Instinct’s AI assistant crossed 12 million business users in 18 months. Security researchers published findings this week showing the app collects financial behavior data, communication metadata, and in documented cases, crypto wallet activity that users never explicitly agreed to share. This is not a bug. It is a business model.
What Is Actually Happening Right Now
AI assistants became the fastest growing software category of 2025 and 2026. Instinct rode that wave hard. According to Sensor Tower, the platform grew from roughly 900,000 active users in January 2025 to over 12 million by mid 2026, making it one of the fastest adopted B2B productivity tools in that period. That kind of speed comes with shortcuts.
According to the Electronic Frontier Foundation, 74% of AI assistants launched after 2024 expanded their data collection practices within six months of public release, often without notifying users. Instinct is now under formal review by the European Data Protection Board and named in a class action lawsuit filed in California in July 2026, according to court filings. The lawsuit specifically calls out undisclosed collection of financial metadata and third party wallet connection data.
This is not a story about one bad company. It is a story about a pattern. And if you are using any AI assistant for business work right now, you are inside that pattern.
The Real Problem Is Deeper Than Privacy Settings
Most people read “AI privacy concern” and scroll past it. That is the move that costs you.
Here is what Instinct actually does inside your workflow. The app sits at the center of your business communication. It reads your emails, your calendar, your documents, and your chat threads. That is the product you signed up for. But according to research published by cybersecurity firm Bishop Fox in June 2026, Instinct’s data retention policies allow the company to store behavioral data for up to 36 months after account deletion. Even if you quit tomorrow, your communication patterns, financial discussions, and business decisions stay in their system for three more years.
The crypto angle makes this significantly worse. A large number of Instinct users connected the app to DeFi tools, crypto portfolio trackers, and blockchain wallets through its native integrations. According to Chainalysis, wallet connection integrations with AI productivity tools grew 290% between Q1 2025 and Q1 2026. Instinct was one of the top five apps in that category. The problem is that wallet metadata, transaction timing, and balance ranges are now sitting on Instinct’s servers. That data is not anonymous. A skilled analyst can reverse engineer identity from wallet behavior patterns alone.
Average people think privacy settings are the fix. They are not. A checkbox in an app settings menu does not stop a company from using behavioral inference data that was already collected. The protection is not in the settings. It is in the separation.
Smart operators run their AI tools on a strict need to know basis. They give the assistant access to what it needs for one specific task and nothing more. They use separate accounts for sensitive financial work. They never connect a primary crypto wallet to a productivity tool without reading the full data policy first, including the parts buried in the appendices.
If your business runs payroll through a platform like Gusto, the architecture matters here. Gusto maintains its own separate data environment. Payroll data does not flow through third party AI integrations unless you explicitly authorize each connection. That kind of clean separation is what protects you when tools like Instinct are under the microscope.
What I Would Do Right Now
I would take three actions today if I run any business that uses Instinct or a similar AI assistant.
First, revoke all financial integrations immediately. Go into the app settings and disconnect every bank account, crypto wallet, portfolio tracker, and financial dashboard you have connected. The assistant does not need access to your money to summarize documents or schedule meetings. If it does ask for that access, that request alone tells you something about the product you are using.
Second, submit a formal data deletion request. Under GDPR and the California Consumer Privacy Act, you have the legal right to see what data the company holds on you and request deletion. Start that process today. Do not assume the company deletes your data when you close the account. According to a 2026 IBM Security report, the average cost of a business data breach reached $4.9 million per incident, and that number rises sharply when financial data is included. The risk is quantified. Act accordingly.
Third, segment your business spending from your AI tools. Using a dedicated business card platform like Wallester keeps your company expenses in a contained system that does not connect to productivity apps by default. That separation is not inconvenient. It is the actual defense strategy.
The companies that get through the AI privacy wave intact are the ones treating data access like a security perimeter. The ones that handed over wallet credentials for the sake of a smoother daily workflow will understand what that decision cost them in about 18 months.
The Bottom Line
Instinct built something millions of people trust with their most sensitive business data. That trust is now a liability on their balance sheet and yours. Regulations will eventually catch up. But regulation moves slow and your financial data moves fast. I am not waiting on a government body to protect my crypto wallet activity. I am protecting it now. You should too.
Frequently Asked Questions
What is Instinct AI and why is it under scrutiny?
Instinct is a business AI assistant that reached 12 million users by mid 2026. It is currently under review by the European Data Protection Board and named in a California class action lawsuit over undisclosed collection of financial metadata and wallet connection data. According to court filings, the company’s data practices go well beyond what users agreed to in the original terms of service.
Can Instinct AI actually access my crypto wallet?
If you connected a crypto portfolio tracker, DeFi tool, or wallet app through Instinct’s integration menu, then yes. According to Chainalysis, wallet connections to AI productivity tools grew 290% in the 12 months before mid 2026. Instinct ranked in the top five apps for those connections. Revoke access through the app settings and then verify in your wallet app directly.
How do I protect my business from AI assistant data collection?
The core strategy is separation. Do not connect financial accounts or crypto wallets to productivity tools. Use a dedicated business card platform to keep spending data in its own environment. Submit formal data deletion requests for any app that has held financial metadata on your account. These steps take about 30 minutes and they matter.
Is the Instinct AI privacy concern unique to this company?
No. According to the Electronic Frontier Foundation, 74% of AI assistants launched after 2024 expanded their data collection within six months of release without notifying users. Instinct is the current headline but the pattern is widespread. Any AI tool sitting inside your business communication stack should be audited for data access permissions quarterly.
What happens to my data if I delete my Instinct account?
According to Bishop Fox’s June 2026 research, Instinct’s data retention policy allows storage of behavioral data for up to 36 months after account deletion. Deleting the app is not enough. You need to submit a formal data erasure request under GDPR or CCPA to trigger an actual deletion obligation. Save confirmation of that request in writing.
