Skip to main content
This page is for the person at your company who reviews vendors: what Insito collects, where it lives, who else processes it, and how requests are handled. For the end-user data itself and how to export or erase it, see Privacy and data requests.
The legal documents (Privacy Policy, Terms of Service and Data Processing Agreement) are being finalised with legal counsel. Email jirka@insito.app if you need a signed DPA before they are published.

Roles

  • Your app’s users: you are the controller and Insito is your processor. Insito processes their data only to run surveys for you, under your instructions and the DPA.
  • Your team’s dashboard accounts: Insito is the controller, as described in the Privacy Policy.

What is collected

From your app, through the SDK:
  • The userId you pass to identify(), plus any custom properties you send
  • Events you trigger and screens the user visits (screen names are also counted per app, without a user)
  • Device metadata: platform, OS version, app version, locale, timezone, session count, days since install
  • Survey impressions and answers
  • The device’s IP address, used only for rate limiting and kept in request logs (never stored with the user’s profile or answers)
The SDKs don’t read advertising identifiers, contacts, location or any other device identifier, and don’t track users across apps. From the dashboard: team members’ names and email addresses, organisation details, billing status and sign-in times.

Where data is stored

Survey data and accounts are stored in a PostgreSQL database in the EU (Frankfurt). Data is encrypted in transit (TLS) and at rest. Each organisation’s data is isolated at the database level with row-level security, and the isolation is tested on every release.

Subprocessors

Transfers outside the EU rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. We announce new subprocessors on this page and by email at least 30 days before they start processing data.

Retention and deletion

  • End-user data: deleted automatically after your organisation’s retention period (default 2 years). You can shorten it or erase one user immediately; see Privacy and data requests.
  • Organisation data: deleted immediately when you delete the organisation.
  • Backups: encrypted, kept for 30 days (daily) and 12 months (monthly).
  • Request logs: kept by the hosting provider for a limited period and never contain answers or request bodies.
  • Audit log: kept for 2 years, then deleted automatically. It records who changed security-relevant settings (user IDs, token IDs, IP addresses) and identifies end users only by a one-way hash. It goes with the organisation when the organisation is deleted.

Security measures

  • TLS for every connection; HSTS on all web properties
  • Row-level security on every table, with automated cross-tenant tests in CI
  • Access tokens stored hashed, scoped, revocable and expiring; SDK keys can be rotated from the dashboard at any time
  • Production access limited to named maintainers
  • Append-only audit log of security-relevant changes, readable and exportable by every member (Settings → Audit log)
  • Error reports scrubbed of personal data before they leave the API
  • Backups encrypted with a key held offline, with regular restore tests

Data Processing Agreement

The DPA covers the requirements of GDPR Article 28: processing only on your instructions, confidentiality, security measures, the subprocessor list above, help with data subject requests, breach notification without undue delay, and deletion or return of data at the end of the contract. Until the final version is published, email jirka@insito.app to request a copy.

App store declarations

See App Store and Google Play privacy labels for what to declare when your app uses Insito.