Privacy Policy

Who we are

INSG is a privacy-first web analytics service operated by INSG (sole proprietor).

• Website: insg.io
• Email: privacy@insg.io

When we say "we," "us," or "our," we mean INSG. When we say "you," we mean you — either as an INSG account holder or as a visitor to a website that uses INSG.

Data Protection Officer

INSG has not appointed a Data Protection Officer. Under Article 37 of the GDPR, a DPO is required when an organization carries out large-scale systematic monitoring of individuals or large-scale processing of special categories of data. INSG does neither — the visitor data we store carries no direct identifiers, is scoped to a single site, cannot be linked across sites or across days, and becomes permanently unlinkable within 48 hours. Beyond that we hold only minimal account data from our customers. If you have privacy questions, contact privacy@insg.io.

Purposes and legal basis for processing

We process data for the following purposes:

What we collect from website visitors

When you visit a website that uses our tracking script, we collect the following data for each pageview:

• Page URL and hostname
• Referrer URL (the page you came from)
• Country (determined at the network edge using IP geolocation — the IP address itself is not stored)
• Browser name and operating system
• Device type (desktop, mobile, tablet) and screen size
• UTM campaign parameters (if present in the URL)
• Page performance metrics (loading speed, visual stability, responsiveness)
• Outbound link clicks and file download clicks (hostname and path only)
• Scroll depth milestones (25%, 50%, 75%, 100%)
• Attention time (seconds spent actively viewing the page)
• Behavioral signals stored as aggregate rollups: click patterns, scroll behavior, content engagement, page element visibility
• Click heatmap coordinates (aggregated per page)
• Page structure snapshots for heatmap overlay (all visible text redacted, form values stripped)
• Copy-text events (truncated to 20 characters, email addresses automatically redacted)

Session grouping is done entirely server-side. No session token is stored in the browser. The tracker writes nothing to cookies, localStorage, or sessionStorage. The only client-side storage access is a localStorage read to check for the opt-out flag (insg_ignore).

What we do NOT collect:

• IP addresses — never stored. Your IP is held transiently in server memory, combined with your User-Agent, language, screen width, the site's ID and a secret key for that day, then fed through a one-way SHA-256 hash. Only the truncated hash is stored, and the original IP cannot be recovered from it. The key is 32 random bytes, generated fresh each day and destroyed 48 hours later — once it is gone, the stored identifiers cannot be recomputed or matched back to a device by anyone, including us. Being precise about the limit rather than overclaiming: during those 48 hours the identifier can group one device's activity on one site.
• Cookies — we never set any
• Personal information — no names, emails, phone numbers, or account IDs
• Browser fingerprints — no canvas, WebGL, font, audio or hardware probing. The visitor identifier is derived only from what your browser already sends with every request (IP, User-Agent, language, screen width); we never interrogate your device for anything beyond that.
• Cross-site tracking data — the site's ID is part of the hash input, so one device visiting two INSG-tracked sites produces two unrelated identifiers that cannot be matched to each other

The identifier is stored alongside each pageview for visitor counting and server-side session grouping. The stored value remains in the database for the site's retention period (Free: 90 days, Standard: 1 year, Pro: 2 years) and is then permanently deleted — but it stops being linkable to any device after 48 hours, when the key that produced it is destroyed. A new key each day also means the same device returning tomorrow produces an entirely different identifier, so there is no continuous thread from one day to the next.

What this means for a visitor erasure request: we can identify and delete your rows only within that 48-hour window, because that is the only period in which your data can be recognised as yours at all. Past it there is nothing left to point at — the rows survive as unattributable counts, which is the intended outcome rather than a gap in the process. If you want to exercise this right, contact us within 48 hours at privacy@insg.io.

What we collect from INSG account holders

• Email address (for login and account communication)
• Password (securely hashed — we cannot read your password)
• Payment information (processed by Stripe — we do not store card numbers)
• Site domains you add to your account

This data is stored securely and used only for providing the INSG service. We do not sell, share, or rent your personal information to third parties.

Shopify integration

Storefront pixel (visitor side)

When a Shopify merchant installs INSG, our web pixel runs inside Shopify's sandboxed customer-events environment. It captures e-commerce funnel events (product viewed, collection viewed, cart updated, checkout started, address submitted, shipping submitted, payment submitted, purchase, search) plus product metadata (product id, name, variant, price, currency). It writes no cookies and no client-side storage. Visitor identity is a short per-day device token computed inside Shopify's sandbox (from User-Agent, language and screen size). Because that sandbox hides the request headers our servers would normally use, the token is produced client-side — so on arrival we immediately re-hash it with the store's site ID and the same secret daily key used everywhere else in INSG, and only that result is stored. What lands in our database is therefore protected by a key destroyed after 48 hours, exactly like the rest of INSG. No PII.

The pixel respects Shopify's Customer Privacy API: if the visitor has opted out of analytics, no events are emitted.

Shopify Admin API (merchant side)

On install, INSG performs a one-time historical backfill via the Shopify Admin API: up to 90 days of completed orders. After that, ongoing orders flow in via the orders/paid webhook (when registered).

Per-field disclosure: what INSG ingests from Shopify orders

The Shopify orders/paid webhook payload includes Protected Customer Data fields (email, name, phone, billing/shipping addresses). INSG discards every Protected Customer Data field at the point of receipt — they are dropped in the normalizer (normalizeShopifyWebhookOrder) before any downstream handler runs and before anything is logged or persisted. The full per-field table:

One caveat we would rather state than gloss over: customer_hash is a plain SHA-256 of the store's site ID and the Shopify customer ID, with no secret key. It is scoped to a single store, and we never receive the email, name, phone or address that would make it identifying — but unlike the visitor identifier it is not protected by a key that expires, so someone who already held both the site ID and a specific Shopify customer ID could confirm a match against it. It exists for one purpose: joining a store's own orders together so the merchant can count repeat buyers.

Cart recovery emails

When INSG detects checkout abandonment (the visitor reached the address step but did not complete payment), it fires a Shopify Flow trigger (insg-checkout-shipping-hesitation) with the opaque checkout_token and the site-scoped visitor identifier. INSG does not handle the recovery email itself. The merchant configures a Shopify Flow workflow that uses Shopify's own customer record to send the email — the email address never leaves Shopify's boundary, and INSG never sees it.

Sub-processors for Shopify integration data

• Cloudflare Workers + D1 — runtime + primary storage for normalized order data and shop configuration (region: globally distributed; aggregated metrics only on the storage side)
• Cloudflare R2 — long-term archive of aggregated event data
• Stripe — billing for paid INSG plans (does not receive Shopify order data)

We do not transfer Shopify order data to third-party advertising networks, data brokers, AI training providers, or any party other than the sub-processors listed above.

Retention

• Free plan: 90 days rolling
• Standard plan: 365 days rolling
• Pro plan: 730 days rolling
• On app uninstall, all shop configuration data is deleted within 48 hours; all commerce data within 30 days (per Shopify's GDPR webhook handling)

Shopify GDPR / CCPA webhook compliance

INSG implements Shopify's three mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) at app.insg.io/webhooks. Because INSG holds no email/name/phone/address for shoppers, customer data requests return only the customer_hash and any orders linked to it; redact requests delete the hash and its linked rows. Shop-level redact requests delete all data for that store within 30 days.

Cookies

Our tracking script sets zero cookies on your visitors' browsers. The INSG website itself uses a session cookie when you log in to your account — this is a strictly necessary cookie for authentication and does not require consent under GDPR/ePrivacy.

Third-party services and data processors

We use the following third-party services to operate INSG:

• Cloudflare, Inc. (US) — Infrastructure provider. All analytics data is processed and stored on Cloudflare Workers, D1 (database), KV (cache), R2 (object storage), and Durable Objects. Cloudflare processes data globally at edge locations but persistent storage is in Western Europe (EU). Transfer mechanism: EU Standard Contractual Clauses (SCCs) as part of Cloudflare's Data Processing Addendum.
• Stripe, Inc. (US) — Payment processing. Receives account holder payment information only. PCI-DSS compliant. Transfer mechanism: EU-US Data Privacy Framework + SCCs.
• Resend (US) — Transactional email delivery (email reports, account notifications). Receives account holder email address only. Transfer mechanism: SCCs.
• OpenAI (US) — AI-powered analysis features (Standard and Pro plans). Receives only aggregate statistical summaries — no personal data, visitor identifiers, or raw events. Transfer mechanism: SCCs + OpenAI's Data Processing Addendum.
• Google — OAuth login only (if you choose Google Sign-In). We receive your email and name; Google receives the OAuth authorization code. Transfer mechanism: EU-US Data Privacy Framework.
• Shopify — For Shopify App Store merchants only. We receive e-commerce events and order totals via Shopify's pixel and webhook APIs. No customer personal data is transmitted to INSG.

We do not use Google Analytics, advertising networks, or any other tracking services on insg.io.

International data transfers

Our primary database is hosted in Western Europe (EU). Data processing occurs on Cloudflare's global edge network, which means analytics data may transit through non-EU locations during processing. However, all persistent storage (databases, caches, archives) is EU-based.

For third-party processors located outside the EEA (Cloudflare, Stripe, Resend, OpenAI), we rely on EU Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework as the legal mechanism for data transfers under GDPR Chapter V.

Data retention

• Analytics events and behavioral rollups: retained per plan (Free: 90 days, Standard: 1 year, Pro: 2 years). The 30-day free trial uses the selected plan's retention.
• Visitor identifier keys: 48 hours. The keys that make stored identifiers linkable to a device are destroyed on that schedule regardless of plan, so event rows outlive the ability to attribute them.
• Heatmap snapshots and click data: 90 days regardless of plan.
• Account data (email, site domains): retained until you delete your account.
• Payment records: retained by Stripe per their retention policy and applicable tax/accounting laws.

Retention is enforced by a daily automated process that permanently deletes expired events, rollups, and archived data. When you delete your account, all associated data is permanently removed.

Your rights

GDPR rights (EU/EEA/UK residents):

If you have an INSG account, you have the right to:

• Access — request a copy of your personal data (Art. 15)
• Rectification — correct inaccurate data (Art. 16)
• Erasure — delete your account and all associated data (Art. 17)
• Restriction — request we restrict processing of your data (Art. 18)
• Portability — receive your data in a structured, commonly used, machine-readable format and transmit it to another controller (Art. 20)
• Objection — object to processing based on legitimate interest (Art. 21)
• Withdraw consent — where consent is the legal basis (e.g., Shopify marketing email processing), you may withdraw at any time. Withdrawal does not affect the lawfulness of processing before withdrawal (Art. 7(3)).

If you are a visitor to a website using INSG, we hold no name, email address, phone number, account ID or IP address for you, and we build no profile of you across sites or across days. For the first 48 hours, pageviews from one device on one site can be grouped together; after that the key that made the grouping possible is destroyed and the rows become unattributable. Erasure is therefore possible only inside that 48-hour window, as described under "What we collect from website visitors" above.

Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement. A list of EU data protection authorities is available at edpb.europa.eu.

CCPA/CPRA rights (California residents):

Under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know — you may request what personal information we have collected about you in the past 12 months, including categories, sources, purposes, and third parties.
• Right to delete — you may request deletion of your personal information.
• Right to correct — you may request correction of inaccurate personal information.
• Right to opt out of sale/sharing — INSG does not sell or share personal information as defined by the CCPA/CPRA. We do not sell data to third parties, share data for cross-context behavioral advertising, or use data for targeted advertising. There is nothing to opt out of.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA/CPRA rights. You will receive the same service quality and pricing regardless of whether you exercise your rights.

Sensitive personal information:

INSG does not collect sensitive personal information as defined by the CPRA (Cal. Civ. Code § 1798.140(ae)), including social security numbers, financial account details, precise geolocation, racial or ethnic origin, religious beliefs, genetic data, biometric data, health data, or sexual orientation.

CCPA categories of personal information collected (past 12 months):

• Identifiers (account holders only): email address. Source: directly from you. Purpose: account management. Shared with: Stripe (payment), Resend (email delivery).
• Internet or electronic network activity (website visitors): page URLs, referrers, browser type, device type. Source: automatically collected via tracking script. Purpose: provide analytics reports. Shared with: Cloudflare (infrastructure).
• Geolocation data (website visitors): country only (not precise). Source: IP geolocation at network edge. Purpose: geographic traffic reports. Shared with: Cloudflare (infrastructure).
• Commercial information (Shopify stores): order totals, product metadata. Source: Shopify Admin API. Purpose: revenue and commerce reports. Shared with: Cloudflare (infrastructure).

To exercise any of these rights, email privacy@insg.io. We will respond within 30 days (GDPR) or 45 days (CCPA).

Automated decision-making

INSG does not make automated decisions about individuals. Our SBDA diagnostic engine analyzes aggregate page-level metrics (bounce rates, click patterns, scroll behavior) to identify conversion issues on websites. These diagnostics are about pages and site performance, not about individual visitors. No profiling of individuals occurs, and no decisions with legal or similarly significant effects are made about any person based on automated processing.

Data sanitization

All event data undergoes automatic server-side sanitization before storage:

• Email patterns are automatically detected and stripped from event data
• URL query strings are removed from stored URLs — only hostname and path are kept
• Page structure snapshots have all visible text redacted and form values stripped
• Copy-text tracking is truncated to 20 characters with email pattern redaction

Data storage and security

• Primary database hosted in Western Europe (EU), encrypted at rest
• All data transmitted over HTTPS
• Passwords hashed using industry-standard algorithms
• Payment processing handled by Stripe (PCI-DSS compliant)
• Account deletion permanently removes all data — events, behavioral data, heatmap data, analysis results, and archives

Compliance

• GDPR & ePrivacy Directive — No cookies, no client-side storage. No consent banner required for our tracking script.
• UK GDPR & PECR — Same: no cookies, no client-side storage.
• CCPA / CPRA — No sale or sharing of personal information. Sensitive PI not collected.
• LGPD, PIPEDA, POPIA, APPI — Data minimization approach designed for global compliance.

Privacy laws differ in scope, but they all favor data minimization. Consult your privacy counsel for your specific situation.

Changes to this policy

We may update this privacy policy from time to time. We'll post the updated version here and update the "Last updated" date. For significant changes, we'll notify account holders by email.

Contact

Questions about this policy? Email privacy@insg.io.