Privacy Policy

1. Who we are

Insaights B.V. (“Insaights”, “we”, “us”) operates this website (insaights.co) and the VERDIX AI governance platform. We are registered in the Netherlands. For any privacy-related questions or data requests, contact us at privacy@insaights.co.

2. What this policy covers

This policy covers how we process personal data collected through this marketing website — including whitepaper and manifesto downloads, newsletter sign-ups, the AI readiness assessment, and contact enquiries. It does not cover the VERDIX platform itself; platform data processing is governed by the Data Processing Agreement (DPA) between Insaights and each client organisation.

3. Data we collect

• Lead capture: Name and email address when you download a whitepaper, the AI Multiplier manifesto, or submit an assessment. We use this to send you the requested content and, with your consent, relevant updates from Insaights.
• Partner & investor access requests: Name, email, and company when you request access to the Partner Brief or Investor Brief. We use this to verify eligibility and send a magic-link access token.
• Usage data: Anonymised page views and session data collected via privacy-respecting analytics. We do not use advertising or fingerprinting trackers.
• Cookie consent: Your preference (accept or decline non-essential cookies) is stored locally in your browser.

4. Legal basis for processing

• Consent — for marketing communications. You can withdraw consent at any time by clicking Unsubscribe in any email we send.
• Legitimate interests — to respond to enquiries, prevent abuse, and improve the website.
• Contract — to fulfil a download request or access-token delivery you initiated.

5. Third-party processors

• Supabase — stores lead capture data (email, name, download timestamps) on EU infrastructure.
• Resend — delivers transactional emails (download links, access tokens, unsubscribe confirmations). EU-based processing available.
• Vercel — hosts this website and serves all pages. Vercel processes request logs for security and performance.

We do not sell personal data to any third party.

6. Data retention

Lead and download data is retained for 24 months from the date of capture, after which it is deleted or anonymised. Unsubscribed addresses are suppressed (not deleted) to prevent re-subscription without consent. You may request earlier deletion at any time.

7. Your rights (GDPR)

If you are in the European Economic Area, you have the right to:

• Access a copy of your personal data we hold
• Rectify inaccurate data
• Erase your personal data (“right to be forgotten”)
• Restrict processing in certain circumstances
• Portability — receive your data in a machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time (for marketing communications)

To exercise any right, email privacy@insaights.co. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Cookies

We use a strictly necessary session cookie for unsubscribe token validation. We do not use advertising, retargeting, or cross-site tracking cookies. If you accept analytics cookies via our cookie banner, we collect anonymised usage data to improve the site.

9. International transfers

All personal data collected on this website is processed and stored within the European Union. Where sub-processors have infrastructure outside the EU, we ensure adequate safeguards are in place (Standard Contractual Clauses or equivalent).

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email to affected contacts. The “Last updated” date at the top of this page will always reflect the current version.

11. Contact

For privacy questions or data requests: privacy@insaights.co
Insaights B.V., the Netherlands