Privacy Policy

Last updated October 14, 2026

Insertum (“we”, “us”) provides embeddable widgets for NPS surveys, testimonials and customer feedback. This policy covers our website at insertum.io, the dashboard at app.insertum.io, and the widgets our customers place on their own sites. Questions go to support@insertum.io.

Two roles

For visitors to our website and people with an Insertum account, we decide how personal data is used and are responsible for it as the controller.

When you answer a survey or leave a testimonial in a widget on another company’s site, that company (our customer) decides what is collected and why. We process those responses on its behalf, as its processor. To access, correct or delete a response, contact that company first; we help our customers handle these requests.

What we collect

On our website

insertum.io sets no cookies and runs no advertising trackers. We use Vercel Web Analytics to count page views. It is cookieless and reports aggregates such as pages viewed, referrers, browser type and country, not individual visitors.

For account holders

• Your name and email address, and your password, which our authentication provider stores only as a hash.
• If you sign in with Google: the name, email address and profile picture Google shares with us.
• Your organizations, workspaces, team members and invitations.
• What you create in the dashboard, such as widgets, designs and settings.
• Cookies on app.insertum.io that keep you signed in. They are necessary for the dashboard to work.

Responses collected through widgets, on behalf of our customers

• Answers: scores, comments, feedback and testimonials, and whether you agreed to a testimonial being published.
• Details you enter or the customer provides, such as name, email address, company, profile picture, and the customer’s own user ID and attributes.
• The website the response came from, your browser’s user agent, and when you responded.
• A keyed hash of your IP address, never the address itself, used to limit abuse. Submissions also pass Cloudflare Turnstile, a bot check that does not ask you to solve puzzles.

How we use it

• To provide the service: run your account, show customers the responses their widgets collect, and publish testimonials they approve.
• To keep it secure: rate limits, bot checks and abuse investigations.
• To send emails the service needs, such as address verification, password resets and team invitations.
• To answer support requests and improve the product, using aggregated usage where we can.
• To meet legal obligations.

We do not sell personal data or use it for advertising.

If you are in the EEA or the UK, we rely on these legal bases: performing our contract with you; our legitimate interests in securing and improving the service and understanding website traffic; your consent, where we ask for it; and legal obligations.

Who we share it with

We use a small set of providers to run Insertum, listed on our subprocessors page. They process data only on our instructions. Otherwise we share personal data only when the law requires it, or with a successor if Insertum is sold or merged, in which case we will tell you first.

Our providers may process data outside your country, including in the United States. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses.

How long we keep it

We keep account data while your account is open. Customers control the responses their widgets collect: deleting a contact or a widget in the dashboard deletes its responses. To delete your account and all of its workspaces, email support@insertum.io from the address on the account.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent you have given. Email support@insertum.io; we may need to confirm it is you. You can also complain to your local data protection authority.

Security

Data travels over HTTPS. Access to production systems is limited to the people who run Insertum. Signing secrets for identity verification are encrypted at rest, and IP addresses are stored only as keyed hashes.

Children

Insertum is not directed at children under 16, and we do not knowingly collect their personal data.

Changes

We will update the date at the top when this policy changes, and email account holders before material changes take effect.