Privacy Policy

Introduction

Insight Studio (“Insight Studio,” “we,” “us,” or “our”) provides a design and technology platform accessible via our websites, applications, and related services (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, and protect personal information, and describes the rights available to individuals under applicable privacy laws including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the California Online Privacy Protection Act (CalOPPA), and the EU General Data Protection Regulation (GDPR).

By using the Services, you agree to the practices described in this Privacy Policy, as updated from time to time.

Scope and Application

This Privacy Policy applies to personal information we collect:

• Through our websites, including insightstudio.dev and any subdomains.
• Through our web applications and tools.
• Through our official social media pages, including our Facebook Fan Page.
• Through email, customer support, and other communications related to the Services.

If you do not agree with this Privacy Policy, you should not access or use the Services.

Who We Are

Controller / business:

• Name of business: Insight Studio
• Business address: Santa Clarita, CA 91321, United States
• State of formation/operation: California

For purposes of CCPA/CPRA, Insight Studio is a “business” when it determines the purposes and means of processing California consumers’ personal information. For purposes of GDPR, Insight Studio generally acts as a “data controller” when it decides how and why personal data is processed through the Services.

Information We Collect

We collect the following categories of personal information, which may include “personal information” under CCPA/CPRA and “personal data” under GDPR.

Information Collected Automatically

When you use the Services, we and our service providers may automatically collect certain information through cookies, pixels, SDKs, and other tracking technologies.

This may include:

• Usage data: Pages viewed, features used, links clicked, time spent, and other usage metrics.
• Device and browser data: IP address, device type, operating system, browser type, language settings, and related technical information.
• Analytics identifiers: Online identifiers and cookies used by tools such as Google Analytics, Supabase logging, and similar analytics services.

We may combine this information with other data we hold to help us understand performance, improve the Services, and for security and fraud prevention.

Information from Third Parties

We may receive personal information from:

• Social media platforms: When you connect or interact with our Services through Facebook, Twitter, or other platforms, consistent with your settings on those platforms.
• Payment processors: Limited information related to transactions (e.g., last four digits of payment card, transaction identifiers, status) provided by Stripe or other processors, but we do not store full payment card numbers ourselves.
• Email service providers: Information about email engagement (e.g., opens, clicks, unsubscribes) from services such as Mailchimp and GetResponse.
• Remarketing networks: Online identifiers and engagement information associated with our campaigns on Google Ads, Twitter, Facebook, LinkedIn, and similar platforms.

How We Use Personal Information

We use personal information for the following purposes, to the extent permitted by applicable law:

• To provide, maintain, and improve the Services, including enabling account-related features and core functionality.
• To communicate with you, including sending service-related emails, updates, security alerts, and responding to your requests.
• To send marketing communications, newsletters, and information about new features or services, where permitted by law and your preferences.
• To operate, analyze, and improve our websites and applications, including through analytics tools such as Google Analytics, Supabase, and similar services.
• To facilitate payments and transactions (e.g., via Stripe, credit card, or crypto services) and to manage billing and fraud prevention.
• To conduct remarketing and advertising campaigns on third-party platforms such as Google Ads, Twitter, Facebook, and LinkedIn.
• To enforce our terms, protect the security and integrity of the Services, and prevent, detect, and respond to abuse, fraud, and security incidents.
• To comply with legal obligations and respond to lawful requests, including from regulators and law enforcement.
• For other purposes that are compatible with the context in which the information was collected, or that we describe at the time of collection.

Legal Bases Under GDPR

Where GDPR applies, we process personal data on the following legal bases:

• Performance of a contract: To provide the Services you request, including account-related communications and support.
• Legitimate interests: To improve and secure the Services, conduct analytics, prevent fraud, and market similar services, provided these interests are not overridden by your rights and interests.
• Consent: For certain marketing communications, social media connections, cookies, and other tracking technologies where consent is required by law.
• Legal obligations: To comply with applicable laws, regulations, and legal processes.

You may withdraw consent at any time where consent is the legal basis for processing, without affecting the lawfulness of processing based on consent before its withdrawal.

CCPA and CPRA Categories

For California residents, we may collect and use personal information in the following CCPA/CPRA categories:

• Identifiers: Email address, social media identifiers, online identifiers (cookie IDs, IP address).
• Internet or network activity information: Browsing and usage information related to the Services.
• Commercial information: Records of products or services purchased or considered, transaction information.
• Inferences: Preferences or interests we derive from your interactions with the Services (e.g., feature usage patterns) for personalization and improvement.

We do not intentionally collect “sensitive personal information” as defined by CPRA (such as government identifiers, precise geolocation, or health information) through the Services.

Sharing and Disclosure

We may share personal information with:

• Service providers and contractors: Companies that provide services on our behalf, such as hosting, analytics (e.g., Google Analytics, Supabase), email delivery (Mailchimp, GetResponse), customer support, payment processing (Stripe and other payment processors), and infrastructure tools (including Thirdweb for web3 functionality).
• Remarketing partners: Third-party advertising networks and social media platforms (e.g., Google Ads, Twitter, Facebook, LinkedIn) that help us deliver and measure remarketing or targeted campaigns.
• Social media platforms: When you choose to share content via social features or interact with our official pages.
• Professional advisors: Lawyers, auditors, and other professional advisors where necessary for legitimate business purposes and legal compliance.
• Authorities and legal processes: Government authorities, law enforcement, courts, or regulators where required to comply with law or protect rights, safety, or property.
• Business transfers: In connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, your information may be transferred as part of that transaction, subject to this Privacy Policy and any successor policies.

We do not sell personal information for monetary consideration, but we may “share” personal information for cross-context behavioral advertising (remarketing) as defined by CPRA. You have the right to opt out of such “sharing” as described below.

Facebook Fan Page

We operate a Facebook Fan Page to connect with users and share content. When you visit or interact with our Facebook Fan Page, Facebook and Insight Studio may be considered “joint controllers” for certain processing of your personal data related to page insights and analytics.

Facebook’s own privacy policy governs how Facebook collects and uses your data when you use its platform. Insight Studio receives aggregated, anonymous statistics about the usage of our Fan Page, which we use to understand audience engagement and improve our content. We do not have direct access to your individual profile data beyond what you have made public or explicitly share with us.

Analytics and Tracking

We use analytics tools, including Google Analytics, Supabase logging, and similar services, to understand how users interact with the Services, improve performance, and detect issues.

These tools may collect information such as:

• IP address and approximate location.
• Device and browser information.
• Usage data and events (pages, interactions, errors).
• Referring URLs and exit pages.

Google Analytics uses cookies and similar technologies; you can learn more and opt out via tools such as the Google Analytics Opt-out Browser Add-on and other privacy controls provided by Google.

Cookies and “Do Not Track”

We use cookies, pixels, and similar technologies to support core functionality, remember your preferences, perform analytics, and run remarketing campaigns.

Under CalOPPA, we must disclose how we respond to “Do Not Track” (DNT) signals and whether third parties conduct tracking on our site.

• DNT signals: At this time, the Services do not respond to browser-based DNT signals, because there is no industry standard for interpreting such signals across first- and third-party services.
• Third-party tracking: Third parties such as analytics providers and remarketing partners may collect information about your online activities over time and across different websites when you use the Services.

You can manage cookies and other tracking technologies through your browser settings and, where applicable, through consent or preference tools provided on our site.

Payments and Crypto

When you pay for products or services, your payments may be processed by third-party providers such as Stripe and other payment processors. These providers may collect and process payment card data, crypto wallet information, and related billing details as independent or joint controllers, subject to their own privacy policies.

Insight Studio generally receives limited transaction details (e.g., amount, currency, status, and partial payment identifiers) and uses them to:

• Process your orders and provide the Services.
• Prevent fraud and manage chargebacks.
• Maintain business and accounting records.

We do not store full payment card numbers or crypto private keys within our own systems.

Remarketing and Advertising

We may use remarketing services for marketing and advertising purposes, including:

• Google Ads (AdWords)
• Twitter
• Facebook
• LinkedIn

These services use cookies, pixels, or similar technologies to recognize you and show relevant ads based on your past interactions with the Services. This type of targeted advertising may qualify as “sharing” personal information under CPRA.

You can generally opt out of remarketing by:

• Adjusting ad preferences on each platform (Google, Twitter, Facebook, LinkedIn).
• Using browser-based tools or industry opt-out pages (such as the Network Advertising Initiative or Digital Advertising Alliance).

Where required by law, we will obtain your consent or provide you with clear choices before using cookies or pixels for remarketing.

Use of AI and Automated Tools

Insight Studio may use automated systems and tools, including machine learning, to analyze usage data, support design workflows, provide recommendations, and improve the Services.

• Input data: If you use AI-powered features (for example, automated suggestions or analysis), your inputs may be processed by our systems and, in some cases, by vetted third-party AI providers acting as processors or sub-processors.
• Outputs and profiling: AI-generated outputs may reflect patterns based on the data you provide and system-wide usage; we do not use AI to make decisions that produce legal or similarly significant effects about you without appropriate safeguards and transparency.
• Training and improvement: Unless we explicitly state otherwise and offer you a choice, we do not use customer-specific content in a way that would publicly expose your data or identify you in training datasets. If we use AI providers that retain logs for abuse detection (for example, short-term request logs), this will be done under appropriate data processing agreements and disclosed in our documentation.

If we introduce higher-risk AI features (such as automated decision-making with significant impact), we will provide additional notice and rights consistent with GDPR Article 22 and evolving AI regulations.

Your Rights — California (CCPA/CPRA)

If you are a California resident, you have the following rights regarding your personal information, subject to legal limitations:

• Right to know: To request details about the categories and specific pieces of personal information we have collected, the sources, purposes, and categories of third parties with whom we share information.
• Right to delete: To request deletion of personal information we collected from you, subject to certain exceptions (e.g., legal obligations, security purposes).
• Right to correct: To request correction of inaccurate personal information.
• Right to opt out of sale or sharing:To direct us not to “sell” or “share” your personal information for cross-context behavioral advertising.
• Right to limit use of sensitive information:If we ever process “sensitive personal information” as defined by CPRA, you will have the right to limit its use and disclosure.
• Right to non-discrimination: We will not discriminate against you (for example, by denying services or offering different prices) because you exercise your privacy rights.

Your Rights — GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with similar rights, you may have the following rights under GDPR or equivalent laws:

• Right of access: To obtain confirmation and a copy of personal data we hold about you.
• Right to rectification: To correct inaccurate or incomplete personal data.
• Right to erasure: To request deletion of your personal data in certain circumstances (e.g., where data is no longer necessary or you withdraw consent).
• Right to restriction: To restrict processing in certain cases (e.g., contested accuracy or pending legal claims).
• Right to data portability: To receive personal data you provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller where technically feasible.
• Right to object: To object to processing based on legitimate interests, including profiling, and to direct us not to process your data for direct marketing.
• Rights regarding automated decision-making: To not be subject to decisions based solely on automated processing that produce legal or similarly significant effects, in the absence of appropriate safeguards.

You can exercise these rights by contacting us at info@insightstudio.dev. Where required, you also have the right to lodge a complaint with your local data protection authority.

International Data Transfers

We are based in the United States, and your personal information may be transferred to and processed in the United States and other countries that may not provide the same level of data protection as your home jurisdiction.

When we transfer personal data from the EEA, UK, or Switzerland to countries that do not have an adequacy decision, we will rely on appropriate safeguards such as Standard Contractual Clauses, Data Privacy Framework participation (where applicable), or other lawful transfer mechanisms.

Data Retention

We retain personal information:

• For as long as necessary to provide the Services and fulfill the purposes described in this Privacy Policy.
• For the duration required by law, contract, or legitimate business needs (for example, accounting and compliance).
• For security, fraud prevention, and dispute resolution, as reasonably necessary.

When data is no longer needed, we will delete, anonymize, or aggregate it, unless we are legally required or permitted to retain it longer.

Security

We implement technical and organizational measures designed to protect personal information from unauthorized access, disclosure, alteration, or destruction, appropriate to the nature of the data and the risks involved.

However, no system is perfectly secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of any account credentials and for notifying us promptly of any suspected security incidents relating to the Services.

Children's Privacy

Our Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without appropriate consent, we will take steps to delete that information as required by law.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page and, where legally required, provide additional notice (such as by email or a prominent notice on the Services).

Please review this Privacy Policy periodically to stay informed about our privacy practices.

Contact Us

If you have any questions about this Privacy Policy or our privacy practices, or if you wish to exercise your privacy rights, you may contact us:

• By email: info@insightstudio.dev
• By visiting: insightstudio.dev/terms

Depending on your jurisdiction, you may also have the right to lodge a complaint with a supervisory authority if you believe we have not adequately addressed your concerns.