Date: June 13, 2025

This Privacy Policy (“Policy”) describes how Inšy (“Company”, “we”, “us”, or “our”) collects, uses, discloses, and protects your information when you use our mobile and web application (the “Service”). By accessing or using the Service, you agree to this Policy.

1. Definitions

Account a unique account created for you to access our Service.

Personal Data – Any information relating to an identified or identifiable natural person.

Service Providers – Third parties who process Personal Data on our behalf (e.g., Supabase, PostHog, Fly.io, RevenueCat, OpenAI, Sentry, Mistral).

Usage Data – Information collected automatically when you use the Service.

AI Interaction Data – Prompts and usage metadata sent to third‑party AI model providers (e.g., OpenAI, Mistral) to generate responses.

Google Services Data – Data accessed from Google Workspace APIs (Calendar events, Gmail message metadata or content) with your explicit consent.

You / User – The person accessing or using the Service.

2. Information We Collect

2.1 Personal Data

We collect the following categories of Personal Data:

• Authentication Data: Email address obtained via Apple ID or Google OAuth, and a system‑generated Unique User ID.

• Google Services Data: With your explicit consent, we access Google Calendar (events, calendars) and Gmail (message metadata or content) to enable AI‑driven actions on your behalf. This data is used only to perform the actions you request, and is not used to train or improve generalized AI/ML models.

• Subscription Data: When you subscribe, we collect plan tier, status, and start/end dates via RevenueCat.

2.2 Usage Data

We automatically collect Usage Data, including:

• Device IP address, browser type/version, and operating system
• Pages or screens viewed, session timestamps, click events, and error logs
• Unique device identifiers and diagnostic data

2.3 AI Interaction Data

To power the AI Assistant, we send prompts and receive responses from third‑party AI model providers. We collect:

• Prompt text, user inputs, and related metadata (timestamp, usage counts)
• Model‑generated outputs, which may be cached temporarily for performance

2.4 Error & Performance Data

We use Sentry to collect:

• Error stack traces, exception messages, and impacted session identifiers
• Performance spans, page load times, and latency metrics

3. How We Use Your Data

Authentication and account management

Data used: Authentication Data

Legal basis: Performance of contract

Product analytics and improvement

Data used: Usage Data

Legal basis: Legitimate interests

AI‑driven actions (calendar and email)

Data used: Google Services Data, AI Interaction Data

Legal basis: Consent

Subscription management

Data used: Subscription Data

Legal basis: Performance of contract

Error reporting and performance monitoring

Data used: Error & Performance Data

Legal basis: Legitimate interests

Communications and notifications

Data used: Email address

Legal basis: Consent or legitimate interests

4. Data Retention

Authentication Data: until you delete your account

Usage Data: up to 12 months

Google Services Data: until you revoke OAuth consent

AI Interaction Data: until you delete your account

Error & Performance Data: up to 90 days, unless required longer for compliance

5. Data Sharing and Disclosure

We may share your data with the following Service Providers under data processing agreements (DPAs):

• Supabase – authentication and database (EU region)
• PostHog – analytics (EU region)
• Fly.io – hosting and routing
• OpenAI, Mistral – AI model processing
• Sentry – error and performance monitoring

We may also disclose data to legal authorities when required by law or with your consent for additional purposes.

5.1 Use of Google Workspace API Data

• No Generalized AI/ML Training. We do not use any data obtained through Google Workspace APIs—including Gmail message metadata or content, Calendar events, or other Workspace‑derived data—to develop, improve, or train any generalized (non‑personalized) artificial intelligence or machine learning models. All data accessed via Workspace APIs is used solely to carry out the specific, user‑initiated actions within our Service and is retained only as described in Section 4 (Data Retention).

• Transfers to Third‑Party AI Providers. We send only the exact prompts and minimal usage metadata you submit to our third‑party AI model providers (OpenAI, Mistral). No additional Google Workspace data (e.g., your emails or calendar entries) is shared with these providers, and nothing is used to train their generalized AI/ML models.

6. International Data Transfers

All core services are hosted in the European Economic Area (EEA). If data is transferred internationally, we apply appropriate safeguards such as Standard Contractual Clauses (SCCs).

7. Your Rights

You have the right to:

• Access, correct, or delete your personal data
• Restrict or object to processing
• Request data portability
• Withdraw consent at any time (without affecting prior processing)
• To exercise your rights, contact us at support@insygent.com.

8. Security Measures

We protect your data using:

• Encryption in transit (TLS) and at rest
• Access controls based on roles
• Regular monitoring and security reviews

9. Cookies and Tracking

We use essential cookies and analytics technologies to support functionality. You may disable cookies in your browser settings, but this may impact performance.

10. Children’s Privacy

The Service is not intended for children under the age of 13. We do not knowingly collect data from children. If you believe we have done so, please contact us for removal.

11. Changes to This Policy

We may occasionally update this Policy. If we do, we will change the effective date above and notify you in‑app or via email if the changes are significant.

12. Contact

If you have any questions about this Privacy Policy, please contact us:

Email: support@insygent.com