Who operates the service
InsertAI is operated by Consultdemy LLC (“Consultdemy,” “we,” “us,” or “our”). This policy applies to the InsertAI website, product, agency and company workspaces, AI features, research tools, and support services.
Our data-protection roles
Consultdemy is a controller for information used for its own website, demo, account administration, security, service communications, and direct business relationship. When a customer places its CRM, commerce, advertising, website, or other business data in a workspace, Consultdemy processes that Customer Data for the customer under its instructions as a processor or service provider. Those processing terms are in our Data Processing Addendum.
Information we collect
- Account information: your name, business email, company, role, authentication records, invitations, permissions, and preferences.
- Demo and support information: the details you submit, including your company, website, growth question, desired timing, support messages, and an obscured network identifier used to prevent form abuse.
- Connected business data: only the data allowed by the permissions you approve, such as Meta campaign, ad account, ad creative, and performance data; Shopify store, product, order, and refund data; HubSpot deal and pipeline data; Google Ads campaign and performance data; Google Analytics 4 acquisition, landing-page, event, and revenue reporting; Google Search Console query, page, click, impression, click-through-rate, and position data; and Webflow site or form data when those integrations are enabled.
- Your business context and work product: goals, constraints, competitors, customer insights, evidence, hypotheses, test plans, decisions, feedback, files, and AI chat history.
- Public market research: public webpages, public advertisements, business listings, reviews, social posts, and similar public sources gathered directly or through research providers.
- Technical and usage information: browser and device information, IP-derived security signals, timestamps, feature activity, errors, audit events, and plan or credit usage.
Please do not place passwords, payment card details, access tokens, health information, or other unnecessary sensitive data in chats, notes, or forms.
How we use information
- Provide authentication, private workspaces, permissions, connections, imports, reports, research, measurement, AI assistance, and experiment planning.
- Keep company memory and decision history so later analysis reflects approved business context and feedback.
- Send invitations, authentication messages, demo replies, service notices, and requested support.
- Protect the service, prevent abuse, troubleshoot errors, enforce plan limits, and improve reliability and usability.
- Comply with law and enforce our agreements.
Connected platforms
You choose whether to connect a platform and review the requested permissions in that platform’s authorization screen. We use connected data to provide the features you request. Current connections are designed for reporting, analysis, and reviewed drafts. We do not publish ads, change budgets, edit CRM records, or modify a storefront or website unless the product presents a separate action and an authorized user approves it.
Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Meta, Shopify, HubSpot, Google, Webflow, and other providers also process information under their own terms and privacy policies.
AI-assisted analysis
Relevant prompts, business context, and selected evidence may be sent to AI service providers to produce the analysis or draft you request. We limit the information to what is reasonably needed for that task. AI output can be incomplete or incorrect and should be reviewed before it is used in a campaign, customer communication, or business decision. We do not use your business data to serve third-party advertising.
When we share information
We share information with service providers only as needed to operate the product or follow your instructions. Our current providers, purposes, locations, advance-notice commitment, and objection process are on the dated Subprocessor page. Connected platforms you enable also process information under their own terms and privacy policies.
Each company workspace is separated by access rules. Your connected-account data and private work product are available only in your company workspace to its authorized users and agency staff whose role permits access to it. We do not place one company’s private connected data, metrics, creative, or work product into another company’s reports, chats, memory, or AI context. We may use aggregate or de-identified operational data that cannot reasonably identify a company or its strategy to protect and improve service reliability. We may also disclose information when required by law, to protect rights or safety, or as part of a business transaction subject to appropriate safeguards and notice where required.
We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
Cookies and similar technology
We use essential cookies and browser storage for sign-in, session security, and product preferences. We do not currently use third-party advertising cookies on the public website. If that changes, we will update this policy and provide consent controls where required.
Security and incidents
We use encrypted connections, restricted server-side credentials, workspace access controls, provider OAuth where available, operational logging, and other administrative and technical safeguards described on our Security page. No online service can guarantee absolute security. Please report suspected unauthorized access promptly to erkan@consultdemy.com. For Customer Data, we notify the customer under the incident terms in the DPA so the customer can meet its own duties.
Retention
- Connected credentials are removed when the connection is disconnected or the related workspace is deleted.
- Workspace data and generated work are kept while the workspace is active and for up to 30 days after a verified deletion request, unless a shorter period is required.
- Demo inquiries may be kept for up to 24 months so we can follow up and maintain a business record.
- Security, audit, and abuse-prevention records may be kept for up to 12 months.
- Encrypted backups may retain deleted information for up to 90 additional days before routine expiry; they are isolated from normal product use.
We may keep a limited record longer when law, fraud prevention, security, billing, or an active dispute requires it. We may retain aggregated or de-identified information that can no longer identify a person or company.
Your choices and rights
Depending on where you live, you may have rights to access, correct, export, restrict, object to, or delete personal information, and to appeal a denied privacy request. These request options are available to every user, regardless of location. You may disconnect a provider in the product, revoke the app in the provider’s settings, update available profile or membership controls, or follow the steps on our Data Deletion page. We may verify your identity and authority before acting on a request. We will not discriminate against you for using a privacy right.
International processing
Our service providers may process information in the United States and other countries. Where required, we rely on contractual and other lawful safeguards for transfers across borders.
Children
InsertAI is a business service for people who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal information from children.
Changes and contact
We may update this policy as the product or legal requirements change. We will update the date shown on this page and provide additional notice when a material change requires it. Privacy questions and requests may be sent to Consultdemy LLC at erkan@consultdemy.com.