InsightStack ("InsightStack," "we," "us," or "our") operates the consumer research platform at https://www.insightstack.fyi (the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. By using the Service, you agree to this policy.
1. What InsightStack does
InsightStack is a business-to-business software platform for consumer and user research. Researchers and their organizations use InsightStack to design studies, invite participants, conduct async video or voice interviews (often moderated by AI), analyze transcripts and media, and query a workspace knowledge base across studies. We do not operate a consumer social network, image-generation service, or adult content platform.
2. Information we collect
- Account and workspace data — name, email address, authentication identifiers (for example via Supabase Auth), workspace membership, role, and settings you provide.
- Study and research content — discussion guides, stimuli, screener responses, interview recordings (video/audio), transcripts, notes, tags, reports, and derived analytics (sentiment, themes, quotes) generated from research you run on the platform.
- Participant data — information participants submit when joining a study (responses, demographics if you collect them, device/browser metadata needed to deliver interviews). Participants may use zero-install links without creating a full InsightStack account.
- Knowledge Layer content — text and files you upload, paste, or connect for search and Q&A within a workspace, including titles, extracted text, embeddings, and source metadata.
- Google user data (optional) — if a workspace administrator connects Google Drive, we receive OAuth tokens (stored encrypted) and, with the connecting user's authorization, read-only access to Google Drive files in the folder they select. We import file content and metadata needed to index documents in the Knowledge Layer (file name, file id, revision, exported text or CSV). We do not sell Google user data.
- Usage and technical data — log data, IP address, browser type, pages viewed, feature usage, and error diagnostics to operate and secure the Service.
- Billing and support — if applicable, payment-related identifiers processed by our payment provider; messages you send to support.
3. How we use information
- Provide, maintain, and improve the Service, including AI-assisted moderation, analysis, and search.
- Authenticate users, enforce workspace permissions, and prevent fraud or abuse.
- Process Google Drive content only to sync and search documents the connecting user explicitly selected, refresh content when files change, and display citations in the Knowledge Layer.
- Send transactional emails (invites, notifications) and respond to support requests.
- Comply with law and protect the rights, safety, and security of InsightStack, our customers, and users.
We do not use Google user data to train generalized AI models unrelated to your workspace, and we do not use Google APIs to create, alter, or distribute non-consensual intimate imagery (NCII) or other harmful synthetic media.
4. Legal bases (EEA/UK)
Where GDPR applies, we process personal data on bases including contract (providing the Service), legitimate interests (security, product improvement), consent (where required, such as optional integrations), and legal obligation.
5. How we share information
- Within your organization — workspace members see data according to role-based access you configure.
- Service providers — hosting and database (for example Supabase), AI inference and embeddings (for example OpenRouter), speech services (for example Deepgram), email delivery, and infrastructure providers that process data on our instructions under agreements.
- Google — when you initiate Google sign-in, or when you choose to index a publicly shared Google Docs/Drive link; governed by Google's policies and your Google account settings.
- Legal — when required by law or to protect rights and safety.
We do not sell personal information.
6. Google API Services User Data Policy
InsightStack's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In summary:
- We do not request restricted Google Drive OAuth scopes. Optional Knowledge Layer imports use public share links or file uploads initiated by workspace editors.
- Google user data from sign-in or public link imports is used solely to provide InsightStack features for your workspace (for example, indexing documents in the Knowledge Layer), not for advertising, and not sold.
- We do not use Google user data to train or improve generalized or foundational AI models. Exported Drive text may be sent to third-party inference providers (for example OpenRouter and upstream LLM APIs) only to generate embeddings and answers for that workspace's Knowledge Layer, under API terms that prohibit using customer content to train providers' public models. See our Google API Services Disclosure.
- Limited Use statement: The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
- Human access to Google-derived content is limited to support and security needs, and workspace members who already have permission to view the synced knowledge base.
- You may disconnect Google Drive in product settings (when available) or contact us to revoke processing; disconnecting deletes the stored connection tokens and stops further sync.
7. Retention
We retain data for as long as your workspace or account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. You may delete studies, documents, or workspace data subject to your role permissions. Backups may persist for a limited period after deletion.
8. Security
We use industry-standard measures including encryption in transit (HTTPS), encrypted storage for sensitive integration tokens, access controls, and monitoring. No method of transmission or storage is 100% secure.
9. International transfers
We may process data in the United States and other countries where we or our providers operate, using appropriate safeguards where required.
10. Your rights and choices
Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to or restrict certain processing. Workspace administrators often control research and participant data; participants should contact the organization that invited them for study-specific requests. To reach InsightStack directly, email promeetmansata@gmail.com.
11. Children
The Service is not directed to children under 16. We do not knowingly collect personal data from children. Contact us if you believe we have collected such data.
12. Changes
We may update this policy. We will post the revised version on this page and update the "Last updated" date. Material changes may be communicated by email or in-product notice where appropriate.
13. Contact
Questions about this Privacy Policy or our data practices: promeetmansata@gmail.com.