How Instant handles your data.

Who we are

Instant is a product of Light (Light Company ApS, CVR 43523503, Skelbækgade 2, 6th floor, 1717 København V, Denmark). Light is the data controller for your account, for this website and for our marketing.

The records your company keeps in Instant, such as its books, documents, invoices and the mail Instant reads for it, belong to your company. For those, your company is the controller and we process them on its behalf, under the data processing terms in our Terms.

Write to hello@light.inc for anything about your data.

What you give us

• Your account. Your name, phone number, email address, the company you work for, your role, your language and your time zone.
• Your company. Its name, registration and VAT numbers, address, owners and other details you or Instant fill in during setup.
• What you send Instant. Your messages in any channel, what you say in voice mode, and the files, photos, receipts and documents you share. When you use voice, your speech is processed live to answer you, and what was said is kept in the thread like a written message.
• Payments. When you buy credits or a plan, Adyen handles your card or bank details. We see the payment's status and the last digits of the card, never the full number.
• Support. What you write when you ask us or Instant for help.

What Instant handles while it works for you

Instant does the work you ask for: it books bills, sends invoices, reconciles the bank, files returns and buys things for your company. What it can reach depends on what you connect and on your role in the company. That can include:

• your mailbox and calendar (Gmail, Google Calendar, Outlook), when you connect them;
• your bank transactions, through the bank feed you connect;
• your company cards and their transactions;
• letters from e-Boks and Digital Post, and your accounts with tax authorities such as Skat or Skatteverket, when you set them up;
• e-invoices sent and received through networks such as Peppol;
• your Shopify store's orders and Shopify Payments payouts, when you connect the store;
• other apps and services you connect to Instant, and websites Instant visits for you in its browser.

When you connect your Shopify store, Instant reads its orders (amounts, tax, shipping, discounts, dates, payment status and payment method) and its Shopify Payments payouts and their transactions. It does not read or keep your store's customers' names, email addresses, phone numbers or addresses, and never changes anything in your store. When you remove Instant from the store, Instant deletes what it copied from Shopify when Shopify asks, 48 hours later; your books stay.

Bookkeeping data is about people too: your customers, vendors and employees, with names, bank details, salaries and expenses. Documents sometimes hold sensitive details, such as a medical bill or a payslip. Instant uses all of this only to do the work for your company.

When a sign-in is needed, such as MitID, you complete it yourself in the live view. Instant keeps that session in your company's browser so it can return, and never types your passwords or verification codes.

Instant remembers what you tell it about how you like things done, so you don't have to repeat yourself. Ask it what it remembers, or to forget something, at any time.

Your data is never used to train or fine-tune AI models.

Your Google and Microsoft accounts

When you connect Gmail, Google Calendar or Outlook, Instant can search and read your mail and attachments, draft, send and archive messages, and read and manage calendar events. It does this when you ask, or on a routine you set up.

• Only for the work you ask for. We use this data only to provide the features you use in Instant. It is never used for advertising, never sold, and never used to train AI models.
• Private to you. Your colleagues in Instant cannot read or send from your connected account.
• People don't read it. Our team does not read your mail unless you ask us to, to keep Instant secure, or where the law requires it.
• Disconnect any time. Disconnect under Apps to delete the stored credentials, or revoke access in your Google or Microsoft account. What Instant already saved into your books, such as a bill from an email, stays there.

Instant's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we collect automatically

• Device and log data. IP address, device, operating system, browser, time zone and the times you use Instant.
• Usage. Which windows and features you open, and errors you run into. Error records are kept for 90 days.

We don't track your precise location.

What we get from others

• Public business registers, such as CVR in Denmark, Bolagsverket in Sweden and Companies House in the United Kingdom, to set up your company.
• Google or Microsoft, your name and email, if you sign in with them.
• A colleague who invites you, your phone number or email address and the role they give you.
• Your bank, card and payment providers, the transactions and statuses Instant needs for your books.

Disconnecting a service stops new data from it. It does not remove what is already in your books.

How we use it, and why we may

• To give you Instant and do the work you and your company ask for. For your account, that is our contract with you (GDPR article 6(1)(b)). For your company's records, we act on your company's instructions as its processor.
• To keep Instant secure, prevent fraud and abuse, and fix what breaks: our legitimate interest (article 6(1)(f)). When something fails, our team may look at the error and the steps around it.
• To improve Instant, from how features are used, in aggregate: our legitimate interest.
• To send you messages about your account, your credits and changes to Instant: our contract with you.
• To bill you and keep our own accounts, and to answer authorities: our legal obligations (article 6(1)(c)).
• To market and measure Instant, as described below: your consent or our legitimate interest, as each part says.

We may turn data into aggregated or de-identified statistics, such as how many companies use a feature. We don't try to re-identify anyone from them.

Cookies and measurement on this site

When you first visit this site or our sign-up page, you see a banner with two equal choices: Accept or Decline. Until you choose, and if you decline, no marketing or analytics cookie is set.

• Google Analytics 4. Measures visits and which pages people read. Without your consent it runs in consent mode: it sets no cookies and sends Google only cookieless pings, which Google uses to estimate visits in aggregate. With your consent it sets its own cookies (_ga) for up to 2 years. Provider: Google Ireland Ltd.
• Meta pixel. With your consent, Meta (Facebook and Instagram) learns which of our pages you visited and whether you signed up, so we can measure our ads and show them to people like you. The pixel sets the _fbp cookie for 90 days. When you sign up and you accepted cookies, we may also send that sign-up to Meta from our server (Conversions API): your phone number hashed, your IP address and browser type as they are, and Meta's own _fbp and _fbc cookie values, which identify the ad click. Nothing is sent if you declined or did not choose. Provider: Meta Platforms Ireland Ltd.
• Google Ads (when we run ads there). With your consent, Google learns which of our ads led to a visit or a sign-up, using _gcl_* cookies for up to 90 days. We will add it to the cookie banner before it goes live. Provider: Google Ireland Ltd.
• TikTok and LinkedIn. If we advertise there, their pixels work the same way and are only loaded with your consent. We will list them here and in the banner before they go live.
• Ad attribution. When you arrive from one of our ads, the campaign tags and the ad's click id in the link (utm_*, gclid, fbclid) are kept in your browser tab and passed to the sign-up page. When you sign up, the tags are stored with your account, and the click id too if you accepted cookies (see What brought you to Instant). They are only shared with Google or Meta if you accepted cookies.
• Essential cookies. instant_consent remembers your choice for 12 months. instant-theme and instant_lang remember your display mode and language for 12 months. The Instant app sets a sign-in cookie to keep you signed in. These need no consent.
• Our own count. We also count page views and cookie-banner choices without setting cookies or recording personal data: only the page address with its campaign parameters and the choice are sent to Google Analytics.

This website is served by Vercel. It uses the country of your IP address to show the right language and does not keep it. The site does not respond to browser "Do Not Track" signals; use the cookie choice instead.

Change your mind any time with the Cookies link in the footer of every page. A new choice applies from the next page you load; to remove cookies already set, clear them in your browser. Declining never limits what Instant does for you.

What brought you to Instant

When you sign up, when you write to us on WhatsApp from one of our ads, and if you answer our question about how you heard of us, Instant records in its own database how you found us, so we can tell which of our ads, emails, partners and friends bring new customers:

• For everyone: the campaign tags in the link you arrived with (utm_source, utm_medium, utm_campaign, utm_content, utm_term and the ad's id), the name of the website that sent you (for example google.com, never the page), whether you signed up yourself, were invited or wrote to us first, when you signed up, and your cookie choice at the time.
• Only if you accepted cookies: the click ids of ads you clicked (Google gclid, gbraid and wbraid; Meta fbclid; TikTok ttclid; Microsoft msclkid), from the link you arrived with and from the Meta (_fbc) and Google (_gcl_aw) cookies; for a cookie, also the time of the click, if it was within the last 90 days.
• If you write to us on WhatsApp from one of our ads: the ad's id, link and headline, Meta's click id for it, and the time.
• If you tell us how you heard about us: when you set up a new company in Instant, we ask once, in your first two weeks; answering is optional. We store the option you pick and anything you add in your own words, which may include names, emails or phone numbers (yours or someone else's) that you choose to mention.
• If someone referred you: who it was, when, and how it was recorded (their link, their code, or you named them when we asked).

We do not store your IP address for this, and this record is not sent to ad platforms. It is kept as long as your account exists and deleted with it.

Why we may: recording what brought you is our legitimate interest in knowing which of our marketing works, and you can object at any time. Ad click ids read from links and cookies in your browser are only recorded with your consent; the click id Meta passes to us with a WhatsApp message you send after tapping our ad is recorded on our legitimate interest. Cookies and pixels are set only with your consent (article 6(1)(a) and the ePrivacy rules of your country).

Advertising audiences

We advertise, or may advertise, on Meta, Google, TikTok and LinkedIn. To do that we may share with those platforms, in hashed form, the phone numbers and email addresses of people who signed up for Instant, so the platform can show them fewer ads, or find people similar to them. We never share the contents of your books, your transactions, your mail or your documents with an ad platform. This is our legitimate interest in reaching people like our customers. You can object at any time by writing to the address above; we then remove you from those lists within 30 days.

Text messages (SMS)

When you sign up with your mobile number and agree to receive texts, Light Company ApS, operating as Instant, uses that number to send you sign-in codes, a welcome message, replies to the requests you text Instant, and account notifications. Message frequency varies, and message and data rates may apply. Reply HELP for help, or STOP to opt out at any time. The full SMS terms are in our Terms.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

When we contact businesses

We sometimes write to newly registered businesses and to people who run small businesses to tell them about Instant. For that we use public business registers (for example Bolagsverket in Sweden, Companies House in the United Kingdom and the CVR register in Denmark) and the contact details a business publishes about itself. We only do this where the law of your country allows it, and we respect the rules for sole traders, who are protected as individuals in many countries. Every email we send says who we are, links to this page, and lets you stop further messages with one click. We do not send marketing by SMS or WhatsApp to anyone who has not asked for it.

If you are a creator or influencer we would like to work with, we may contact you through the public channels you use for business.

Both are our legitimate interest in telling businesses about Instant, within the marketing law of each country.

Who we share it with

We never sell your data. We share it only in these cases:

• The people in your company see your company's data as their role allows. An auditor with read access cannot change anything. Your connected mailbox stays private to you.
• Those Instant deals with for you. When you ask, Instant sends data where the work needs it: a VAT return to the tax authority, a payment to your bank, an invoice to your customer, a reply to your vendor, an order to a shop.
• Our service providers, who process data for us under contract and only on our instructions. They are listed below.
• Ad platforms, only as described in the cookie and advertising sections above.
• Light's group companies, such as Light's UK company, to support and sell Instant.
• A buyer, if Light or Instant is merged, acquired or sold, under the same protections as this policy.
• Our advisers, such as auditors, lawyers and accountants, under confidentiality.
• Authorities, when the law requires it, or to protect people, prevent fraud or defend legal claims.

Where your data is stored

Instant stores your company's data, your conversations and your connected-account credentials in the EU. Some providers above, such as OpenAI, Twilio, Slack, Plaid, Vercel, Google and Meta, may process data in the United States or elsewhere outside the EU. When they do, the transfer is covered by the EU-US Data Privacy Framework or the EU's standard contractual clauses, with the UK extension for UK users.

How long we keep it

• Your account, while it is open.
• Your company's records, while your company uses Instant. When your company leaves, we delete them within 90 days. Export your books first: you often have a legal duty to keep them for several years.
• Our own billing records, for as long as bookkeeping law requires, 5 years in Denmark.
• Error records, 90 days. A deleted table can be restored for 30 days, then it is gone.
• Backups are overwritten on a rolling basis.
• Marketing data: Google Analytics data is deleted after 2 months. Contact details of businesses we wrote to are deleted 12 months after our last contact if you never replied, and at once if you ask us to stop. Sign-up data used for ad audiences is removed within 30 days of you leaving Instant or objecting. Cookies expire as listed above.

Your rights

You can ask us what we hold about you, have it corrected, deleted or restricted, receive a copy in a portable form, object to marketing and to any processing based on our legitimate interest, and withdraw consent at any time without affecting what happened before. Ask Instant, or write to hello@light.inc. We answer within a month.

If you ask about records your company keeps in Instant, such as an invoice addressed to you, we pass your request to that company, because it decides about them.

You can also complain to your local data protection authority, for example Datatilsynet in Denmark, IMY in Sweden or the ICO in the United Kingdom.

Keeping it safe

Your data is encrypted in storage and in transit. Messages are encrypted before they are stored. Connected-account credentials are encrypted and never shown to the AI or your browser. Each company's data is kept apart, Instant only gets the tools your role allows, and every action is logged.

Instant acts for you, so a few risks are worth knowing:

• It can make mistakes. It may misread a document or post to the wrong account. Every action shows on the thread of the object it changed, so you can check and undo.
• It only acts on your request. Sending, paying, buying, filing and signing need your instruction. For routines, choose "Ask me before each run". Instant makes no automated decisions with legal or similarly significant effects on your company's own customers, including your Shopify store's customers.
• Others may try to instruct it. An email or a web page can contain text written to mislead an AI. Instant treats what it reads as information, never as permission.

No system is perfectly secure. If you find a vulnerability, tell us at hello@light.inc.

Children

Instant is for businesses and is not meant for anyone under 18. We don't knowingly collect children's data. If we learn that we have, we delete it. A parent or guardian can ask us to at the address above.

Other websites and services

Services you connect to Instant, and websites Instant visits or links to, have their own privacy policies. We are not responsible for how they handle your data.

Changes to this policy

When we change this policy, we update the date at the top. Before a change that matters to you takes effect, we tell you in Instant or by email.