Insights7 Privacy Policy
Effective date: October 8, 2026
Last updated: October 8, 2026
Version: 3.1 (replaces version 3.0)
This Privacy Policy explains how Insights7, Corp. (“Insights7,” “we,” “us”) collects, uses and shares personal data when you visit insights7.com, book a conversation with us, receive our communications, use the Insights7 platform at platform.insights7.com, or otherwise deal with us as a customer, prospect or partner.
1. Our role
When we are the controller. We decide how and why your personal data is used, and this Policy applies, for:
- visitors to our website;
- people who book a meeting, contact us, or receive our marketing;
- business contacts at customers, prospects, partners and suppliers;
- account and sign-in data for platform users, and data about how the platform is used, to the extent we use it to run, secure and improve our business and the platform.
When we act for our customers. Our customers put their own information into the platform, such as their workforce’s names, roles, responsibilities, time records, KPI ownership, commitments and financial data (“Customer Data”). For Customer Data we act as a processor (or “service provider”) on behalf of the customer, which is the controller. We handle Customer Data only under our agreement with that customer, including our Data Processing Agreement. If your employer or another organization uses Insights7 and you have a question or request about your data in its instance, please contact that organization. If you contact us, we will pass your request to them.
2. Contact us
Email: info@insights7.com
Insights7 has not appointed a data protection officer because it is not required to.
3. What we collect, where it comes from, and why
| Category | Examples | Where it comes from | Why we use it | Legal basis (EU/UK) | How long we keep it |
|---|---|---|---|---|---|
| Account data | Name, work email, company, role in the platform, password (stored only as a salted, one-way hash) | You or your organization’s administrator | Create and manage accounts; authenticate users; communicate about the service | Contract; legitimate interests (operating our service for our customers) | Life of the account, plus up to 30 days |
| Platform usage data | User ID, company ID, pages viewed, features used, IP address, browser and device information, error and performance logs | Collected automatically when you use the platform, including through PostHog product analytics | Security, troubleshooting, support, product analytics and improvement | Legitimate interests (securing and improving the service) | 12 months, then deleted or aggregated |
| Booking and contact data | Name, email, company, meeting time, information you choose to share when booking | You, through Calendly or by email | Arrange and hold meetings; respond to enquiries | Legitimate interests (responding to you); steps before a contract | Up to 24 months after last contact |
| Business contact and CRM data | Name, work email, job title, company, LinkedIn profile, notes of our interactions | You; business cards and events; professional networking sites such as LinkedIn; introductions; contact lists we have imported | Business development, account management, relationship history | Legitimate interests (B2B relationship management) | While the relationship is active, plus up to 36 months |
| Marketing data | Email address, subscription status, email engagement | You (for example, a sign-up form); business contact data above | Send newsletters, insights and offers | Consent, or legitimate interests where the law allows B2B marketing without consent | Until you unsubscribe; we keep a suppression record so we do not email you again |
| Customer billing data | Billing contact, billing address, invoices, payment records (amount, date, payment method). For payments made through Stripe, only the limited details Stripe shares with us, such as card type and last four digits; we do not store full card numbers | Your organization; Stripe | Invoicing, collections, tax and accounting | Contract; legal obligation | 7 years after the relevant tax year |
| Support data | Messages and attachments you send through the platform’s support form or by email | You | Resolve issues; improve support | Contract; legitimate interests | 24 months after the request is closed |
| Public company information | Information on your organization’s public website and other public sources | Public sources | Generate draft suggestions in our AI Features (see Section 4); research prospects | Legitimate interests | As long as needed for that purpose |
Payments. Customers pay either by direct ACH bank transfer to Insights7 or through our payment processor, Stripe, by card or ACH. When you pay through Stripe, Stripe collects and holds your card or bank account details and handles them under its own privacy policy (https://stripe.com/privacy). We do not store full card numbers.
We do not intentionally collect sensitive personal data (such as health, biometric or precise location data), and we ask customers not to put it in the platform.
4. AI Features
Some platform features, such as the AI Process Generator, use AI models from OpenAI through OpenAI’s API. We do not send Customer Data or personal data from the platform to any AI model provider. These features use only publicly available information, such as an organization’s public website, together with Insights7’s own content. Our AI provider does not use data sent through our API account to train its models. We do not use Customer Data to train AI models. We do not use AI to make decisions that produce legal or similarly significant effects on individuals.
5. Cookies and similar technologies
Our website and platform use a small number of cookies and similar technologies. See our Cookie Policy at https://insights7.com/cookies/ for the full list and your choices.
6. How we share personal data
We do not sell personal data, and we do not share it for cross-context behavioral advertising. We share personal data only:
- With service providers and sub-processors who host, support or help us run our business and the platform (for example, our payment processor, Stripe), under written contracts that limit their use of the data. Our current list, with what each one does and where, is at https://insights7.com/subprocessors/.
- With your organization, if you use the platform through it (for example, its administrators can see your account and activity).
- For legal reasons, where needed to comply with law or legal process, or to protect rights, safety and security.
- In a corporate transaction, such as a reorganization, financing, merger or sale of all or part of our business, subject to confidentiality protections.
- With your consent or at your direction.
7. International transfers
We are based in the United States, and our platform is hosted in the United States. Some providers process data in other countries; for example, our product analytics provider PostHog uses its EU-hosted service. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, and Swiss amendments as applicable, or rely on a recipient’s certification under the EU–US Data Privacy Framework and its UK and Swiss extensions where that recipient is certified. You can ask for a copy of the relevant safeguards at info@insights7.com.
8. How long we keep data
We keep personal data only as long as needed for the purposes in Section 3, then delete or de-identify it. Backups are kept for 30 days and then overwritten. When a customer’s subscription ends, we handle Customer Data as set out in our Terms of Service and Data Processing Agreement.
9. Security
We use reasonable safeguards appropriate to the data we hold. For example:
- the platform requires HTTPS, with TLS encryption for communications between your browser and the platform;
- passwords are stored as salted, one-way hashes;
- the platform checks submitted data with Rails model validations and uses parameterized database queries to help protect against SQL injection;
- Rails authenticity tokens help protect against cross-site request forgery (CSRF);
- customer data is encrypted at rest;
- each customer’s data is logically separated from other customers’ data;
- access within the platform is controlled by role-based permissions;
- we make regular backups;
- the platform is a multi-tenant Ruby on Rails application hosted in the United States on Heroku (a Salesforce company), which runs on Amazon Web Services infrastructure.
No method of transmission or storage is completely secure. If we learn of a security breach affecting personal data, we will notify affected customers, individuals and authorities as required by law. For Customer Data, we notify the customer under our Data Processing Agreement, and the customer decides on notice to its people and regulators.
10. Your privacy rights
Everyone. You can ask us to tell you what personal data we hold about you, give you a copy, correct it, or delete it, and you can opt out of marketing at any time. We will not discriminate against you for using your rights.
EU, EEA and UK. You also have the right to restrict or object to our processing (including processing based on legitimate interests, and always for direct marketing), to data portability, and to withdraw consent at any time without affecting earlier processing. You have the right to complain to your local data protection authority (in the UK, the Information Commissioner’s Office), although we would appreciate the chance to address your concern first.
US states. Depending on where you live (for example, California, Colorado, Connecticut, Minnesota, Oregon, Texas, Virginia and other states with comprehensive privacy laws), you may have the rights to know, access, correct, delete and port your data, and to opt out of sale, targeted advertising and certain profiling. We do not sell personal data or use it for targeted advertising or profiling with legal or similarly significant effects. Minnesota residents may also ask for the list of specific third parties to which we have disclosed their personal data.
How to make a request. Email info@insights7.com. We may need to verify your identity, and you may use an authorized agent where the law allows. We respond within one month (EU/UK) or 45 days (US states), and may extend this where the law allows. If we decline your request, you may appeal by replying to our decision with “Appeal” in the subject line; we will respond to appeals within the time the law requires and tell you how to contact your state attorney general if you disagree.
Data in a customer’s instance. For Customer Data, please contact the organization that gave you access (see Section 1).
11. Marketing emails
You can unsubscribe from marketing emails at any time using the link in each email or by emailing info@insights7.com. We will still send service and transactional messages to platform users.
12. Children
Our services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal data from children.
13. Changes to this Policy
We may update this Policy. We will post the new version at https://insights7.com/privacy-policy/ with a new “Last updated” date. For material changes, we will email platform account administrators at least 30 days before the change takes effect. Prior versions are available on request at info@insights7.com.