Privacy Policy

1. Controller

SG5 Digital Solutions — Ing. Simon Gorski, MA, Währinger Strasse 80-82/1, 1180 Wien, Österreich, [email protected], +43 677 62 999 140. A data protection officer is not required by law; please direct any requests to the address stated above.

2. Two roles: for whom we process which data

InsightHub is used by businesses ("customers") to advise their website visitors, buyers, prospects, and callers ("end users"). Two roles must be distinguished here:

• We as controller: for data of visitors to our own pages (landing page, help), of prospects (contact and trial forms), and of users of the platform my.insighthubapp.com (customer accounts, billing, support).
• We as processor: for all data that end users generate via a customer's widget, WhatsApp, phone assistant, or plugins, as well as for the shop, product, order, and lead data synchronized by the customer. The controller here is the respective customer; the basis is our Data Processing Agreement. End users should address their requests to the business whose website or shop they used — we support the customer in responding.

3. Visiting our pages

When you access the pages at www.insighthubapp.com and my.insighthubapp.com, our hosting provider and our network service provider process technical access data (IP address, time, address accessed, browser and operating system information, referrer) in server logs for delivery, security, and error analysis (Art. 6(1)(f) GDPR). Logs are deleted after 90 days at the latest. We do not use any analytics or marketing trackers. Fonts are loaded from our own servers.

The help pages do not store any cookies. Embedded product videos are loaded from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4) only after you click, in privacy-enhanced mode; in doing so, YouTube receives your IP address and may set cookies (Art. 6(1)(a) GDPR through active playback). Google is certified under the EU-US Data Privacy Framework.

4. Contact and trial requests

We process details from contact or trial forms (name, e-mail, company, shop URL, platform, message) to handle the request and to set up the trial environment (Art. 6(1)(b) GDPR). The form e-mails are delivered via the e-mail service Postmark (ActiveCampaign, LLC, USA) on the basis of standard contractual clauses and certification under the EU-US Data Privacy Framework. We delete requests as soon as no contract is concluded and no retention obligation exists, at the latest after twelve months.

5. Customer account and billing (my.insighthubapp.com)

• Account: name, e-mail address, password (as a hash), optional two-factor secret, role, language, login times, and security-related logs (Art. 6(1)(b) GDPR). The application sets technically necessary cookies (session, CSRF protection); no tracking cookies.
• Billing: invoice and payment data are processed by our payment service provider Stripe Payments Europe, Ltd. (Dublin, Ireland); card data does not reach our systems. We retain invoice data for seven years in accordance with § 132 Bundesabgabenordnung (BAO, Federal Fiscal Code) (Art. 6(1)(c) GDPR).
• System e-mails (invitations, reports, notifications) are sent via Postmark (see Section 4).
• Support: E-mail and ticket communication is processed to perform the contract (Art. 6(1)(b) GDPR). On request, a bug report from the application carries diagnostics (the page you were on, version, browser, the last error messages and failed requests with status code and request id – no typed text or content – plus a screenshot you see before sending); this data stays in our systems.

Electronic signing of the Data Processing Agreement. You can sign the agreement electronically on the DPA page. For this we operate the signing service DocuSeal ourselves (sign.sg5.biz). We process the company name, the name of the signatory, the email address, the business address, the signature, the time and the IP address in the document's audit trail. The legal basis is Art. 6(1)(b) GDPR (conclusion of the contract). We keep the signed document for the duration of the business relationship and afterwards according to statutory retention periods.

6. What InsightHub processes on behalf of our customers

The following processing operations take place only if the customer activates the respective feature. The controller is the customer; we process on the customer's instructions (Art. 28 GDPR).

• Chat widget: end users' messages and the assistant's responses, time, language, and, where applicable, identifiers passed by the customer (e.g. customer ID). In the browser, the widget stores only the language selection and the display state (Local Storage) as well as a session marker for campaign attribution (Session Storage); it does not set any cookies.
• AI processing: to generate responses, messages and the relevant knowledge data are passed to a language model. By default this is Microsoft's Azure OpenAI Service (Microsoft Ireland Operations Ltd.) with processing exclusively in the Azure region Sweden Central (EU); search uses embeddings from Mistral AI (Paris, France, EU). The models are not trained on customer data. If a customer stores their own keys for another provider (e.g. OpenAI), processing takes place there under the customer's responsibility.
• Campaign attribution: UTM parameters, landing page, referrer, time, and a random visitor identifier in order to attribute requests to a campaign.
• Leads and contacts: contact data entered by the end user or by the customer (name, e-mail, phone, request, custom fields), conversation history, status, notes, and documents the customer files with a lead. Documents are stored in the object storage of Hetzner Online GmbH (Falkenstein, Germany) unless the customer has configured their own storage (Nextcloud, S3, SFTP).
• WhatsApp channel (add-on): phone number, profile name, and message content of the WhatsApp communication, transmitted via the WhatsApp Cloud API of Meta Platforms Ireland Ltd. (Dublin). WhatsApp's privacy notice applies to transmission within WhatsApp; the customer is responsible for their WhatsApp Business account.
• Phone assistant InsightHub Voice (add-on): the caller's phone number, time, duration, and the text transcript of the call. Calls are not recorded as audio. Telephony is provided via Twilio Ireland Ltd. (Dublin); speech-to-text and text-to-speech conversion via Deepgram, Inc. (USA, standard contractual clauses). Callback requests are stored as a lead; transfers are made to phone numbers configured by the customer.
• Shop data: products, content, categories, and — depending on the feature — customer and order data (name, e-mail, order number, line items, status) that the customer synchronizes from their shop system.
• Reviews and surveys: e-mail address and name for invitations, responses, ratings, and free-text answers; invitations contain an unsubscribe link. At the customer's request, we import public Google reviews via the Google interfaces (Google Ireland Limited).
• Appointment booking (Google Calendar): if the customer connects their Google Calendar, InsightHub reads only the busy times (start and end, no content) of the selected calendar to offer free slots, and creates the appointments booked through InsightHub as events there or deletes them on cancellation. No other calendar content is read or stored; the access credentials (refresh token) are stored encrypted and can be disconnected at any time in the settings. InsightHub's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Cart reminders: shopping cart (items, value), e-mail address, and, where applicable, name and phone number. Reminders are sent only after the buyer's explicit consent (Art. 6(1)(a) GDPR); the consent text and time are logged, every e-mail contains an unsubscribe link, and carts are deleted after the retention period configured by the customer (default 60 days).
• Helpdesk: request, e-mail address, and history of support tickets that end users open via the widget.

7. Recipients and processors

Data processing agreements are in place with all service providers. Data is not disclosed for advertising purposes or sold. Authorities receive data only where legally required.

8. Transfers to third countries

Hosting and AI processing take place in the EU. For the service providers listed in Section 7 that are established in or process data in the USA, we base the transfer on adequacy decisions (EU-US Data Privacy Framework) or the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR), together with supplementary measures such as transport encryption.

9. Retention period

• Account and contract data: for the term of the contract; thereafter deletion after 30 days, unless retention obligations exist.
• Data processed on behalf of customers (chats, leads, logs, shop data): for the term of the contract or until deleted by the customer; complete deletion no later than 30 days after the end of the contract. Customers can delete individual data at any time.
• Server logs: up to 90 days. Shopping carts: after the configured retention period (default 60 days). Invoice data: seven years.
• Backups: encrypted, rolling, deletion within the backup rotation.

10. Data security

Transport encryption (TLS) on all connections, encryption of stored credentials and keys, role-based access rights, two-factor authentication, logical tenant separation, encrypted backups, and logging of security-related events. Details are set out in Annex 2 of the Data Processing Agreement.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21), as well as the right to withdraw any consent given at any time. To do so, please contact [email protected]. If your request concerns the website or shop of one of our customers, we forward it to that customer or support them in responding. You also have the right to lodge a complaint with a supervisory authority, in Austria with the Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Wien, www.dsb.gv.at.

12. No automated decision-making

InsightHub does not make automated decisions with legal effect within the meaning of Art. 22 GDPR. The assistant answers questions and records requests; decisions on contracts, prices, or claims are made by the respective customer.

13. Changes to this policy

We amend this policy when our offering, our service providers, or the legal situation changes. The current version can always be found at this address; we notify customers of material changes by e-mail or in the customer account.