Privacy Policy

Who we are

Insito ([legal entity name, registered address and company ID — to be completed]) provides in-app survey software for mobile apps. Contact for privacy matters: jirka@insito.app.

We act in two roles:

• Controller for the data of our customers: people who sign up for the dashboard, their team members, and visitors of this website.
• Processor for the survey data our customers collect from the users of their apps through the Insito SDK. For that data, the customer is the controller and our Data Processing Agreement applies.

Data we collect about customers

• Account data: name, email address, password hash or sign-in provider, organisation name.
• Billing data: plan, invoices and payment status. Card details are handled by Stripe and never reach our servers.
• Usage and security data: IP address, browser, request logs and error reports.
• Communication: emails you send us and transactional emails we send you.

Data we process for customers

When an app uses the Insito SDK, we receive the app user ID the customer chooses, the properties and events the customer sends, device information (platform, OS version, app version, locale) and the survey answers. We use this data only to deliver the service to the customer. We do not sell it, use it for advertising, or combine it across customers.

Purposes and legal bases

• Providing the service and support — performance of a contract.
• Billing and accounting — contract and legal obligation.
• Security, abuse prevention and error monitoring — legitimate interest.
• Product emails about your account — contract; marketing emails only with consent.

Where data is stored and who processes it

Our primary database runs in the EU (Frankfurt). Some subprocessors, such as payment and email providers, may process data outside the EU under Standard Contractual Clauses. The current list with regions is published in our data protection documentation.

Retention

• Account data: for as long as the account exists. Deleting the account or organisation in Settings removes it.
• Survey data: kept for the retention period the customer sets (default two years), then deleted automatically.
• Backups: overwritten on a rolling basis within 12 months.
• Invoices: as long as accounting law requires.

Your rights

You can request access to, correction of, or deletion of your personal data, object to or restrict processing, and ask for a copy in a portable format. Most of this is available directly in the dashboard under Settings → Data & privacy. If you are an app user and want your survey data removed, contact the app that showed you the survey — they control that data and can erase it through Insito. You can also complain to your local data protection authority.

Security

Data is encrypted in transit and at rest. Access is limited to the people and systems that need it, and each customer's data is isolated from every other customer's.

Changes

We will announce material changes to this policy by email or in the dashboard before they take effect.