Privacy Policy

Google user data: what each permission accesses

When you connect your accounts, Google asks you to grant specific permissions (called scopes). Here is what each one is and why we need it.

Google Ads. We read your campaign structure, settings, budgets, bidding, keywords, ads, audiences and performance statistics so we can audit your account and identify problems and opportunities. When, and only when, you approve a specific recommended fix inside Insyt, we use the same permission to apply that change to your Google Ads account. We never make changes you have not approved.

Google Analytics. We read your GA4 reporting data and configuration, including traffic, engagement and goal completion data, so we can check that your tracking is working correctly and connect advertising performance to real outcomes on your site. This permission is read-only. We cannot change anything in your Analytics account.

Google Tag Manager. We read your tracking configuration so we can audit your setup. If you approve a tracking fix that requires a change, we use the edit permission to apply exactly that change, and nothing else.

You can disconnect any Google account from Insyt at any time from your Insyt settings, or by revoking Insyt's access in your Google Account at myaccount.google.com/permissions.

Google API Services: Limited Use disclosure

Insyt's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, this means:

• We only use data obtained from Google APIs to provide and improve the user-facing features of Insyt that are visible to you: audits, recommendations, reports, and approved fixes.
• We do not transfer or sell Google user data to third parties such as advertising platforms, data brokers, or information resellers.
• We do not use Google user data to serve advertisements, including retargeting, personalized, or interest-based advertising.
• We do not use Google user data to determine creditworthiness or for lending purposes.
• Humans at Insyt do not read your Google user data except with your explicit permission (for example, when you ask support to investigate an issue), where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.
• We do not use Google user data to train generalized artificial intelligence or machine learning models. Where we use AI to analyze your data, it is solely to generate your audit results, and our AI provider is contractually prohibited from using your data to train its models.

How we use AI

Insyt uses Anthropic's AI services to analyze your advertising and analytics data and generate audit findings and recommendations. Relevant data from your connected accounts is sent to Anthropic's API for processing, is used only to produce your results, and is not used by Anthropic to train its models under our commercial agreement with them.

How we use your information

We use the information described above to provide the service (run audits, generate recommendations, apply approved fixes), manage your account and subscription, process payments, send transactional email such as audit reports and billing notices, provide support, secure the service against fraud and abuse, comply with legal obligations, and improve Insyt. We may send you occasional product updates by email; you can opt out of these at any time, and we will still send you essential service messages.

Who we share data with

We do not sell your personal data, and we do not sell or share Google user data with anyone for their own purposes. We share data only with the service providers we need to run Insyt:

• Supabase (database and authentication hosting): stores your account data and audit data.
• Railway (application hosting): runs the Insyt application.
• Stripe (payments): processes subscription and audit payments.
• Resend (transactional email): delivers account and audit emails.
• Google APIs (Google Ads, Google Analytics, Google Tag Manager): the connections you authorize.
• Anthropic (AI analysis): analyzes advertising data to generate audit results.

Each provider is bound by contractual terms limiting them to processing data on our instructions. We may also disclose data where required by law, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of assets, in which case Google user data would only be transferred with your explicit prior consent as required by Google's policies.

Data retention

• Account data: kept while your account is active, and deleted within 30 days of a deletion request or account closure, except where we must keep it (see below).
• Google user data and audit data: kept while the relevant Google account remains connected, so we can show trends over time. When you disconnect an account or delete your Insyt account, we delete the associated Google user data within 30 days.
• Billing records: kept as required by UAE tax and accounting law, typically five years.
• Server logs: kept for up to 12 months for security purposes.

Legal bases (EU and UK users)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the service you signed up for), legitimate interests (securing and improving the service, preventing fraud, limited business communications), consent (connecting your Google accounts, non-essential cookies, marketing email), and legal obligation (tax and accounting records). Where we rely on consent, you can withdraw it at any time. See our GDPR page for full detail.

International transfers

We operate from the United Arab Emirates and use service providers in the United States and elsewhere. Where we transfer personal data of EU or UK users outside the EEA or UK, we rely on the European Commission's Standard Contractual Clauses, supplemented by the UK International Data Transfer Addendum for UK data, together with additional safeguards such as encryption in transit and at rest.

Cookies and analytics on our own website

tryinsyt.com uses a small number of cookies: essential cookies needed for sign-in and security, and analytics cookies that help us understand how visitors use our site so we can improve it. Where required by law, we ask for your consent before setting non-essential cookies, and you can change your choice at any time. We do not run third-party advertising cookies on our site.

Security

We protect your data with encryption in transit (TLS) and at rest, access controls, and the principle of least privilege. Google sign-in credentials are stored encrypted and are never exposed in the browser. No system is perfectly secure, but if we become aware of a breach affecting your personal data we will notify you and the relevant authorities as required by law.

Your rights

Depending on where you live, you may have rights to access, correct, export, delete, or restrict the processing of your personal data, and to object to certain processing. To exercise any of these rights, email hello@tryinsyt.com. We complete export and deletion requests within 30 days. EU and UK users can find more detail, including how to complain to a supervisory authority, on our GDPR page.

Children

Insyt is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or by a prominent notice in the app before the changes take effect. The effective date at the top always shows the current version.

Contact

Galco FZ-LLC, United Arab Emirates. Email: hello@tryinsyt.com.