Data protection
Data Processing & Sub-processors
Last updated 17 July 2026 · Version 2026-07-17
Working draft. This document is under legal review. It is provided in good faith to describe how Insights handles your data today, but does not create contractual obligations until a signed version is issued.
When Insights processes personal data on behalf of a customer, it does so as a processor under the terms of our Data Processing Addendum (DPA). A signed DPA can be requested from privacy@insights.co.
Sub-processors
The following sub-processors help us deliver the service. We commit to giving 30 days' notice of material changes to this list.
| Provider | Purpose | Data shared | Location | Transfer basis | DPA |
|---|---|---|---|---|---|
| Supabase | Managed Postgres database, authentication, file storage. | All application data (see data inventory). | European Union (Ireland/Frankfurt region). | — | Link |
| Cloudflare | Content delivery, DDoS protection, edge runtime. | IP address, user-agent, request metadata. | Global edge network. | Standard Contractual Clauses (SCCs). | Link |
| Lovable AI Gateway (Google Gemini) | Generate AI analyses and report drafts. | Prompts derived from research content, with basic PII masking on free-text respondent answers. Provider does not train on inputs. | United States / European Union. | Standard Contractual Clauses (SCCs) via the AI Gateway. | Link |
| Resend (email)(optional) | Send transactional and notification email. | Recipient email address, message content. | United States / European Union. | Standard Contractual Clauses (SCCs). | Link |
| Stripe(optional) | Process subscription payments. | Billing name, email, payment method (handled directly by Stripe). | United States / Ireland. | Standard Contractual Clauses (SCCs). | Link |
| HubSpot(optional) | Marketing CRM (only if the organisation enables the integration). | Contact name and email; company name; engagement milestones. | United States / European Union. | Standard Contractual Clauses (SCCs). | Link |
How to request a signed DPA
Email privacy@insights.co with your legal entity name and signatory. We will return a countersigned copy within five business days.