Last updated: August 9, 2026
See also the sub-processor list and Data Processing Agreement for more detail than fits here.
The Service is provided by inis.run, an independently owned business established and operating in Ireland; our full legal and registration details are available on request from legal@inis.run. We are the data controller for the personal data this policy describes — your account, billing, and security data. For data you process inside your own sessions (your end users’ data, for example), you are the controller and we act as your processor under the Data Processing Agreement. For anything in this policy, contact privacy@inis.run.
We do not inspect, read, or log the content of the code you run or the data flowing through a session, by default and by design.
That claim has one honest exception: it describes what we don’t look at, not what we don’t store. If you explicitly save a checkpoint or a template, that saved state — memory and disk — is retained because you asked us to keep it, until you delete it or your account is closed. A session you destroy has its memory and disk deleted. A session that idles out, or reaches its maximum lifetime, is paused instead: its state is preserved, encrypted and in the EU, until you resume it, delete it, or its paused-retention window expires, at which point it is destroyed. We separately record minimal operational metadata about the session itself (duration, resource allocation, and billing metrics) — not its contents.
We collect only the information necessary to provide, bill, and protect the Service:
Legal basis for processing (relevant if you are in the EEA/UK): account and billing data is processed to perform our contract with you (GDPR Article 6(1)(b)); security and abuse-detection logs are processed under our legitimate interest in keeping the Service safe and available (Article 6(1)(f)); anything else requiring consent is only processed with it. We do not use personal data for automated decision-making that produces legal or similarly significant effects.
The infrastructure that runs your sessions — compute, control-plane database, and object storage for checkpoints and templates — runs on EU infrastructure we operate at Scaleway, in the European Union (currently Paris, France). That infrastructure is EU-owned, operated by an EU company with no US parent, and outside the reach of the US CLOUD Act.
Transactional email (sign-in codes, team invitations, account notices) is sent through Scaleway’s EU transactional-email service, region fr-par. The software has no non-EU email provider to fall back to.
Payment processing (Stripe) is different: we have not yet confirmed the exact data-processing location for our account, so we do not claim it is EU-only until we have. See the sub-processor list for the specifics on both, and for GitHub/Google — if you choose to sign in with one of those instead of email, your account ID and verified email necessarily pass through that provider’s own infrastructure (not ours, and not EU-pinned) as part of using their sign-in button. That is inherent to offering third-party sign-in and is a separate thing from our own hosting choices.
Under the General Data Protection Regulation, you have the right to:
To exercise any of these rights, contact us at privacy@inis.run. We will respond within one month, as required by the GDPR.
If personal data is processed inside your own sessions (your end users’ data, for example), we generally cannot act on a rights request about it ourselves — we don’t inspect session content, so you, as the controller of that data, are best placed to locate and respond to it. Where a request needs action on infrastructure we control (deleting a specific session, checkpoint, or template), we will assist. See the Data Processing Agreement for how this works when we act as a processor on your behalf.
We keep the number of third parties who touch your data small on purpose:
The full sub-processor list, with the specifics of what each one does and does not see, is at inis.run/security/subprocessors. We do not sell personal data, and we do not use an analytics, advertising, or CRM broker — all operational metrics and logs are self-hosted on our own infrastructure.
Our current Data Processing Agreement draft is at inis.run/security/dpa — the facts on that page are accurate today; a few business terms are still marked as pending legal review. Want a signed DPA now? Email legal@inis.run and we will work through it with you directly. We will give at least 30 days’ notice, by email or in-product notice, before adding or replacing a sub-processor that processes personal data, so you can object — and, if we cannot resolve the objection, stop using the Service and close your account before the change takes effect.
The infrastructure that runs your sessions does not, by design, transfer session data outside the EU. Where a sub-processor’s own processing involves a transfer outside the EEA/UK — see Section 4’s note on Stripe and transactional email — we rely on an appropriate GDPR Article 46 transfer mechanism, such as Standard Contractual Clauses, once that transfer is confirmed. We will not assert SCCs are in place for a transfer we have not confirmed exists.
If we become aware of a personal data breach affecting your account information, we will notify the Irish Data Protection Commission within the timeframe the GDPR requires, and notify affected customers without undue delay. If the breach involves data you hold as controller inside your own sessions, we will notify you as the controller so you can meet your own obligations — see the Data Processing Agreement.
inis.run does not use advertising, marketing, or behavioral tracking cookies.
We only use essential, first-party technical cookies necessary to keep you securely signed in to your account. Because we do not perform tracking or run third-party analytics scripts, we do not require, and do not show, a cookie consent banner.
We may update this policy as the Service evolves, and will post each revision here with an updated “Last updated” date. For a material change — a new category of data collected, a new purpose for processing, or a change to retention or residency commitments — we will notify you by email or in-product notice before the change takes effect.
Questions? Reach out to privacy@inis.run.