Website, waitlist and support. Your email address if you join the waitlist or write to support, and the content of your support messages.

Payments. Your plan, the amounts and dates of payments, and the payment status, processed by Stripe on the web or by Google Play if you buy in Nova Launcher. We do not store card numbers. For organisations that buy through Google Cloud Marketplace, the order data that Google sends us.

Work accounts. The organisation’s legal name and registration number, the identity of the administrator who accepted the Business Terms and Data Processing Agreement, the notices shown to members and their acknowledgements, and audit records of administrator actions such as exports.

B3. Why we use your data, and our legal bases

To provide Nova Agent OS to you (contract, GDPR Art. 6(1)(b)). Running your cloud computer, your agents and your connections, storing your content, billing you, and answering your support requests.

To keep Nova Agent OS secure and prevent misuse (legitimate interests, Art. 6(1)(f)). Authenticating you, detecting and stopping fraud, abuse and attacks, and investigating breaches of the Terms. Our interest is in a service that is safe for you and for other people.

To understand how Nova Agent OS is used and improve it (legitimate interests). Using the content-free usage data described in section B2. We never use your content for this.

To meet our legal duties (legal obligation, Art. 6(1)(c)). Keeping bookkeeping records, answering lawful requests from authorities, and keeping records that show how we handled your requests.

To settle amounts you owe (legitimate interests). Keeping a limited record of a late or unpaid Team subscription for up to six months after the last payment event, settlement or refund, also if the account owner deletes their account.

To send you news about Nova Agent OS (consent, or contract for service messages). We send marketing emails only if you have agreed to them, and you can unsubscribe at any time. Messages about your account, your plan, security or changes to the service are part of the contract.

Information about other people in your content (legitimate interests). See section B5.

To enforce our terms and keep others safe (legitimate interests, and legal obligation where sanctions or reporting duties apply). We do not read or scan your content for this. We use records of what agents do (the type of action, the kind of target, the outcome and whether our reviewer vetoed it), quota and rate-limit hits, the record of connections from your cloud computer, sign-up and payment patterns, abuse reports, and notices from AI providers, connected services and authorities. If we warn, throttle, suspend or terminate an account, we record the signal, the decision and who took it; that record is yours to ask for, and you can ask a person to review the decision (Terms of Service, Section 15.i and 15.j).

We do not sell your data, and we do not use your account data or your content for advertising. Nova Agent OS shows no advertising. The only advertising-related processing is measuring our own ads on novaagentos.ai, which happens only with your consent (section B13).

B4. Your agents and your AI provider

You can run agents from other providers, such as Anthropic (Claude Code), OpenAI (Codex) or Cursor, on your cloud computer, signed in to your own account with that provider. When your agent works, it sends your instructions and the content it needs to that provider. The provider handles that data under its own privacy policy and your agreement with it, not on our instructions. Some providers use content from consumer accounts to train their models unless you turn this off in your account with them. We tell you this when you connect an agent on the web or in Nova Desktop and ask you to check your provider’s settings.

Our commitments on retention and model training in this Part B cover what Instabridge and our processors hold. They do not cover what your agent sends to your own AI provider. That provider’s terms and your settings with it decide how long it keeps the data and whether it uses it for training.

We send data to your provider because you asked us to run your agent (contract). For other people’s data in it, we rely on our legitimate interest in helping you manage your own work.

If your provider account reaches its limit, Nova Agent OS may complete the request with a backup AI model that we pay for. Those requests go through our AI gateway Opper to one of the backup model hosts listed in section B8: DigitalOcean, GreenPT, Fireworks AI or TensorX, and Novita AI only when no other host can serve the model. You can choose the backup model family for each tier in Settings, but you cannot turn the backup off today. These hosts are our processors: they process your content only on our instructions, under data processing agreements, and do not use it to train their models. The Brain never uses the backup model; its AI steps run only through your own agent sign-in.

Our automated reviewer. Before Nova Agent OS asks you to approve an action that reaches outside your cloud computer, a separate AI reviewer may look at the request to see whether it is plainly within what you asked. The reviewer receives the action, the code it would run, what your agent said and called just before, and the approval choices you saved. It never receives what your agent reads from a web page, file or tool, and it can never approve a message to another person. The reviewer is an AI model run for us by Opper, our AI gateway in Sweden, on a model hosted in the USA under terms that forbid training on the data; the review and its outcome are stored on your cloud computer.

B5. Information about other people in your content

Your content can contain information about other people: the people who write to you, meet you or work with you, and people mentioned in your files. We process that information only to do what you ask Nova Agent OS to do with your own work, for example to find, summarise, draft or reply. We do not build profiles or pages about those people, do not assess them, do not work out sensitive details or characteristics about them, never use their information to contact them or to market to them, and do not use it for any purpose of our own. Our legal basis is our legitimate interest, and yours, in helping you manage your own work; we have weighed it against those people’s rights, and they would expect the people they write to or meet to read, file and search what they sent, often with software. 

We cannot tell those people individually that their information is in your content, so we publish this section instead (GDPR Art. 14(5)(b)). Anyone who believes their information is in Nova Agent OS content can write to privacy@instabridge.com to object, to ask what we hold, or to ask for deletion; we need the email address or other identifier under which their information may appear, and we confirm it is theirs before we act. For information in a work account, the organisation that runs the account is responsible, and we forward the request to it.

B6. Your Instabridge Account across Nova Agent OS, Nova Launcher, Eyecon and the Instabridge app

The same Google sign-in gives you the same Instabridge Account in Nova Agent OS, Nova Launcher, Eyecon and the Instabridge app. We use the account identifiers across the apps to identify you, keep your accounts secure, prevent fraud and misuse, and meet our legal duties (contract and legitimate interests). Work accounts are never shared with any other app.

Your Instabridge Account also gives you one AI account that is shared between Nova Agent OS, Nova Launcher, Eyecon and the Instabridge app, so the AI content and settings of that account are available in each app where you are signed in (contract). Each app asks for your consent before it collects context such as apps, calendar or location. The Eyecon caller ID directory is never linked to this account, and Nova Agent OS content is never used for advertising in any app.

B7. AI model training

We do not use your content to train or improve AI models. If we later offer a “Model improvement” setting, it will be off unless you turn it on (consent), it will cover only your own instructions, ratings and corrections, and it will never cover content from your connected services or other people’s data.

B8. Who receives your data, and where

We share your data only with the providers that run Nova Agent OS for us, and otherwise only as described here. Our processors process your data on our instructions, under data processing agreements:

Your AI provider (Anthropic, OpenAI, Cursor or another provider you connect) is not our processor. It receives data from your agent under your own agreement with it (section B4).

Organisations. If you use a work account, the organisation that runs it can see, export and delete the work account and its content.

Others. We disclose data to authorities or courts when the law requires it, to protect people from serious harm, and, under the same protections as in this Privacy Policy, in a merger or sale of the business. A reseller that bills us for cloud services has access to billing only, not to your data.

Transfers outside the EEA. Several providers process data outside the EU and EEA, including in the United States. We protect those transfers with the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise with the European Commission’s Standard Contractual Clauses (2021/914) and a transfer impact assessment. Offsite backups are encrypted before they leave your cloud computer; Google Cloud stores them in Finland and cannot read them, because only two named officers of the Company hold the keys. You can ask for a copy of the safeguards at privacy@instabridge.com.

B9. How long we keep your data

If a restore from an offsite backup ever becomes necessary, we re-apply the record of deletions made since that backup, so that deleted accounts stay deleted. One limit remains: if both our database and the environment that holds the deletion record were lost at the same time, deletions made after the last offsite backup could not be re-applied automatically.

B10. Your rights

You have the rights described in Part A, “Your Rights and Choices”: access, correction, deletion, restriction, objection, portability, and the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, www.imy.se) or to the authority where you live or work. Using them is free. Write to privacy@instabridge.com or to Instabridge Sweden AB, Box 190, 101 23 Stockholm, Sweden.

In Nova Agent OS you can do most of this yourself: export your content from Settings, change or delete content on your cloud computer, disconnect services and agents, and delete your account in Settings.

Work accounts. You cannot delete a work account yourself, and your rights over its content are exercised with the organisation that runs it. If you write to us, we will forward your request to the organisation or help you reach it.

Decisions about your account. We do not make decisions about you by automated means alone that have legal or similarly significant effects. Where an automated signal leads us to throttle, suspend or terminate an account, a person reviews the decision before termination and on your request at any step, and you receive the reasons (Terms of Service, Section 15.i).

United States residents. We do not sell Nova Agent OS data and do not share it for cross-context behavioral advertising. You have the rights to know what data we hold, to correct it and to delete it, as described above.

B11. Security

Each user’s cloud computer is kept separate from other users’ computers. Data is encrypted in transit. Offsite backups are encrypted before they leave your cloud computer, and only two named officers of the Company hold the keys. Our staff do not look at your content. The only exceptions are support that you ask for, security investigations and restoring the service after a failure. Only a small number of named staff can reach the systems that hold your content, that access is reviewed regularly, and access under our support and recovery procedures is logged and kept for 730 days. Our technical logs are designed to contain no content. We do not scan the content of your files, sessions or messages with safety classifiers of our own; our checks work on what an agent is about to do, not on what you wrote. Each agent runs in its own environment, treats what it reads from sources as information rather than instructions, asks you before it sends a message to anyone else, writes to a service outside your cloud computer, deletes data, pays or purchases, or acts on your own computer, and can be stopped at any time. A separate automated reviewer, not the acting agent, checks whether an action that needs approval is plainly within what you asked (section B4). Every connection from your cloud computer to the internet goes through a gateway we run. Writes and sign-ins go only to named services, other websites can only be read anonymously, sign-in headers are removed from web requests, and each connection is recorded. Our own keys for AI gateways never enter your cloud computer; the gateway adds them on the way out. Your AI provider applies its own safety systems to what your agent sends it, under its own terms.

B12. Children

Nova Agent OS is for people aged 18 or over. We ask you to confirm this when you sign up. We do not knowingly process data of anyone younger, and we delete an account if we learn that its holder is under 18.

B13. Cookies, analytics and advertising measurement on novaagentos.ai

Cookies we always use. novaagentos.ai and the Nova Agent OS apps use one cookie, to keep you signed in. It is needed for the service, so it does not require your consent. We measure visits with Cloudflare Web Analytics, which uses no cookies and no identifiers stored on your device.

Advertising measurement, only with your consent. We advertise Nova Agent OS on Google. To know whether those ads bring visitors and sign-ups, novaagentos.ai uses Google’s advertising tag (Google Ads conversion measurement). When you first visit, a banner asks whether you accept it; nothing is set until you choose. If you accept, the tag stores cookies on your device that record that you arrived from a Google ad and whether you later request access, sign up or buy a plan, and sends that information, with your IP address and browser details, to Google Ireland Limited. Google reports the results of our advertising to us and may use the data for its own purposes under its own terms; for that use Google is a separate controller. If you decline, no advertising cookies are set and nothing is sent to Google, and Nova Agent OS works exactly the same.

The advertising cookies are set only on novaagentos.ai, never inside the Nova Agent OS apps or on your cloud computer, and they never carry the content of your files, sessions or messages. Our legal basis is your consent (GDPR Art. 6(1)(a); Swedish Electronic Communications Act, LEK, 9 kap. 28 §). You can change or withdraw your choice at any time through the cookie settings link at the bottom of every page on novaagentos.ai, or by deleting the cookies in your browser; withdrawing does not affect what was processed before. The advertising cookies expire after 90 days, and the conversion data in our Google Ads account is kept for 13 months.

B14. The Brain

The Brain is Nova Agent OS’s searchable memory of your own work. It is off by default. You turn on each source separately, after we show you what Nova Agent OS reads from it, what it keeps and creates, and for how long. The Brain reads a limited, recent set of items from each source you turn on and keeps a copy on your cloud computer so that you and your agents can search it. It does not build pages about other people, assess them or work out sensitive details about them. The Brain is not available in work accounts unless the organisation has turned it on.

The Brain keeps only facts about your own projects, tasks, decisions and commitments, short notes about companies and projects, and your own profile page with your sign-in name, email, picture and chosen role. An AI check runs before any fact or note is saved and refuses assessments of people and health, beliefs or other sensitive details about anyone, including you. If you turn on the Nova AI app context source, the Brain imports the context categories you enabled in the app, such as apps, calendar and location, and the notes you send from the app; it leaves out your address book. The AI steps of the Brain run only through your own agent sign-in, never through the backup model.

Brain items from a connected source are deleted 90 days after the item’s date; context you import from the Nova AI app, 60 days after import; notes and agent memory, when you delete them or your account. Brain backups are kept for 7 days, and encrypted offsite copies for up to 30 days. Search data for Brain items is created by Opper with Microsoft Azure in Sweden (section B8). Turning a source off stops Nova from fetching anything new from it at once. You then choose to delete what the Brain saved from it, or to keep it. If you delete it, the deletion runs the next time your Nova cloud computer starts or syncs, and offsite copies expire within 30 days. If you keep it, those pages stay in your Brain and Nova can still use them until you delete them.

B15. Changes to this Part B, and contact

We update this Part B when Nova Agent OS changes in a way that affects your data. The date at the top shows the latest version. Where a change is to your detriment we tell you at least 30 days in advance by email and in Nova Agent OS. 

Privacy questions and requests about Nova Agent OS: privacy@instabridge.com, or by post to Instabridge Sweden AB, Box 190, 101 23 Stockholm, Sweden. Our data protection officer is reachable at the same address; the external data protection officer listed in Part A can also be contacted for Nova Agent OS.

ANNEX A – SUPPLEMENTAL CCPA PRIVACY NOTICE

This Supplemental CCPA Privacy Notice supplements our Privacy Policy and only applies to our processing of personal information that is subject to the CCPA.

NOTICE AT COLLECTION

At or before the time of collection, California residents have a right to receive notice of our privacy practices. California residents can find this information below.

• Personal Information Collected. See the section of this Supplemental CCPA Privacy Notice titled “Overview of Personal Information Collected, Disclosed, Sold and/or Shared” for a list of personal information which may be collected. If we have previously collected personal information in the past 12 months, we may collect that personal information from you.
• Uses of Personal Information. See the section of this Supplemental CCPA Privacy Notice titled “Uses of Personal Information” for a list of the purposes for which we use personal information.
• Is Personal Information “Sold” or “Shared” for “Cross-Context Behavioral Advertising”? Yes.
• How Long is Personal Information Retained For? We will retain your personal information for as long as you have an account in the Services or for as long as we need to keep any personal information to comply with our legal obligations, resolve disputes, or enforce our agreements. After this your personal information will be deleted. AI Personalisation data is retained for no more than 30 days and is automatically scheduled for deletion. If you disable a category or turn off AI Personalisation, we stop collecting that category and delete related AI Personalisation data according to the same automated schedule, unless a longer period is required by law.
• Additional Information. For more information on our privacy practices, please review this Supplemental CCPA Privacy Notice and our Privacy Policy. Importantly, the section of our Privacy Policy titled “Your Rights and Choices” includes important details about how you can exercise some of the rights which you have under the CCPA.

CATEGORIES OF SOURCES FROM WHICH PERSONAL INFORMATION IS COLLECTED

We collect personal information that you provide to us, personal information we collect automatically when you use the Services, and personal information from third-party sources. If you choose to enable AI Personalisation in the Services, we may collect and use additional personal information only for the categories you specifically opt in to. You can change your selections at any time in Settings.

OVERVIEW OF PERSONAL INFORMATION COLLECTED, DISCLOSED, SOLD, AND/OR SHARED

The CCPA provides California residents with the right to know what categories of personal information Instabridge has collected about them, whether Instabridge disclosed that personal information for a business purpose (e.g., to a service provider), whether Instabridge “sold” that personal information, and whether Instabridge “shared” that personal information for “cross-context behavioral advertising” in the preceding twelve months. California residents can find this information below:

USES OF PERSONAL INFORMATION

We may use and disclose the personal information that we collect for the following business and commercial purposes:

• Processing for purposes described in the “How We Use Information” section of our Privacy Policy;
• Processing related to delivering personalized, cross-context behavioral advertising, as well as marketing communications;
• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;
• Helping to ensure security and integrity to the extent the use of personal information is reasonably necessary and proportionate for these purposes;
• Debugging to identify and repair errors that impair existing intended functionality;
• Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with Instabridge;
• Maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar Services;
• Providing advertising and marketing services;
• Providing AI-powered personalisation features (opt-in); generating personalised AI responses and recommendations, and maintaining and protecting the AI Feature (including security, abuse prevention, debugging, and quality assurance). We do not use AI Personalisation data to train or fine-tune AI models.
• Providing the AI chat (opt-in): generating answers to your messages, keeping your chat history available to you, and maintaining and protecting the chat. We do not use chat content to train or fine-tune AI models, and we do not sell or share it for cross-context behavioral advertising.
• Undertaking internal research for technological development and demonstration;
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by Instabridge, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by Instabridge.

DISCLOSURE REGARDING “SALES” OF PERSONAL INFORMATION AND/OR “SHARING” FOR “CROSS-CONTEXT BEHAVIORAL ADVERTISING”

In the preceding twelve months, Instabridge has “sold” and/or “shared” personal information for cross‑context behavioral advertising purposes. Such activities may involve providing your personal information to trusted third‑party advertising partners, who may use it to deliver targeted advertising across various digital contexts. We make these disclosures in accordance with applicable law. We do not sell AI Personalisation data. We do not share AI Personalisation data for cross-context behavioral advertising as part of the AI Feature.

We do not sell Nova Agent OS data, and we do not share Nova Agent OS data for cross-context behavioral advertising. Nova Agent OS shows no advertising (Part B, section B3).

DISCLOSURE REGARDING OPT-OUT PREFERENCE SIGNALS

Instabridge does “sell” and “share” personal information for cross‑context behavioral advertising. If you do not wish for your personal information to be used for these purposes, you may exercise your right to opt out. To do so, please click on the “Do Not Sell My Personal Information” link available on our website, in the app, or contact us at privacy@instabridge.com. We will process your opt‑out request in accordance with the CCPA and other applicable laws.

DISCLOSURE REGARDING INDIVIDUALS UNDER THE AGE OF 16

Instabridge does not have actual knowledge of any “sale” of personal information of minors under 16 years of age. Instabridge does not have actual knowledge of any “sharing” of personal information of minors under 16 years of age for “cross-context behavioral advertising.”

DISCLOSURE REGARDING SENSITIVE PERSONAL INFORMATION

Instabridge only uses and discloses sensitive personal information for the purposes set forth in Section 7027(m) of the CCPA regulations. For AI Personalisation, we use and disclose Sensitive Personal Information only for purposes permitted under 11 CCR § 7027(m), and only as reasonably necessary and proportionate to provide the AI Personalisation feature you request via specifically opting in to that processing.

NON-DISCRIMINATION

California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.

NOTICE OF FINANCIAL INCENTIVE

This Notice of Financial Incentives aims to inform you about any programs, benefits, and other financial incentive offerings, including price or service differences (collectively, “Incentive Offerings”), that we may provide in connection with the collection of your personal information so that you may make an informed decision on whether to participate in our Incentive Offerings. Such Incentive Offerings may be deemed “financial incentives” under the CCPA.

The material aspects of any Incentive Offering, along with the personal information collected in connection with an Incentive Offering, will be described at the time you are presented with the Incentive Offering.

Examples of our Incentive Offerings may include:

• One-Time Discount. We may offer you a discount on your data purchase or an amount of free data if you provide us your email address and agree to receive marketing communications.
• Refer-a-Friend Program. We may offer a discount on your future purchase when you provide your personal information along with your friends’ or colleagues’ personal information, and they make a purchase. The referred party may also receive a reward in the form of a discount on the first order and/or a free service for making a purchase through your referral.

You can opt-in to an Incentive Offering by following the instructions that accompany the presentation of the Incentive Offering. If you subsequently wish to withdraw from the Incentive Offering, you may request such withdrawal by contacting us as set forth in “Contact Us” above.

Each Incentive Offering may be based upon our reasonable and good-faith determination of the estimated value of such an offer to our business, taking into consideration the value of the offer itself and the anticipated revenue generation that may be realized.

ANNEX B – Supplemental Privacy Statement for individuals who do not have an Instabridge account

This Supplemental Privacy Statement applies to people who do not hold an Instabridge account (referred to here as a “Non-Instabridge user” or “you”). It adds to, and should be read together with, our Privacy Policy.

This Annex B covers caller ID. Information about people who are not Nova Agent OS users but appear in a Nova Agent OS user’s content is covered in Part B, section B5.

What information do we collect about you?

A number of our features involve processing phone numbers — not only those belonging to Instabridge Caller ID users, but in some situations also those of people who do not use Instabridge Caller ID (i.e. Non-Instabridge users). To identify an incoming caller, we look the number up against our directory: where a number is not already saved in the user’s contacts, it is sent to our servers so that we can return a name and spam status. We may also store phone numbers as part of our community directory, as described below. We do not use Non-Instabridge users’ phone numbers for other forms of tracking, including advertising.

How do we use a Non-Instabridge user’s information?

When someone registers for Instabridge Caller ID (referred to as an “Instabridge Caller ID user”, “they”, “their”), they may choose to:

• enable access to their phonebook contacts in order to use the Caller ID feature. In that case, we upload their contacts — each contact’s phone number and the name saved against it — to our servers, where we use them to identify incoming callers and to build and improve our community directory. When a call comes in, we determine whether the number matches one of that user’s saved contacts and, if so, display the saved contact details on the caller ID screen; where there is no match, we identify the number against our directory;
• flag a phone number or an SMS as spam, or otherwise send us feedback. We use what they report to (i) recognise and confirm spam or malicious callers, (ii) provide context about numbers that would otherwise be unknown, and (iii) power features such as spam filtering, fraud protection, and message categorisation. For SMS, we never process the content of the message itself — only a hashed representation and pattern derived from it;
• propose a name for a phone number they have been in contact with, so that callers who were previously unidentified can be recognised by other users through live caller ID. To keep this accurate and protect the wider community, a proposed name is only shown via live caller ID after it has been confirmed by input from the community.

In these situations we will not notify you individually, as permitted under Article 14(5)(b) of the GDPR. We do, however, put suitable safeguards in place to protect your rights, freedoms, and legitimate interests, which includes making this statement publicly available.

What is our legal basis for this processing?

This processing is carried out on the basis of our legitimate interests and those of our users. In practice, this means our interest in running and delivering the Instabridge Caller ID service, and in keeping it safe and trustworthy by maintaining a community-driven directory of spam and fraudulent numbers, together with our users’ interest in being able to identify the people who contact them more easily.

Retaining Non-Instabridge user information

We only retain Non-Instabridge users’ phone numbers in the limited situations described above, and only for as long as needed to deliver the services that Instabridge Caller ID users have requested. Appropriate security measures are maintained to guard your personal data against unauthorised access, loss, or destruction. Where we retain name suggestions or numbers reported as spam, we erase them no later than two years after the suggestion was made or the spam report was submitted by an Instabridge Caller ID user.

How Non-Instabridge users exercise their data subject rights

You are entitled to all of the rights set out in the “Your Rights and Choices” section above. To correct the name shown for your number, remove your number from Instabridge Caller ID so that it is no longer visible to other users, or to exercise any of your other rights, contact us at privacy@instabridge.com.

Automated decision making and profiling

Delivering our Services sometimes relies on automated processing, which may make use of artificial intelligence (AI) or machine learning. Through this, we build spam and likely-fraud profiles in order to surface information about callers and SMS senders and to warn users about possible spam or fraud — and such profiles may relate to a “Non-Instabridge user”. Our automated systems examine patterns across the calls and messages that Instabridge Caller ID users receive or report, which helps us build these profiles and identify abuse such as spam or fraud. For SMS, this analysis is performed on a hashed representation and pattern of the message rather than its content. We likewise develop and train AI models on user reports to spot fraudulent and spam SMS messages. This enables faster, more consistent decisions and lets us work through very large volumes of data. Whenever we rely on AI systems, we maintain appropriate security measures to protect personal data against unauthorised access, loss, or destruction.

If you believe our spam classification is incorrect, or you would like your number removed from our search database, please contact us at privacy@instabridge.com.