Privacy Policy

1. Our role: controller and processor

Insighterr is a business-to-business service. For the Customer Data described below (call recordings, transcripts, evaluations and related content), your organization (the “Customer”) is the controller (or “business”) and Insighterr acts as its processor (or “service provider”), handling that data only on the Customer's documented instructions and under our Data Processing Addendum. For account, security and website data, Insighterr is the controller.

If you are an agent or employee whose calls are analyzed, your employer is the party responsible for informing you and obtaining any required consent. Please direct privacy requests about your calls to your employer; we will assist them in responding.

2. Information we process

Customer Data (provided by or on behalf of the Customer):

• Call audio, and transcripts with speaker labels and timestamps generated from it.
• Call metadata the Customer supplies (for example agent name, campaign, dates, disposition, custom columns).
• AI-generated evaluations, scores, summaries, coaching content and chat conversations about the data.
• Customer-defined configuration: scorecards, prompts, dashboards and saved reports.
• Storage connection credentials the Customer provides (encrypted at rest and never returned by our API).

Calls may contain personal information about callers and agents, including information a caller volunteers. We do not ask for or intentionally target sensitive categories.

Account and usage data:

• Name, work email, role, team, permissions, and a password hash (or SSO identity).
• Sign-in and session records, IP address, device and browser information, and security logs.
• Product usage and metering: call duration ingested, AI token counts, and feature activity. Usage records contain identifiers and counts, not call content.
• Messages you send us (for example access or SSO requests).
• Preferences stored in your browser, such as theme and sign-in state.

3. How we use information

• To provide the Service: ingest, transcribe, index, search, evaluate and chart calls, and answer questions in chat.
• To authenticate users, enforce role-based access, and keep the Service secure.
• To send operational emails such as password-reset codes and notifications.
• To measure usage, support billing, troubleshoot and improve reliability.
• To comply with law and enforce our Terms.

We do not sell personal information, do not use Customer Data for advertising, and do not use Customer Data to train our own or third-party foundation models.

4. AI processing

Evaluations, summaries and chat are produced by large language models. Transcript text and prompts are sent to the model provider the Customer (or we, on its behalf) has configured, such as Amazon Bedrock, Google Vertex AI, or Azure OpenAI/Foundry, over encrypted connections, solely to generate the response. These providers act as our subprocessors under terms that restrict use of the data to providing the service. Speech-to-text, speaker detection and semantic-search embeddings run on infrastructure we operate. AI output can be inaccurate; it should support, not replace, human judgment, especially for decisions about people.

5. Subprocessors and sharing

We share information only as needed to run the Service:

• Cloud infrastructure and storage: Amazon Web Services and/or Google Cloud (compute, databases, object storage).
• AI model providers selected for the organization (see section 4).
• Email delivery providers for transactional email.
• Identity providers the Customer configures for single sign-on.
• Professional advisers, and authorities where required by law or to protect rights and safety.
• A successor in a merger, acquisition or asset sale, with notice to affected Customers.

A current subprocessor list is available on request at [email protected].

Within a Customer's organization, access is limited by role (admin, analyst, supervisor, agent) and by assigned campaigns, teams and agents.

6. Call recording and consent

Many jurisdictions require notice to, or consent from, call participants before a call is recorded or analyzed (for example all-party-consent laws in several U.S. states, and GDPR in the EU/UK). Customers are solely responsible for lawful recording, required announcements, and a valid legal basis for uploading calls to the Service. We do not record calls ourselves; we process recordings the Customer provides.

7. Retention and deletion

We retain Customer Data for the duration of the Customer's subscription, unless the Customer deletes it sooner. After termination we delete or return Customer Data within 90 days, except where law requires longer retention; backups roll off on their normal cycle. Account, security and billing records are kept as long as needed for legitimate business and legal purposes. Deleting records in the Service requires password re-confirmation.

8. Security

We use encryption in transit (TLS) and at rest, hashed passwords, optional single sign-on, role-based access control that limits every query to the user's permitted data, rotating short-lived session tokens, login rate limiting, and audit-friendly usage records. No system is perfectly secure; we will notify affected Customers of a confirmed breach without undue delay and as required by law.

9. International transfers

Data may be processed in countries other than where you live, including India, the United States and other regions where our providers operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Your rights

Depending on where you live (for example under GDPR, UK GDPR, CCPA/CPRA or India's DPDP Act), you may have the right to access, correct, delete, restrict or port your personal data, to object to certain processing, to withdraw consent, and to complain to a regulator. We do not discriminate against anyone for exercising these rights. For Customer Data, please contact the Customer (your employer) first; for account and website data, email [email protected]. We may need to verify your identity before acting.

11. Cookies and local storage

We use essential cookies for sign-in (httpOnly access and refresh tokens, and a short-lived single sign-on flow cookie) and browser local storage for preferences such as theme and interface state. We do not use advertising or cross-site tracking cookies.

12. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect children's data.

13. Changes

We may update this policy. Material changes will be notified by email or in the Service before they take effect, and the “Last updated” date above will change.