Legal

Privacy Policy

Last updated: June 6, 2025

1. Overview

Insightlytix (“we”, “our”, or “us”) is an AI-powered analytics assistant that connects to your Google Analytics 4 (GA4) account and generates plain-English business insights. This policy explains what data we collect, how we use it, and the choices you have.

2. Data we collect

Account data

When you sign in with Google, we receive your name, email address, and profile photo. We store your email address and the plan you are on in our database. We do not store your Google password.

Google Analytics data

We read traffic, engagement, and conversion data from your GA4 property using read-only access. We do not store your raw Google Analytics data. Data is fetched on demand when you load a dashboard or request an AI analysis, and is not written to our database.

Usage data

We track how many AI analyses you have run per month. This count is stored in our database alongside your email and plan to enforce plan limits. We do not store the content of individual analyses.

Site context

If you choose to describe your business (business type, target market, primary goal) to personalise your AI analysis, this text is stored locally in your browser (localStorage) and is never sent to our servers except as part of an AI analysis request.

3. How we use your data

To authenticate you and maintain your session
To fetch your Google Analytics data and display it in your dashboard
To generate AI-powered insights using OpenAI’s GPT-4o model
To enforce plan-based usage limits
To send you monthly AI analysis reports if you are on a paid plan (Starter or Pro)
To respond to support enquiries

We do not sell your data, use it for advertising, or share it with third parties except as described in Section 4.

4. Third-party services

Google (OAuth & Analytics API)

Sign-in is handled via Google OAuth. We request read-only access to your Google Analytics accounts. Your use of Google services is governed by Google’s Privacy Policy.

OpenAI

When you request an AI analysis, anonymised, aggregated GA4 metrics are sent to OpenAI’s API to generate insights. No personally identifiable information about your website’s visitors is included. OpenAI’s data use is governed by their Privacy Policy.

Supabase

User account data (email, plan, usage count) is stored in a Supabase (PostgreSQL) database hosted in the EU. Supabase’s data handling is governed by their Privacy Policy.

Stripe (planned)

Payment processing will be handled by Stripe. Card details are never transmitted to or stored by Insightlytix. Stripe’s data handling is governed by their Privacy Policy.

5. Data retention

We retain your account record and usage counts for as long as your account is active. If you request account deletion, we will remove your email address, plan record, and usage history from our database within 30 days. Because we do not store raw GA4 data, there is no analytics data to delete on our end.

6. Your rights

Depending on your location, you may have the right to access, correct, or delete the personal data we hold about you. To exercise any of these rights, or to revoke Insightlytix’s access to your Google Analytics account, contact us at the address below. You can also revoke access at any time via Google Account Permissions.

7. Data use restrictions

Insightlytix’s use of data received from Google APIs — including your Google account information and Google Analytics data — is subject to the Google API Services User Data Policy, including the Limited Use requirements.

We explicitly confirm that Google user data is never used for:

Serving targeted or personalised advertising
Selling to data brokers or any third party
Training artificial intelligence or machine learning models
Credit assessment or determining creditworthiness
Any purpose not directly required to provide Insightlytix’s analytics service to you

When GA4 metrics are sent to OpenAI to generate your insights report, that data is used solely to produce the response returned to you. OpenAI’s API terms prohibit using API inputs to train their models. No personally identifiable information about your website visitors is included in any data sent to OpenAI.

9. Cookies and local storage

We use cookies strictly for authentication (NextAuth.js session cookie). We use your browser’s localStorage to cache dashboard data and store your site context description locally. We do not use tracking or advertising cookies.

10. Security

All data is transmitted over HTTPS. We use Google OAuth — we never see or handle your Google password. Database access uses role-based permissions and row-level security. OAuth tokens are stored server-side and never exposed to the browser.

11. Changes to this policy

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of Insightlytix after changes are posted constitutes your acceptance of the updated policy.

12. Contact

Questions about this policy? Email us at adetunjiaramide@gmail.com.