Legal
Privacy policy
Last updated 5 November 2026.
Instalo helps UK recruitment agencies agree placement fees with their clients, invoice them and collect payment. This policy explains what personal data Instalo holds, why, who it is shared with, how long it is kept, and the rights you have. It covers this website, including the pilot questionnaire, and the Instalo apps.
Who we are
Instalo is run by Leon Ashmead, trading as Instalo, in the UK.
You can contact us about this policy or your data at [email protected].
Who is responsible for what
- Instalo is the controller of its own users' account data: the people at agencies who use Instalo, and client contacts once they have a login.
- Each agency is the controller of the data it puts into Instalo about its candidates and its clients. Instalo processes that data on the agency's behalf, under the data processing terms in our agreement with the agency. If you are a candidate, contact the agency that placed you about your data; we will help them answer you.
What we hold
People at agencies
- Your name, email address, phone number, agency and role.
- Your login: your email address, a hash of your password (never the password itself), and for each signed-in session the IP address and browser it came from.
Agencies
- Company name, legal form, registered address and VAT number.
- Bank account details, encrypted when stored. The apps only ever show the last four digits; the full number is used only to print it on the agency's invoices.
Clients and their contacts
- The client company's name and billing address.
- Each contact's name, email address, phone number and job title.
Candidates
For each placement, the agency enters the candidate's name, job title, salary and start date. Candidates do not use Instalo. These details are used only to work out the fee and to produce the invoice.
Invoices and payments
- Each invoice's bill-to name, email and address, its amounts, and a stored PDF copy.
- From Stripe, our payment provider: each agency's Stripe account status, the last four digits and bank name of its payout account, and the identifiers and status of each client's payment method and direct debit mandate.
- Card and bank account numbers used to pay stay with Stripe. Instalo never receives or stores them.
- Messages Stripe sends us about payments, which can include a payer's name, email address, billing address and the last four digits of their card. We keep these encrypted and delete them after 35 days.
The pilot questionnaire
If you fill in the questionnaire on our pilot page, we hold your name, your agency, your email address, your phone number if you give it, your answers, and which link brought you to the page (for example a LinkedIn post). The form is run for us by Tally.
How you use Instalo
We record which pages are visited and which actions are taken, to understand how Instalo is used and to fix problems. You are identified only by Instalo's own id for you, never by your email address, and ids in page addresses are removed before anything is sent. In the live service we also record sessions with every piece of text, every input and every element's attributes masked, so a recording shows layout, clicks and navigation, not what was on your screen.
Why we use it
| What for | Lawful basis |
|---|---|
| Running your account and the service: placements, approvals, invoices, payments and payouts | Performance of our contract with you or your agency |
| Processing candidate and client data for agencies | On the agency's instructions, as its processor |
| Keeping invoices and the records they need | Legal obligation (UK tax law) |
| Checking identity for payments (Stripe's know-your-customer checks) | Legal obligation, carried out by Stripe |
| Security, preventing fraud, and fixing errors | Legitimate interests in keeping the service safe and working |
| Product analytics and masked session recordings | Legitimate interests in improving the service |
| Reading pilot questionnaire answers to decide what Instalo does first, and replying to your enquiry | Legitimate interests in shaping the product and answering you |
| Contacting you about taking part in the pilot | Your consent, given on the form; you can withdraw it at any time |
| Emails about your account, invoices and payments | Performance of our contract; we do not send marketing from the apps |
Who we share it with
We use these providers to run Instalo. Each acts on our instructions under a written agreement.
| Provider | What for | Where |
|---|---|---|
| Stripe | Payments, payouts and identity checks | UK, EU and US |
| DigitalOcean | Hosting, databases, file storage and logs | London, UK |
| Mailgun | Sending email, including invoice PDFs | EU |
| PostHog | Product analytics and masked session recordings | EU |
| Sentry | Error reports, with personal data removed | EU |
| Better Stack | Logs and alerts from our servers, with personal data kept out | EU |
| Tally | The pilot questionnaire on our website, and its answers | EU (Belgium) |
If an agency connects its accounting software (Xero), Instalo sends that software the agency's invoices, their bill-to details and the payments against them. The agency chooses to do this and can disconnect at any time.
We do not sell personal data, and we do not share it for advertising.
Transfers outside the UK
Where a provider handles data outside the UK, the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum, with the provider's own safeguards.
How long we keep it
| Data | How long |
|---|---|
| Account, client and placement records | While the agency's account is open, then 12 months after it closes |
| Invoices and the records they need | 6 years, as UK tax law requires, even after an account closes or a deletion request |
| Something deleted in the app (for example a contact or a placement) | Hidden at once; its personal details are removed 90 days later, so a mistake can be undone |
| Your data after you ask us to erase it | Removed within 30 days of your request |
| Payment messages from Stripe | 35 days |
| Pilot questionnaire answers | 12 months, or until the pilot ends if your agency doesn't take part |
| Internal messages between Instalo's services | 3 days after they are processed; 30 days for ones that failed |
| Signed-in sessions | Until you sign out or the session expires (7 days) |
Removing personal details means blanking names, email addresses, phone numbers, salaries, addresses and free text, while keeping ids, amounts, statuses and dates, so the agency's records and totals still add up. A contact removed from a client, or a team member who is deactivated, stays visible to the agency in its history until one of the rules above applies.
Cookies and browser storage
Instalo does not use cookies for analytics or advertising, so we don't ask for cookie consent. Analytics runs without storing anything in your browser. The apps store only what they need to work: the cookie that keeps you signed in, whether you have hidden the getting started guide, where to return after connecting Xero, and the links that let a client approve a placement or pay an invoice. This website sets no cookies of its own. The pilot questionnaire is embedded from Tally, which sets no cookies but keeps two ids in your browser's storage so the form works and your answers aren't lost.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong;
- erase your data, except what we must keep by law (such as invoices);
- restrict or object to how we use it, including for analytics;
- give you your data in a format you can move to another provider.
Email [email protected]. We answer within one month. If your data was entered by an agency (for example as a candidate or a client contact), we will pass your request to that agency and help it respond.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.
Keeping it safe
Data is encrypted in transit, and bank details and payment messages are also encrypted when stored. Access within Instalo is limited by role: for example, only an agency's Admin and Finance members see its invoices. Personal data is kept out of logs and error reports.
Changes to this policy
If we change this policy we will update the date at the top, and tell agencies by email about any change that affects how their data is used.