Privacy Policy

1. Who we are

ZAA Cloud LLC (“we”, “our”, “us”) operates InsightLoop. For data that identifies you directly to us, such as your account, sign-in events, and support correspondence, we are the data controller. For the feedback, comments, attachments, and integration data that you or your customers upload into a project, we act as a data processor on behalf of the organization that owns the project. Its owner decides what to collect, who to share it with, and when to delete it. We hold and operate on it under their instructions.

For privacy questions, write to privacy@insightloop.io.

2. Information we collect

Account information

When you create an account, we collect your name, email address, and a hashed password. If you sign in with Google, GitHub, or Microsoft, we receive your name and email from that provider, plus your profile picture where the provider supplies one.

Single sign-on and directory sync

If your organization uses SAML single sign-on, we receive your name and email from its identity provider each time you sign in. If it connects a SCIM directory, the identity provider sends us your name and email to create and update your membership, sometimes before you have signed in for the first time. The same connection can end your membership or deactivate your account, which signs you out and blocks sign-in until your organization restores access. Your organization's administrators set up and manage these connections.

Billing and subscription information

When you subscribe to a paid plan, payment is handled by LemonSqueezy, our payment provider and merchant of record. LemonSqueezy collects the billing details it needs to take payment, such as your name, billing address, and payment method. We never receive or store full card numbers. On our side we store your plan, subscription status, billing period, and any extra capacity you have bought. For each purchase we also keep LemonSqueezy's order and customer references and which account started the checkout, so a subscription stays linked to the organization it was bought for and to the person who pays for it, even if the organization changes hands. The subscription terms are set out in the Plans and billing section of our Terms of Service.

Anonymous portal access

When you vote, comment, or submit feedback on a public feedback portal without signing in, we create a temporary anonymous session. Browsing alone does not create a session or store any anonymous record. The session has no personal information attached. If you later sign up or sign in, your votes, comments, and feedback are transferred to your new account and the anonymous record is deleted.

Content you create

Feedback, comments, votes, project settings, custom roles, categories, statuses, roadmap items, team invitations, and replies you send to feedback authors are stored as part of normal use of the platform, along with the themes, summaries, and draft specs our AI features generate from your feedback.

File uploads

You can attach files to feedback and comments. We accept PNG, JPG, WebP, and PDF, up to 5 MB per file. Uploads are stored on Cloudflare R2.

Session and device information

When you sign in, we record your IP address, browser user agent, and a session timestamp. We use this information to manage active sessions, detect anomalous activity, and revoke compromised sessions. We never sell it and never hand it to an advertiser, a data broker, or any third party of our own choosing. It does appear in one place your own project can read: an audit log entry records the IP address and browser of whoever performed the action, so a project member holding audit access, or software they authorised, can see it. Section 7 covers what that means.

Server and application logs

Our infrastructure records the standard metadata a web service produces: request timestamps, response codes, paths, IP addresses, and error traces. These logs are used for security monitoring, debugging, and abuse prevention. We also send error and exception traces to Sentry, our error-monitoring sub-processor, to diagnose and fix faults. Personal data is minimized and masked before transmission. Retention is described in the data retention section below.

API keys

If you create API keys for use with the InsightLoop REST API or the Model Context Protocol (MCP) server, we store the key name, the creator, the project it belongs to, and a one-way hash of the secret. We never store the secret in plain text.

Submitter contact information

Feedback that arrives from an external channel (a support tool, an email inbox, or an integration) may include the submitter’s name and email so the project team can reply. That information is visible only to members of the project it landed in and is never displayed on a public portal.

Sensitive and special-category data

We do not request and we do not need any special category of personal data under GDPR Article 9 or sensitive personal information under California law. That includes racial or ethnic origin, religious or philosophical beliefs, trade union membership, health or genetic data, biometric identifiers, precise geolocation, financial account numbers, and government identifiers. A user may inadvertently include such information in a free-text feedback item or attachment. If you discover that in a project you control, you can delete the content at any time.

3. Sources of the information

We receive information from the following sources:

• Directly from you. Anything you type into the product, including feedback, comments, project settings, and support emails.
• From Google, GitHub, or Microsoft, when you sign in with one of those providers. We receive your name and email, plus your profile picture where the provider supplies one.
• From your organization's identity provider, when an administrator connects SAML single sign-on or a SCIM directory. We receive your name and email to create and maintain your membership.
• From your integrations, when a project owner connects GitHub, Linear, Jira, Intercom, or Slack. The data flows are listed in the integrations section below.
• From your customers and end users, when they submit feedback, vote, or comment on a project you own.
• Automatically, from your browser and our server (cookies, IP address, user agent, request logs).

4. How we use information

We use the information we collect for the purposes below. Each purpose has a legal basis under the EU General Data Protection Regulation and equivalent laws.

You can withdraw consent at any time for processing based on consent. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You can also object to processing based on legitimate interest by emailing us. To stop the weekly digest, turn it off in your notification settings.

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We do not share it with advertising networks, data brokers, or analytics vendors. We do not use customer feedback content to train our own models or third-party general-purpose models.

5. AI processing and automated decisions

InsightLoop uses AI to make feedback easier to act on. When feedback is added to a project, the content is sent to OpenAI over an encrypted connection so we can:

• Read the item to pull out the individual requests it contains and restate each one as a short neutral sentence
• Convert the item and its extracted requests into numeric embeddings used to recognize the same request across different phrasings and to power search
• Decide whether each extracted request belongs to an existing theme, and name and summarize each theme from the requests it contains
• Suggest a category for each item based on the project’s category list
• Compare themes that look alike and merge duplicates
• Draft a product specification when a project member asks for one on a theme

OpenAI is contractually prohibited from using API content to train their models under their API data usage policy. We do not share names, email addresses, or session data with OpenAI. Only the feedback content needed for the task is sent (comments are not sent), and we cap the size of each request. Semantic search also sends the text you search for to OpenAI, so it can be turned into an embedding and matched against your feedback.

No automated decisions about people

The AI features above organize content, not people. Themes, categories, impact scores, and generated drafts describe feedback items, not the individuals who submitted them, and nothing they produce changes who can access what or contacts anyone. Your team can change or undo any of it. InsightLoop makes no decision about an individual based solely on automated processing that produces legal or similarly significant effects under Article 22 of the GDPR.

6. Third-party services and sub-processors

We use the sub-processors below to run the service. Each is limited to a specific purpose and bound by a written data processing agreement.

A current list of sub-processors and material changes are available from privacy@insightloop.io.

7. Integrations and programmatic access

When you connect a third-party tool to InsightLoop, we receive data from that tool so we can mirror it as feedback in your project. You control which tools are connected and can disconnect them at any time from your project settings.

• GitHub. Issues, issue comments, author handle, repository, and labels for the repositories you connect.
• Linear. Issues, comments, author, team, and labels for the teams you connect.
• Jira. Issues, comments, reporter, project, and status for the Atlassian sites and projects you connect.
• Intercom. Customer conversations and the contact who started them, for the workspace you connect.
• Slack. Messages from the channels you opt in, including later edits and deletions, the sender, and timestamps. We also post notifications to a channel you choose.

When you change something in InsightLoop that came from a connected tool, we may write the change back so the source stays in step: status changes, edits, comments, and deletions to GitHub, Linear, and Jira, and comments to Intercom. Writeback stops when you disconnect the tool. Integration access tokens are stored encrypted at rest and tied to the integration that owns them.

API and MCP access

You can let software read and write your project’s data by creating an API key. One key works two ways: with our REST API, called by your own scripts and systems, and with our MCP server, which lets an AI coding agent (such as Cursor, Claude Code, Antigravity, Windsurf, or any other MCP-compatible client) work on your behalf. A key acts as the member who created it and can never read or change more than that member can.

Responses carry the same data that member sees in the dashboard. That rule, rather than any list, is what tells you the scope, and it covers personal information about the people who sent you feedback: their display name, their profile picture, their email address when they signed in with one, a reply address where an integration or an emailed submission supplied one, and anything they wrote. Where that member can read your project’s audit log, responses also carry the IP address and browser recorded against each logged action. Once a response leaves our servers we do not control what happens to it, whether it went to your own system or to a third-party agent governed by that agent’s own terms. Treat API keys like passwords and revoke them as soon as they are no longer needed.

8. Public portal content

Project admins can make a feedback portal public. Anything posted on a public portal (feedback titles and bodies, comments, vote counts, roadmap items, and the display name of the person who posted) is visible to anyone on the internet.

To help portals be discovered, we publish a sitemap of public portal pages, their roadmaps, and their most recent feedback items. We also embed structured data (JSON-LD) on each public page so search engines can render rich results showing the title, vote count, comment count, timestamps, and display names of the submitter and commenters.

We allow a named list of AI crawlers to read public portal content. The current list is published at InsightLoop’s robots.txt and includes crawlers operated by OpenAI, Anthropic, Google, Apple, Perplexity, Common Crawl, Meta, ByteDance, Amazon, Mistral, DuckDuckGo, and You.com. We do not pay for placement and we do not control what those operators do with the content after they fetch it.

Private portals require authentication. They are not crawled, not indexed, and not listed in any sitemap or AI feed. Your email address is never shown on a public portal. Only your display name is visible.

If you want a piece of content removed from public visibility, contact the project admins or delete it from your account. Project admins can also switch the portal to require authentication at any time.

9. Cookies and local storage

InsightLoop sets only strictly necessary and preference entries. No advertising cookies, no analytics, no third-party tracking. Every cookie and storage entry is listed in our Cookie Policy.

10. Security

Technical and organizational measures we apply include:

• Encrypted in transit. All requests use TLS.
• Encrypted at rest. The primary database and Cloudflare R2 are encrypted on disk.
• Encrypted integration secrets. Integration access tokens are encrypted at rest with authenticated encryption and tied to the integration that owns them, so a stored token cannot be reused elsewhere.
• Hashed passwords. Passwords are stored using a one-way cryptographic hash. They are never stored in plaintext.
• Project isolation. Members of one project cannot access another project’s data unless they have been granted access to it.
• API key controls. Keys are project-scoped, listed in your settings, and can be revoked at any time. A key stops working the moment its owner leaves the project or is deactivated.
• Access controls. Production access is restricted to a small group of engineers and authenticated through individual accounts.

No system is perfectly secure. If you believe you have found a vulnerability, please report it to privacy@insightloop.io. We will acknowledge the report within 5 business days.

11. International data transfers

InsightLoop is operated from the United States and our sub-processors are based in the United States and the European Economic Area. If you are located outside those regions, your information will be transferred to and processed in them.

For transfers from the EEA, the United Kingdom, or Switzerland to the United States, we rely on the European Commission’s Standard Contractual Clauses, executed with each sub-processor. The UK addendum and the Swiss equivalent apply where relevant.

12. Data retention

• Sessions expire after 7 days.
• Team invitations expire after 7 days by default.
• Feedback, comments, and votes stay until you delete them or your account, with one exception: archiving is how you free up feedback capacity, so feedback that stays archived for 90 days is permanently deleted along with its comments and attachments. Restore anything you want to keep before then.
• Uploads stay until you delete them or the feedback they belong to is deleted. Files attached to feedback and comments are also removed at the end of your plan's retention window, but only once that feedback is closed or archived. Files on open feedback are never removed. We email the organization owner 7 days beforehand, and the windows are published in the Limits Policy.
• Held integration deliveries (events a connected tool sent while your organization was over its monthly webhook limit) are processed as room becomes available and discarded after 45 days if still waiting.
• Anonymous portal sessions are short-lived. When the visitor signs up or signs in, their content moves to the new account and the anonymous record is deleted. Unclaimed anonymous accounts are deleted automatically after 30 days.
• Server logs (request metadata, error traces) are kept for up to 30 days for security monitoring and debugging.
• Error-monitoring events sent to Sentry are retained for up to 30 days.
• Audit logs recording significant actions across your projects and account (who did what, and when) are kept for up to 390 days.
• Backups of the primary database are encrypted and rotated. Deleted records may persist in a backup for up to 30 days before they are purged.
• Billing records we must keep for tax, accounting, or legal reasons may be retained in minimized form after your account is closed. Payment and invoice records are held by LemonSqueezy as merchant of record.

You can permanently delete your account from your account settings. Before you can delete it:

• Cancel any active subscription, including one you still pay for in an organization you no longer own.
• Either transfer ownership of, or remove the other members from, organizations you own.
• If an organization you own requires single sign-on, make sure you are not its last break-glass account. An administrator can designate another or turn the requirement off first.

When you delete your account:

• We confirm the request by email before anything is removed. The confirmation link expires after 24 hours, and you can request a new one at any time.
• Deletion completes within 30 days: your personal data (name, email, sessions, notification preferences) is removed from active systems, and any backups still holding it are purged on their normal rotation.
• Organizations you own with no other members are deleted with your account, together with their projects.
• In organizations you leave behind, feedback and comments you wrote stay, with the author cleared, so your team's history is not lost. Project admins can delete that content.

13. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate information, either from your account settings or by emailing us
• Delete your account and the personal data tied to it
• Receive a copy of your data in a machine-readable format
• Object to or restrict certain processing, including direct marketing
• Withdraw consent at any time by adjusting your notification preferences, deleting your account, or disconnecting integrations
• Lodge a complaint with a supervisory authority in your jurisdiction

California residents have rights under the CCPA and CPRA, including the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to opt out of any sale or sharing. We do not sell or share personal information, and we do not use it for cross-context behavioral advertising. You can use an authorized agent to make a request on your behalf. We will ask you to verify the agent’s authority.

To exercise any of these rights, email privacy@insightloop.io. We respond within 30 days and we will not discriminate against you for exercising any of these rights. To protect your data we may ask you to confirm your identity before acting on a request.

14. Children

InsightLoop is a business tool and is not directed to children. The minimum age to use it is 16, and in jurisdictions with a lower threshold (for example, 13 under the U.S. Children’s Online Privacy Protection Act), the lower threshold still applies. We do not knowingly collect personal information from anyone below the applicable age. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top. For material changes, we will notify account holders by email or in-product at least 30 days before the change takes effect, unless a shorter notice is required by law or by security or operational necessity.