Instruxi Privacy Notice
Version: 2.0
Last Updated: 23 October 2026
Document Owner: Data Privacy Manager
1. Introduction & Who is Responsible
Instruxi Limited (“Instruxi”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Notice covers the GVNR plugins on your computer, the Enforcer servers, the GVNR connector you add to an AI chat, optional AI judgment by TypeSafe, our websites (including instruxi.io and gvnr.io), and how we manage our business operations under the UK General Data Protection Regulation (UK GDPR).
Instruxi Limited (UK company number 13781404) runs GVNR and Enforcer. Depending on how you interact with our services, our legal responsibilities differ:
As a Processor (Organization Workspaces): When an organization sets up an Enforcer workspace and invites its team, the organization decides what the workspace is for and acts as the Data Controller. We process that data as their Processor. If your employer runs your workspace, you should ask them how they use it.
As a Controller (Everything Else): We are the Data Controller of your account details (email and sign-in records), a workspace you use individually, billing information, security records, and our websites. In the Public workspace, Instruxi acts as the administrator.
2. Our “Local-First” Privacy Commitment
GVNR is designed as a secure AI agent management and governance tool. A core tenet of our architecture is that the GVNR command-line interface (CLI) operates locally on your machine. We do not collect, monitor, or access your proprietary API keys, the prompts you send to your AI models, or the specific operational data processed by your local AI agents (unless you explicitly share them in a shared plan or upload a file). Local deployment ensures that proprietary keys and sensitive data remain secure on your own hardware.
3. The Data We Collect and How Our Products Work
3.1. The GVNR Plugins on Your Computer
Until you sign in, the GVNR plugin keeps everything on your computer and makes no network calls. Data kept locally includes your agent’s running state, the full text of your last prompt (used to calculate cost), and your settings.
Once you sign in, the plugin sends a “receipt” for each decision to your workspace. This includes:
The verdict, the rule, the tool, the model, tokens, spend, the project name, and your email address as the operator.
It does not include your command text, file contents, or prompts.
3.2. Shared Plans and the GVNR Connector
When you use shared plans in Claude Code or other AI apps, the plugins track the tasks you hold, the commands you run, and their exit codes. The GVNR connector in your AI chat shows your teammates’ task titles and who holds each task. It never returns anyone’s cost, spend, prompts, idle time, or email address to other teammates.
3.3. Product Telemetry & Usage Data
To understand product adoption and improve our ecosystem integrations, the GVNR CLI and Enterprise cloud tiers collect basic telemetry data. This includes email domains, installation environments, usage frequency, CLI version, operating system, and crash reports. We track telemetry from free CLI users to detect adoption signals (such as multiple active users within a single organization) to proactively engage organizations regarding enterprise capabilities.
3.4. Website Data
When you visit our websites, we automatically collect technical data to ensure security and optimize performance. This includes:
Visit Counts: We count visits without using cookies. We record the linking site, campaign tag, and a short, pseudonymous code based on a hash of your IP address and browser string.
HubSpot Analytics: Only if you explicitly consent, we use HubSpot to analyze site traffic, which sets cookies and logs your IP address, browser fingerprint, and screen size.
Google Fonts: Pages load fonts from Google Fonts, which means Google receives your IP address and browser details.
3.5. AI Judgment by TypeSafe (Jev)
This feature is strictly optional and is off by default unless an admin of your workspace turns it on. If enabled, Enforcer sends TypeSafe the data it needs to judge work on a plan, including the run’s report, evidence (commands, outputs, file paths), and acceptance criteria. We apply strict data minimization, but if personal data is included in the evidence or notes, it will be transmitted to TypeSafe.
4. Purposes and Legal Basis for Processing
We will only use your personal data when the law allows us to. Below is a breakdown of why we process your data and the legal basis we rely upon.
Running GVNR: processing decisions, the receipt record, shared plans, sign-ins, and delivering technical support. Legal basis: Performance of a Contract. (For an organization’s workspace, we act on their instructions as their processor).
Product-Led Sales & Marketing: Analyzing telemetry to identify when multiple developers at the same company are using the tool, feeding our sales pipeline. Legal basis: Legitimate Interests (to execute our B2B growth strategies and identify potential enterprise customers).
Security & Compliance: Monitoring for fraudulent activity, preventing abuse, keeping the record tamper-evident, and enforcing our licenses. Legal basis: Legitimate Interests (network security, administration, and protection of our intellectual property).
Optional Features: OpenTelemetry, AI Judgment (TypeSafe), or setting marketing cookies (HubSpot). Legal basis: Consent (for cookies) or Contract/Processor instructions (for features activated by you or your admin).
Billing and tax records for paid workspaces. Legal basis: Performance of a Contract and Legal Obligations.
5. Data Sharing and Subprocessors
We do not sell, rent, or trade your personal data. We share your information with trusted third-party subprocessors who assist us in operating our business:
DigitalOcean: Hosts the Enforcer databases and file storage (based in the New York region, USA).
Cloudflare: Provides network routing, bot protection, and security.
Vercel: Hosts and serves our website front-end and analytics counter.
Stripe: Processes payments and billing for paid workspaces.
TypeSafe: Processes AI judgment and plan evaluations (only if activated by a workspace admin).
HubSpot & SendGrid: Manages CRM, marketing analytics, and transactional email delivery.
6. International Data Transfers
Our core infrastructure, including Enforcer’s databases and file storage, is located in the United States (via DigitalOcean). Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by relying on valid legal transfer mechanisms. Specifically, we rely on the UK Extension to the EU-US Data Privacy Framework (where the provider is certified) or we execute the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses with our subprocessors.
7. Data Retention
7.1. Retention Periods
Account sign-in sessions: Deleted 24 hours after they end.
Failed sign-in attempts: Deleted after 14 days.
OpenTelemetry logs (if enabled): Deleted after 90 days.
Telemetry for analytics (sales outreach): Aggregated or anonymized when it is no longer needed to track active account signals.
7.2. Retention of Cryptographic and Audit Records (Append-Only)
Due to the nature of our service, certain categories of data—such as cryptographic receipts, approval records, billing-related records, and workspace audit trails—are maintained as append-only records. We do not support automatic deletion of these records because they are strictly necessary to ensure the operational and legal integrity of the workspace.
Handling Erasure Requests: When you submit a valid request for erasure, we cannot delete immutable receipts. Instead, we will pseudonymize your personal data, restrict access, and implement cryptographic erasure where technically feasible, while retaining the underlying non-identifiable receipt data required for system integrity.
8. Your Legal Rights
Under UK data protection laws, you have rights in relation to your personal data, including the right to:
Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete data.
Erasure: Request deletion of your personal data (subject to our append-only limitations described in Section 7).
Restriction & Objection: Object to our use of telemetry for sales outreach, or request the restriction of processing.
Data Portability: Request the transfer of your data to another organization.
You can also take action yourself locally. Using CLI commands like shipOn and policyOn stops the plugin from sending receipts and policy questions. Running /enforcer:governor telemetry off stops OpenTelemetry. Deleting the local ~/.config/enforcer and ~/.enforcer directories removes local records and your sign-in token.
9. Contact Details and Complaints
If you have any questions about this Privacy Notice, our data practices, or wish to exercise your rights, please contact our Data Privacy Manager.
Email Address: sales@instruxi.io
Entity: Instruxi Limited (UK company number 13781404)
Postal Address: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ
If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk).