Privacy Policy

Last updated: April 25, 2026 · InsightLoop Technologies, Inc.

In plain English: You own your employee data. We store it securely to power your HR platform, never sell it, and let you export or delete it at any time. We use Paystack for payments (they handle card data; we never see it).

1. What Data We Collect

Organization & Account Data

Organization name, country, industry, employee count
Administrator name, email, phone, job title
Hashed passwords (bcrypt, cost 12 — we cannot read your password)
Login timestamps and IP addresses for security auditing

HR Records (Your Data)

Employee records: names, roles, departments, hire dates
Feedback entries, performance reviews, pulse survey responses
Performance improvement plans and disciplinary records
Separation cases: type, cause, evidence, HR/legal notes

Payment Data

Payment processing is handled entirely by Paystack. We store only the transaction reference, amount, plan type, and status. We never store card numbers, CVVs, or bank account details.

Technical Data

Server logs, error logs, and audit trails
Browser type and IP address (for security and fraud detection)

2. How We Use Your Data

Purpose	Legal Basis
Providing the InsightLoop platform and Services	Contract performance
Processing payments via Paystack	Contract performance
Sending subscription and renewal notifications	Contract performance
Security monitoring and fraud prevention	Legitimate interests
Complying with legal obligations	Legal obligation
Improving platform features (aggregated, anonymized)	Legitimate interests

3. Data Ownership & Control

You own your data. All employee records, HR documents, and separation cases you create are your property. InsightLoop acts as a data processor on your behalf.

You may at any time: export all your data in CSV/JSON format, request deletion of specific records, or request complete account and data deletion by contacting privacy@insightloop.com.

4. Data Security

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
SOC 2 Type II certified infrastructure
Role-based access control: users only see data their role permits
Immutable audit log of all data access and modifications
Regular security assessments and penetration testing
Passwords stored as bcrypt hashes (cost 12) — never reversible

5. Data Retention

Active accounts: Data retained for the life of the subscription plus 90 days
Expired/cancelled accounts: Data retained for 90 days post-expiry, then permanently deleted
Audit logs: Retained for 730 days (2 years) for compliance purposes
Backup data: Purged within 30 days of primary deletion

6. Third-Party Services

Service	Purpose	Privacy Policy
Paystack	Payment processing	paystack.com/privacy
Your hosting provider	Server infrastructure	Varies

We do not use advertising networks, social media trackers, or analytics services that share your data with third parties.

7. Your Rights (GDPR & Applicable Law)

Depending on your jurisdiction, you may have the right to: access your personal data, correct inaccurate data, request deletion ("right to be forgotten"), data portability, object to processing, and withdraw consent. To exercise these rights, contact privacy@insightloop.com.

8. Cookies

InsightLoop uses only essential cookies required for authentication (session management and remember-me tokens). We do not use advertising or tracking cookies.

9. Contact

For privacy enquiries: privacy@insightloop.com
For data deletion requests: privacy@insightloop.com

We may update this Policy periodically. Material changes will be notified via email to your registered admin address at least 30 days before taking effect.