Privacy Policy

1. About This Policy

This Privacy Policy describes how InsightStack, LLC ("InsightStack," "we," "us," or "our") collects, uses, stores, and protects information when you use the InsightStack platform and related services (collectively, the "Platform"). This Policy applies to all Customers and users of the Platform.

InsightStack is a business-to-business (B2B) platform. Our Customers are companies and business professionals. Where our Customers upload content containing personal data of their own customers or third parties, InsightStack acts as a data processor on behalf of our Customer, who is the data controller.

By using the Platform, you agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Platform.

2. Information We Collect

2.1 Account and Contact Information

When you register for an account, we collect information such as your name, business email address, company name, and other information you provide during account setup. This information is used to create and manage your account, communicate with you, and provide support.

2.2 Customer Conversation Data

You may upload customer conversation data (such as interview transcripts or email threads) to the Platform for processing. InsightStack processes this content to extract structured insights and excerpts on your behalf. As described in Section 3 below, the full conversation content is deleted immediately after processing and is never stored by InsightStack.

2.3 Billing and Payment Information

Payment and billing information is collected and processed by Stripe, Inc., our third-party payment processor. InsightStack does not store your full credit card or bank account information. We may retain billing records such as transaction history, subscription tier, and payment status for legal and financial compliance purposes.

2.4 Usage and Technical Information

We automatically collect certain technical information when you use the Platform, including IP address, browser type, device type, operating system, pages visited within the Platform, and feature usage data. This information is used to operate and improve the Platform, troubleshoot issues, and ensure security.

2.5 Communications

If you contact InsightStack for support or other purposes, we may retain records of that correspondence, including email content and any information you provide.

3. Data Architecture: How We Handle Customer Conversations

InsightStack's data handling architecture is designed with privacy and minimization as core principles. Here is how your conversation data flows through the Platform:

• When you upload a customer conversation, the full content is transmitted securely to our processing pipeline.
• The conversation is processed by our AI pipeline (which uses Anthropic's API - see Section 5) to extract structured insights, pain points, feature requests, and other relevant excerpts.
• The full conversation content is permanently deleted after processing is complete. InsightStack does not store raw conversation content.
• Only the structured excerpts and derived insights are retained in your account. These remain stored until you delete them or your account is terminated.

4. How We Use Your Information

InsightStack uses the information we collect for the following purposes:

• To provide, operate, and maintain the Platform and its features
• To process and analyze customer conversation data on your behalf and return structured insights
• To manage your account, subscription, and billing
• To communicate with you about your account, service updates, and support requests
• To detect, investigate, and prevent security incidents and misuse of the Platform
• To comply with legal obligations and enforce our Terms of Service
• To improve the reliability, performance, and functionality of the Platform using aggregated, non-customer-identifiable technical data

InsightStack does not use your Content - including any excerpts or insights derived from your conversations - to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model. This commitment applies without exception.

5. Third-Party Processors and Sub-Processors

InsightStack uses a limited set of trusted third-party service providers ("sub-processors") to operate the Platform. By using the Platform, you authorize us to engage these sub-processors as described below.

5.1 Anthropic, Inc. (AI Processing)

InsightStack uses Anthropic's API to process customer conversation data and extract structured insights. When you upload a conversation, the content is transmitted to Anthropic's API for processing. Anthropic processes this data solely to provide the API response and does not use API input data to train its models under its enterprise API terms. InsightStack's use of Anthropic is subject to Anthropic's data processing commitments applicable to commercial API customers.

Note: Because full conversation content is deleted after processing, Anthropic only ever has transient access to conversation data during the API call - it is not stored by Anthropic after the response is returned.

5.2 Stripe, Inc. (Payment Processing)

Stripe processes all payment and billing transactions. Stripe's handling of payment data is governed by Stripe's own privacy policy and security certifications. InsightStack does not have access to your full payment credentials.

5.3 Render (Hosting and Infrastructure)

The Platform is hosted on Render cloud infrastructure. Your account data and stored Excerpts are maintained on Render's servers within the United States.

We will notify Customers of any material changes to our sub-processor list by updating this Privacy Policy and providing notice as described in Section 11.

6. Data Retention

The following table summarizes our retention practices by data type:

When you delete Excerpts or insights from the Platform, they are removed from your account and deleted from our systems. When your account is terminated, InsightStack will delete all remaining Excerpts after the 30-day retrieval period described in our Terms of Service.

7. Data Security

InsightStack implements industry-standard security measures to protect your information, including:

• Encryption of data in transit using TLS
• Encryption of data at rest
• Access controls limiting employee access to customer data to those with a legitimate operational need
• Regular security assessments and monitoring

No system is completely secure. If InsightStack becomes aware of a security breach that may affect your data, we will notify you as required by applicable law.

8. Data Sharing and Disclosure

InsightStack does not sell, rent, or trade your personal data or Content to third parties. We may share information only in the following limited circumstances:

• With sub-processors as described in Section 5, solely for purposes of providing the Platform
• In response to a valid legal process (such as a court order or subpoena), or where required to comply with applicable law or government request
• To protect the rights, property, or safety of InsightStack, our Customers, or others
• In connection with a merger, acquisition, or sale of substantially all of InsightStack's assets, in which case we will provide notice and your data will remain subject to this Privacy Policy

9. Customer Responsibilities Regarding Third-Party Data

Because InsightStack is a B2B platform, your customers and conversation participants are not our direct users. When you upload conversation data containing personal information of third parties (such as the individuals being interviewed), you are the data controller for that information. You are responsible for:

• Ensuring you have the legal right to share conversation content with a third-party platform
• Obtaining any required consent from conversation participants for third-party AI processing
• Complying with applicable privacy laws (including notice and consent requirements) with respect to the personal data of individuals whose information appears in your uploaded content
• Responding to any privacy rights requests from your own customers or conversation participants

InsightStack processes such third-party personal data solely on your behalf and in accordance with your instructions as the data controller.

10. Your Rights and Choices

As an InsightStack Customer, you have the following rights with respect to your data:

• Access: You may access and review the Excerpts and insights stored in your account at any time through the Platform.
• Deletion: You may delete individual Excerpts or insights from the Platform at any time. You may also request deletion of your account and all associated data by contacting info@insight-stack.ai.
• Export: You may export your stored Excerpts and insights through the Platform.
• Correction: You may update your account information at any time through your account settings.

California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, the right to delete, and the right to opt out of the sale of personal information. InsightStack does not sell personal information. To exercise your rights, contact us at info@insight-stack.ai.

If you are located in the European Union or United Kingdom, you may have rights under the General Data Protection Regulation (GDPR) or UK GDPR, including the right to access, rectify, erase, or restrict processing of your personal data, and the right to lodge a complaint with a supervisory authority. Contact us at info@insight-stack.ai to make a request.

11. Changes to This Policy

InsightStack may update this Privacy Policy from time to time. We will provide at least 30 days' advance notice of material changes via email or in-platform notification. The effective date at the top of this Policy reflects the most recent revision. Your continued use of the Platform after the effective date of changes constitutes your acceptance of the updated Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or InsightStack's data practices, please contact us at: