DataInsight

DataInsight checks every ad change against your real purchase data and grades it A to F. Keep what makes money. Undo what doesn't.

DataInsight

Privacy Policy

Effective date: October 18, 2026

  • For a Referee Report we use the order exports and ad change-history exports you send us, or that we download with the view-only access you grant.
  • Our grading removes customer names, emails, phone numbers and addresses from order files before it analyzes them.
  • We do not change your ads. Our access to ad accounts is read-only.
  • We do not sell your data.
  • Referee Report files are deleted within 30 days of delivering your report. The finished report holds no customer personal details and is deleted whenever you ask.

This explains what DataInsight collects, why, who helps us process it, and how to have it deleted.

1. What we collect

  • Account information: your name and email, and what you choose to add when you sign up (company, job title, country, and whether you want marketing email). If you sign in with Google, we receive your Google name, email and profile photo.
  • Ad account data, read-only: when you connect Google Ads or Meta through their own sign-in screens, we read reporting data such as spend, impressions, clicks, conversions and conversion value, by day. We also keep these daily figures for each campaign, ad group (Meta: ad set) and ad, with their names and status, while the account stays connected; disconnecting deletes them.
  • Store sales and order data: for a Referee Report, the order exports and ad change-history exports you send us, or that we download with the view-only access you grant. Our grading removes customer names, emails, phone numbers and addresses from order files before it analyzes them.
  • Shopify, if you connect your store: we read its orders with read-only access: the last 60 days, then new and updated orders once a day, kept while the store is connected. A Referee Report's 12 months come from the order export you send us, not from this connection. For each order we keep when it was placed and last updated, its amounts (total, products before and after discounts and returns, discounts, refunds, shipping and taxes), the number of items, currency, payment status, whether it was cancelled or is a test order, its sales channel, whether it is a repeat order (only that yes or no, never who the customer is), the names, variants, quantities and amounts of the products in it, and whether its tags mark it as a subscription or wholesale order, plus a scrambled order reference so we can update or delete it. We also keep your store's time zone and currency, and the access Shopify gives us, encrypted. We never ask Shopify for customer names, emails, phone numbers or addresses, and never store them. Disconnecting the store, uninstalling our app or a deletion request from Shopify deletes these orders. If a customer asks Shopify to erase their data, we delete their orders and keep only those scrambled references, so the orders are never stored again.
  • If you connect any other store, or an ad or email account, we keep only numbers (sales, orders, spend, clicks, emails sent and what each platform reports) by day or campaign. Some platforms send a customer's name, email or address with a payment (Stripe does); we add up the amounts and never store those details. We never change your accounts. Disconnecting deletes that data.
  • Mailchimp, if you connect it: you paste a Mailchimp API key. Mailchimp can't limit a key to read-only, so we limit what we do with it: we only read your campaign reports. For each day you sent campaigns, we keep how many you sent, emails sent, unique opens, unique clicks, and the store revenue and currency Mailchimp reports. We never read your audience, subscribers, their emails or names, and we never send, change or delete anything in your account. The key is stored encrypted and never shown again. Removing Mailchimp in DataInsight deletes the key and every number read with it straight away.
  • If you connect WooCommerce, BigCommerce, Omnisend, ActiveCampaign, Customer.io, Recurly, Braze or OneSignal, we store the key you paste (and your store or account address), encrypted, and read only order totals, subscription totals or campaign counts; never your customers' or subscribers' details.
  • Social accounts and site analytics, if you connect them: Facebook Pages and Instagram, TikTok, Google Analytics 4, YouTube and Search Console, read-only. Each has its own section below: what we read, how often, what we keep, and how to disconnect and delete.
  • Calendar data, if you connect a calendar: event titles, times and attendees from Google Calendar or Outlook. If you add a calendar link (for example from Partiful, Luma, Google, Outlook or Apple), we store the link encrypted and the title, time, place and link of its events from the past month to six months ahead. If you add a single event from its link, we read that one public page when you add it or check it for changes, and store only its title, time, place, link and a small copy of its cover image. We use this only to show events in your calendar; removing a calendar or event deletes that data immediately.
  • Content you create: notes, tasks and goals in your workspace.
  • Usage data: pages visited and basic device and browser information, collected with Google Analytics.
  • We keep small pieces of data on your device (cookies, local storage and your browser's database) to keep you signed in, finish a sign-in you started, and keep your notes open when you're offline. Google Analytics on our site sets its own cookies. We don't use any of them for ads.
  • Early-access sign-ups: if you join early access for an offer that isn't available yet, we keep your email, your store's web address, your monthly ad-spend band and which offer you joined, only to email you when it opens, and delete them when you ask or when that offer opens or closes.
  • Billing: if you pay for a plan, Stripe takes the payment. We keep Stripe's customer and subscription IDs, your plan, its status and renewal date, whether it has a founding price and whether you used a code; never your card details. We also count how many Ask your data questions you ask each calendar month, to apply your plan's allowance.

2. Facebook Pages and Instagram

If you connect them, you sign in with Facebook and pick which of your Facebook Pages, and the Instagram Business or Creator accounts linked to them, to sync.

  • What we read: each Page's and Instagram account's daily followers, reach, views, engagements and profile visits (for Instagram, also taps on your profile's links), and your own posts and Reels with their reach, views, likes or reactions, and comment, save and share counts. We use them to show how your posts and accounts are doing.
  • How often: right after you connect, then once a day. Over the next few days we also fill in the 90 days before you connected. Each day we read your posts from the last 28 days again, because their counts keep growing.
  • What we keep: those daily counts; for each post, its ID, type, publish time, link and the first 120 characters of its caption, with its counts as of each day we read them; each Page's and account's name and ID; the ID Facebook gives us for you, so we can act on Facebook's requests about you; and the access Facebook gives us, encrypted.
  • What we never keep: who follows you, who likes, comments on or views your posts, or what a comment says. We read only the totals. We never post, comment, reply, send messages or change anything on your Pages or Instagram accounts.
  • Disconnecting and deleting: choosing Remove account in DataInsight stops syncing that Page or account and deletes everything we read for it straight away. Removing DataInsight in your Facebook settings does the same for every Page and Instagram account you connected: Facebook tells us, and we delete everything we read for them and our access to them straight away (see Deleting your data).

3. TikTok

If you connect it, you sign in with TikTok and we read that one account through TikTok's Login Kit and Display API.

  • What we read: your account's followers, total likes and number of videos, and your latest 1,000 public videos with their view, like, comment and share counts. TikTok gives only today's numbers, so your history starts the day you connect. We use them to show how your videos and account are doing.
  • How often: right after you connect, then once a day.
  • What we keep: those daily totals; for each video, its ID, publish time, share link and the first 120 characters of its description or title, with its counts as of each day we read them; your TikTok display name and username, and the link to your TikTok profile and the ID TikTok gives us for you; and the access TikTok gives us, encrypted.
  • What we never keep: who follows you, who likes, comments on or watches your videos, or what a comment says. We read only the totals. We never post, comment, send messages or change anything on your TikTok account.
  • Disconnecting and deleting: choosing Remove account in DataInsight deletes everything we read for that account straight away. Removing DataInsight's access in TikTok, or deleting your TikTok account, does the same: TikTok tells us, and we delete everything we read for it and our access to it straight away.

4. Google Analytics 4

If you connect it, you sign in with Google and pick which Google Analytics 4 properties to sync. This connection asks Google only for read-only access to Analytics, and it is separate from Google sign-in, Google Calendar and Google Ads.

  • What we read: for each property and day, its sessions, engaged sessions, key events and revenue, split by where the sessions came from (source, medium and campaign name), plus the property's name, currency and the day it was created. We use them to show your site's traffic, key events and revenue by source, including what came from your social posts.
  • If you run a digital business: when you tell us to grade your ads on key events (such as sign-ups), we also read each key event's daily count by name, back to when the property was created, and keep those daily counts and the value you give each one to grade your ad changes. They are totals: we never read who signed up.
  • How often: right after you connect, then once a day, reading the last 7 days again because Google still updates them. Over the next few days we also fill in up to six years before you connected, back to when the property was created.
  • What we keep: those daily counts for each source, medium and campaign (each name cut to 80 characters), with the property's currency; each property's name and ID and its Analytics account ID; and the access Google gives us, encrypted. We don't ask Google who you are.
  • What we never keep: anything about an individual visitor or customer. Google Analytics gives us only daily totals. We never create, change or delete anything in your Analytics account.
  • Disconnecting and deleting: choosing Remove account in DataInsight deletes everything we read for that property straight away. Removing DataInsight's access in your Google Account ends our access and stops the syncing; what we already read stays until you remove the property in DataInsight or email us.

5. YouTube

If you connect it, you sign in with Google and pick which of the YouTube channels you own to sync. This connection asks Google only for read-only access to YouTube and YouTube Analytics, and it is separate from Google sign-in, Google Calendar, Google Ads and Google Analytics. DataInsight uses YouTube API Services. Google's Privacy Policy (https://policies.google.com/privacy) covers what Google itself holds.

  • What we read: each channel's daily views, estimated minutes watched, subscribers gained and lost, likes, comments and shares, and your channel's own videos with their titles and their view, like and comment counts. We use them to show how your channel and videos are doing.
  • How often: right after you connect, then once a day. Over the next few days we also fill in the 90 days before you connected. Each day we read the last 28 days again, because YouTube still updates them, and the counts of videos published in the last 28 days, because they keep growing.
  • What we keep: those daily counts; for each video, its ID, publish time, link and the first 120 characters of its title, with its counts as of each day we read them; each channel's name and ID; and the access Google gives us, encrypted. We don't ask Google who you are.
  • What we never keep: who subscribes to your channel, who watches, likes or comments on your videos, what a comment says, or a video's description or tags. We read only the totals. We never post, comment or change anything on your YouTube channel.
  • Disconnecting and deleting: choosing Remove account in DataInsight deletes everything we read for that channel straight away. Removing DataInsight's access in your Google Account ends our access and stops the syncing, but Google doesn't tell us, so what we already read stays until you remove the channel in DataInsight or email us.

6. Search Console

If you connect it, you sign in with Google and pick which of your Search Console properties to sync. This connection asks Google only for read-only access to Search Console, and it is separate from Google sign-in, Google Calendar, Google Ads and Google Analytics.

  • What we read: for each property and day, its clicks and impressions from Google web search, its click-through rate and its average position in the results, for the whole property. We use them to show how your site is doing in Google Search.
  • How often: right after you connect, then once a day, reading the last 7 days again because Search Console finishes a day's numbers 2 to 3 days later. We read only finished days. Over the next few days we also fill in up to 16 months before you connected, all that Search Console keeps.
  • What we keep: those daily counts; each property's address, which is also its ID; and the access Google gives us, encrypted. We don't ask Google who you are.
  • What we never keep: the searches people typed, the pages they landed on, or anything about an individual searcher or visitor. We read only the property's daily totals. We never add, change or delete anything in your Search Console.
  • Disconnecting and deleting: choosing Remove account in DataInsight deletes everything we read for that property straight away. Removing DataInsight's access in your Google Account ends our access and stops the syncing, but Google doesn't tell us, so what we already read stays until you remove the property in DataInsight or email us.

7. What we use it for

  • Grading your ad decisions against your store's sales and producing your reports.
  • Running the workspace features you use, such as notes and calendars.
  • If you turn on Ask your data, we send each question you ask, and the figures and names (such as products or ad accounts) that answer it, to Anthropic, which picks the report and writes one sentence about it; under Anthropic's commercial terms it isn't used to train its models, and turning Ask off stops this at once.
  • If you connect DataInsight to Claude, Claude can read the same figures through DataInsight's read-only connector, only while Ask your data is on; it can't change anything, and you can disconnect it at any time.
  • Keeping your account secure and answering your questions.
  • Sending marketing email only if you asked for it.

8. What we never do

  • We do not sell your data.
  • We do not change your ads. Our access to ad accounts is read-only.
  • We do not use data from Google APIs to serve ads.
  • We never combine one brand's platform data with another brand's, so there are no cross-customer benchmarks.
  • Ad platform data is combined with your store's sales only to show you your own performance. It is never shared with other customers or sent to any ad platform.
  • We never post, comment, send messages or change anything on your Facebook Pages, Instagram, TikTok, Google Analytics, YouTube or Search Console accounts.

9. Independent by design

We're paid only by you. We take no commissions, referral fees or payments from ad platforms, agencies or tools we grade. Grades never change based on who runs your ads.

10. Google user data

This covers data we get from Google when you sign in with Google, connect Google Calendar, connect Google Ads or connect Google Analytics. Signing in with Google also asks for read-only access to your Google Calendar, so your events can show without a second step. It also covers YouTube and Search Console, if you connect them.

  • What we access: Google Calendar, read-only: your calendars' names, and your events' titles, times, locations, descriptions and attendees (their names, email addresses and replies). Google Ads, read-only: the account's name, currency and time zone; campaign, ad group and ad names and settings; reporting such as spend, impressions, clicks, conversions and conversion value; and the account's change history. For each change we keep only the email domain of the person who made it and a one-way code, never the address. We never create, change or delete anything in your calendar or ad account. Google Analytics, read-only, if you connect it: each property's daily sessions, engaged sessions, key events and revenue by source, medium and campaign, never anything about an individual visitor, and we never change anything there either. YouTube, read-only, if you connect it (the youtube.readonly and yt-analytics.readonly permissions): each channel's daily views, estimated minutes watched, subscribers gained and lost, likes, comments and shares, and your own videos' titles and view, like and comment counts, never who watches, subscribes or comments, or what a comment says. Search Console, read-only, if you connect it (the webmasters.readonly permission): each property's daily clicks, impressions, click-through rate and average position in Google web search, never the searches people typed or the pages they landed on. We never change anything in either.
  • What we use it for: showing your events in your calendar and on a note's agenda, grading your ads and building your reports, and writing the summaries you ask for with Fill with AI. For a summary, we send that note's ad numbers and event details to Anthropic, which writes the text. If you turn on Ask your data, we send a question you ask and the Google Ads figures that answer it to Anthropic, which writes one sentence about them. Google Analytics data is used only to show your site's traffic, key events and revenue by source in DataInsight. YouTube and Search Console data is used only to show how your channel, videos and site are doing in DataInsight.
  • How we keep it: the access Google gives us is stored encrypted on our servers. Ad reporting is saved to your account, and event details you add to a note are saved with that note. Disconnecting in Settings, or removing DataInsight from your Google Account, ends our access. Google Analytics counts stay in your account until you remove the property in DataInsight, which deletes them. YouTube and Search Console counts stay in your account until you remove the channel or property in DataInsight, which deletes them.
  • What we never do: we don't sell Google user data. We don't use it or share it for ads, including retargeting. We don't use it to train AI models. Under Anthropic's commercial terms, data we send through its API isn't used to train its models. We don't use it to decide credit or lending.
  • Who can read it: people at DataInsight don't read your Google data unless you give us permission for specific data (for example, to fix a problem you report), it's needed for security such as investigating abuse, the law requires it, or it's combined and anonymized for running the service.

The statement below covers every Google API we use, including the Google Analytics Admin and Data APIs.

DataInsight's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

11. Who processes your data

We use these services to run DataInsight. Each receives only what its job needs.

  • Supabase: database, sign-in and server functions.
  • Vercel: website hosting.
  • Anthropic: AI text generation for summaries you ask for, and Ask your data answers if you turn it on.
  • Stripe: payments for paid plans, and the one-time audit.
  • Google: sign-in, Google Ads and Google Calendar connections, site analytics, and the Google Analytics, YouTube and Search Console connections if you choose to connect them.
  • Meta: Meta (Facebook and Instagram) ads connection, and the Facebook Page and Instagram connection if you choose to connect it.
  • Microsoft: Outlook Calendar connection, if you choose to connect it.
  • TikTok: TikTok account connection, if you choose to connect it.
  • Mailchimp: email campaign reports, if you choose to connect it.

12. How long we keep it

Referee Report files (order exports and ad change-history exports) are deleted within 30 days of delivering your report. The finished report and its graded decisions, which hold no customer personal details, are kept while your account exists and deleted whenever you ask. Connected accounts: until you remove them. Your account and notes: until you ask us to delete them. Email hello@datainsight.la and we'll delete any of it sooner.

What we read from a connected Facebook Page, Instagram account, TikTok account or Google Analytics property is kept until you remove it in DataInsight, remove DataInsight in Facebook or TikTok, or ask us to delete it, and then deleted straight away. When you connect one, we hold the sign-in, encrypted, while you pick which accounts to sync, for 30 minutes at most. We delete it as soon as you connect accounts or cancel; if you just leave, our daily cleanup deletes it once its 30 minutes are up.

What we read from a connected YouTube channel or Search Console property is kept until you remove it in DataInsight or ask us to delete it, and then deleted straight away. Removing DataInsight's access in your Google Account stops the syncing but deletes nothing, because Google doesn't tell us. The sign-in you make to connect one is held the same way, for 30 minutes at most.

We keep each connected ad account's change history and the settings in force each day while the account is connected, to grade decisions over time; we delete it within 30 days of disconnecting, or sooner on request.

We keep your billing record while your DataInsight account exists and delete it with the account; Stripe keeps its own payment records as the law requires. Monthly question counts are kept for the current month and the two before it.

We keep the weekly reports we build for you. Each connected account's weekly totals, and what you decide on its calls, are kept while that account stays connected and deleted when you disconnect it; the rest of a report is deleted when you delete your DataInsight account or ask us to.

13. Deleting your data

Email hello@datainsight.la from the address on your account and we will delete your data. You can also disconnect your ad accounts in Settings at any time, and remove DataInsight's access from your Meta account settings, or from your Google Account at https://myaccount.google.com/permissions.

Facebook and Instagram: when you remove DataInsight in your Facebook settings (Apps and websites), Facebook tells us, and we delete every Page and Instagram account you connected, with everything we read for them and our access to them. If you also ask for your data to be deleted, Facebook sends us that request too, and then gives you a confirmation code and a link to our status page, which shows the day the deletion was done and names no one.

TikTok: when you remove DataInsight's access in TikTok, or your TikTok account is deleted, TikTok tells us, and we delete everything we read for that account and our access to it.

Google Analytics: Google sends us no deletion requests. Remove the property in DataInsight, or email us, and we delete what we read for it.

YouTube and Search Console: Google sends us no deletion requests for these either. Remove the channel or property in DataInsight, or email us, and we delete what we read for it.

To change marketing email preferences, .

14. Security

  • Read-only access to ad accounts.
  • Data encrypted in transit (HTTPS).
  • Data encrypted at rest: our database and its backups are encrypted with AES-256 (Supabase), and the access platforms give us is encrypted again (AES-GCM) before it is stored.
  • Delete your data any time on request.

15. Changes and contact

If this policy changes, we will update the effective date above. DataInsight is an independent product based in California. Privacy questions and deletion requests: privacy@datainsight.la.