Instatus – Privacy Policy

Last updated October 29, 2026
The privacy of your data, and it is your data, not ours, is a big deal to us. This policy explains what personal data Instatus collects, why, who we share it with, and the choices and rights you have. We'll never sell your personal data.
Instatus, Inc. ("Instatus", "we") is a Delaware corporation. Our mailing address is 9450 SW Gemini Dr PMB 30900, Beaverton, Oregon 97008-7105, USA. You can reach us about privacy at privacy@instatus.com.
This policy covers instatus.com, the Instatus dashboard, our mobile apps, our APIs and integrations, and instatus.com/now. The Instatus Out macOS app has its own privacy policy.
We are the controller of the personal data we collect to run our own business: your account, billing, support conversations, our websites and our marketing. This policy describes how we handle that data.
We are a processor for the data our customers put into Instatus. That includes their status page content, the people who subscribe to their status pages, their on-call contacts and their monitoring data. Our customer decides how that data is used, and our Data Processing Addendum governs how we handle it. If you subscribed to a company's status page, or you're on a customer's team, that company's privacy policy applies, and you should contact them first to exercise your rights. We'll help them respond.
Account information. When you sign up, we collect your name, email address, password (stored only as a salted bcrypt hash), and your team or company name. If you sign in with Google, GitHub or single sign-on, we receive your name, email address and an identifier from that provider. You may also add a phone number, profile picture, time zone and language.
Billing information. Payments for self-serve plans are handled by Paddle, our reseller and Merchant of Record. Your card details go directly to Paddle and never touch our servers. We receive your billing contact, country, tax details, plan and payment history.
Usage and device information. When you use Instatus, we log things like IP addresses, browser and device type, pages and features used, actions taken in your team (such as who published an incident), and errors. Our mobile apps also send a push notification token if you allow notifications.
Support and communications. When you write to us, we keep the conversation and the contact details you used. If you subscribe to our newsletter or product updates, we keep your email address and whether you opened them.
Website visitors. Our websites use cookies and similar technologies, described below.
Information from others. If someone invites you to their team, we receive your email address from them. If you join through a referral or affiliate link, we learn which partner referred you.
We don't make decisions about you that have legal or similarly significant effects based solely on automated processing.
Instatus uses AI providers to translate, summarize and draft content and to detect abuse. Some of this happens automatically as part of the Service, for example refreshing an incident's summary when the incident changes, which sends its updates, timeline and responder names to the provider. Other features run only when you use them. See our subprocessors page for what each provider does. We don't use your data to train AI models, and our AI providers are contractually prohibited from doing so.
We'll never sell your personal data, and we won't use your name or your company's name in marketing without your permission. We only share personal data:
We use a small number of cookies and similar technologies:
Your choices. On instatus.com, including Help and Now, and in the dashboard:
We save your choice in a cookie for six months, and it applies to instatus.com and the dashboard.
Instatus status pages don't use marketing cookies of ours. A customer may add their own analytics to their status page, under their own privacy policy.
You can also block or delete cookies in your browser settings, and opt out of Google Analytics with Google's opt-out add-on. Blocking necessary cookies may stop parts of Instatus from working.
We protect personal data with encryption in transit, encryption at rest for our primary database and backups, multi-factor authentication, access controls and monitoring. Read more in our security overview. If a breach affects your personal data, we'll notify you and the relevant authorities as the law requires.
We're based in the United States and store data primarily in the United States. Our team works remotely from several countries, and our service providers may process data in the countries listed on our subprocessors page. When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and the UK and Swiss equivalents, together with additional safeguards where needed.
Wherever you live, you can ask us to access, correct, export or delete your personal data, and you can stop marketing emails at any time. Many of these things you can do yourself in your account settings. Depending on where you live, you may also have these rights:
EEA, UK and Switzerland. You can access, correct, erase, restrict or port your personal data, object to processing based on legitimate interests, and withdraw consent at any time without affecting earlier processing. You can also complain to your local data protection authority, although we'd appreciate the chance to help first.
California and other US states. Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws can request to know what personal data we collect and how we use and disclose it, and to access, correct, delete and receive a copy of it. In the last 12 months we collected the categories described in What we collect: identifiers, commercial information, internet activity, approximate location from IP addresses, and professional information, f