Quick summary
- We do collect the minimum data needed to run Insight 360 - your account, your conversations, and basic usage signals.
- We do not sell your data, share it with advertisers, or use your conversations to train third-party foundation models.
- You can export your data, delete your account, or ask us what we hold about you at any time.
Who we are
Insight 360 ("we", "us") is a brand intelligence co-pilot. For the purposes of POPIA and GDPR, Insight 360 is the responsible party / data controller for personal information you provide directly to the product.
What we collect
Account information
- Email address and (optionally) display name.
- Authentication metadata (sign-in timestamps, provider - email or Google).
Product content
- Threads, messages, and tool-card outputs you generate in Insight 360.
- Folder and organisational metadata you create to sort your work.
Usage signals
- Basic diagnostic logs (request timing, error traces) used to keep the service running.
- Rate-limit counters tied to your user ID.
How we use data
- To provide the service - running your prompts, saving your threads, showing your history.
- To secure the service - detecting abuse, enforcing rate limits, investigating incidents.
- To improve the service - aggregated, de-identified usage patterns only.
- To communicate - service notices, security alerts, and (with your consent) product updates.
Retention & deletion
- Threads and messages are retained until you delete them or close your account.
- Account records are removed within 30 days of a deletion request; backups roll off within 90 days.
- Diagnostic logs are retained for up to 90 days, then rotated.
Security
We work toward alignment with recognised security frameworks (including ISO/IEC 27001 and SOC 2 principles, and the OWASP Top 10 for application security). Current controls include:
- TLS 1.2+ in transit; encryption at rest for the primary database and file storage.
- Row-Level Security (RLS) on every user-owned table, so users cannot read each other's data.
- Least-privilege access for internal systems and audit logging on privileged operations.
- Rate limiting on AI endpoints to reduce abuse and cost-exhaustion risk.
These are our current practices and roadmap goals - not a claim of formal certification. Report a suspected vulnerability to security@insight-360.co.za.
Your rights (POPIA / GDPR / CCPA)
Depending on where you live, you have some or all of the following rights over your personal information. Insight 360 honours these for all users regardless of jurisdiction:
- Access - ask what we hold about you.
- Rectification - correct inaccurate information.
- Erasure ("right to be forgotten") - request account and content deletion.
- Portability - export your threads in a machine-readable format.
- Objection / restriction - object to specific processing.
- Withdraw consent - for any processing that relies on consent.
To exercise any of these rights, email dpo@insight-360.co.za. You also have the right to lodge a complaint with the South African Information Regulator or your local supervisory authority.
Children
Insight 360 is not intended for children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with data, contact privacy@insight-360.co.za and we will delete it.
Changes to this policy
We will update this page as Insight 360 evolves. Material changes will be announced in-app or by email at least 14 days before they take effect.
Contact us
- General privacy questions - privacy@insight-360.co.za
- Data Protection Officer / POPIA requests - dpo@insight-360.co.za
- Security disclosures - security@insight-360.co.za