Skip to main content
Your app decides who its users are and passes Insito a userId. This page covers what Insito stores against that ID, how to honour access and erasure requests (GDPR Articles 15 and 17, and similar laws), how consent works in the SDKs, and what can’t be recalled once it has left Insito. Subprocessors, security measures and the DPA are on Data protection and subprocessors.
Don’t use an email address, phone number or name as the userId. Use an opaque ID from your own database, such as a UUID. Insito never needs to know who the person is, and an opaque ID keeps answers pseudonymous in your dashboard, exports, Slack messages and logs.

What Insito stores about an end user

The SDK keeps undelivered responses on the device for up to 7 days; see Offline delivery.

Retention

Every night Insito deletes responses and impressions older than the organisation’s retention period, and end users not seen for that long. The default is 2 years. Change it in Settings → Data & privacy → Data retention (90 days to 10 years), or with PATCH /v1/dashboard/organization and retentionDays (30 to 3650). Shortening it deletes the older data on the next nightly run, so the dashboard asks you to confirm.

Access and erasure requests

When one of your users asks for their data or asks you to delete it:
  1. Open Settings → Data & privacy → End-user data requests.
  2. Choose the app and enter the userId your app passes to identify().
  3. Click Export JSON or Export CSV for an access request. The export contains the profile, every response with its questions, and every survey impression.
  4. Click Erase… and type the userId to confirm for an erasure request. The profile, responses, impressions and throttle stamps are deleted immediately. The user’s answers disappear from analytics, exports and shared reports.
Erasure only affects the chosen app. If the same person uses several of your apps, repeat it for each one. The same operations are available from the API with a dashboard session, but not with API keys or AI tools: GET and DELETE /v1/dashboard/projects/:projectId/respondents/:externalUserId. If the user is still signed in to your app, also call MicroSurvey.optOut() (see below). Otherwise the next identify() creates a new profile. Both SDKs can stop collection on a device:
  • MicroSurvey.optOut(): nothing is sent until optIn(). Queued responses and the cached identity are deleted and any open survey closes. The decision is stored on the device and survives relaunches.
  • MicroSurvey.optIn(): collection resumes. Call identify() afterwards.
  • Deferred collection: with deferCollection: true in init() (React Native) or InsitoConfig(deferCollection: true) (Flutter), the SDK sends nothing until optIn() is called. Use this when you ask for consent first. Once given, consent is remembered.
  • MicroSurvey.reset(): forgets the signed-in user, for example on logout. Queued answers are still delivered.
MicroSurvey.consent returns granted, denied or pending. These require @insito/react-native 0.3.0 or insito_flutter 0.3.0.

Deleting an organisation or account

Settings → Data & privacy → Danger zone:
  • Delete organisation (type the organisation slug): cancels the subscription and permanently deletes every app, survey, response, end-user profile, shared report link, API key and member login.
  • Delete account (type your email): deletes your login. If you are the organisation’s only member, the organisation is deleted with it.
Stripe keeps the customer record and invoices, which are needed for accounting.

What can’t be recalled

Erasure and deletion only reach data stored by Insito. Copies that have already left Insito stay where they are:
  • Messages already posted by the Slack integration
  • Payloads already delivered to your webhooks
  • Data read by AI tools through the MCP server, including anything kept in that tool’s chat history
  • CSV and PDF exports you downloaded, and copies made by people you shared a report link with
Delete these at the destination when you handle a request.

Backups

Insito keeps encrypted database backups: daily copies for 30 days and monthly copies for 12 months. Deleted data stays in those backups until they expire. Backups are only restored for disaster recovery, and access is restricted.