1. Scope and roles
This Policy explains how INSINTA processes personal data in its website, accounts, hosted application, public QR reporting, support, security, and billing operations.
INSINTA acts as controller where it independently determines the purposes and means of processing, including account administration, access approval, authentication, service security, billing administration, service communications, fraud prevention, legal compliance, and its own operational audit data.
A customer organization acts as controller for member, location, asset, incident, workplace, evidence, and other operational data processed through its workspace and customer-configured flows. INSINTA processes that customer-directed operational data on the customer's behalf. Public reports submitted through a customer's QR/reporting flow are customer-directed operational data, while INSINTA separately controls the security, abuse-prevention, routing-integrity, and legal-compliance data it generates for that flow. The Terms and Conditions contain the applicable contractual processing terms.
This Policy does not govern Paddle's independent Merchant-of-Record processing, a customer's own privacy practices, or third-party sites linked from INSINTA.
2. Data we process
Account and identity data
We process name, email address, email-verification status, password authentication records managed through Better Auth, sessions, password-reset state, locale, theme, and security/account events. We do not store a readable password.
Organization and access data
We process organization name and slug, membership and role, invitations, access requests, approval status, authorization history, operator/security controls, and records showing who performed protected actions.
Physical operations data
We process location hierarchy, asset identity and passport data, QR-label identity and binding history, taxonomy, condition, incidents, descriptions, category, priority, assignment, status, proof, approval, notes, lifecycle and audit history, and related timestamps. These records may identify employees, contractors, reporters, responsible persons, or people visible in evidence.
Public and anonymous incident reports
A person may report an incident through a public QR route without an account. We process the report text, selected physical target, category and other form fields, submitted evidence, report timestamps, bounded network/security signals, abuse-control state, and a public report token needed to route the report. We do not require an anonymous reporter to become a member. Reporters should avoid names, contact details, faces, documents, or other personal information unless necessary and lawful.
Photos, files, and evidence
We process uploaded filename and metadata, MIME type, size, storage state, organization and incident links, and image bytes. Supported incident images are normalized for safe presentation and stored privately. Replacement may preserve earlier evidence as superseded history. Evidence may contain people, property, identifiers, or other information supplied by the reporter or customer.
Communications and notifications
We process recipient email address, message category, delivery metadata, invitation/verification/reset tokens, notification records, and support correspondence. Optional Web Push uses a browser push endpoint and key material plus bounded user-agent data. Native push uses APNs or FCM device tokens and may include locale and application version. We do not use notification content for advertising.
Billing data
When Paddle billing is enabled, we process organization/customer correlation, plan and price identifiers, subscription and transaction identifiers, status, billing period, amounts/currency returned by Paddle, lifecycle operations, webhook records, invoices/portal references, entitlement state, and audit evidence. Paddle receives payment details directly. INSINTA does not receive or store full card numbers or CVC values.
Technical, security, and diagnostic data
We process request time, route template, response status, latency, request/correlation identifiers, service and deployment state, bounded IP/security evidence where required, rate-limit state, error category, browser/application version, and sanitized diagnostic records. Logging policy prohibits credentials, cookies, authorization headers, raw request bodies, full webhook payloads, private object keys, and sensitive response bodies, but technical identifiers may still be personal data.
Preferences and browser storage
We use essential authentication and access cookies and store locale and theme preferences. Theme and a bounded realtime logout signal may also use local storage. The service worker may cache static application assets and an offline page. The separate Cookie and Browser Storage Disclosure provides details. We do not currently use advertising cookies or third-party behavioral analytics.
3. Sources
We receive data from users, organization administrators, public reporters, customer-configured QR labels, user devices and browsers, Paddle, Resend, push providers, hosting/security providers, and service-generated audit or diagnostic processes. An organization may provide information about its members, workers, contractors, visitors, locations, assets, and incidents.
4. Purposes
We process data to:
- create and secure accounts, sessions, organizations, memberships, and permissions;
- provide asset passports, location hierarchy, QR identity, incident reporting, evidence, work, approval, notification, and history features;
- route public reports to the correct organization and protect that route from abuse;
- enforce plan capacity and organization isolation;
- send requested transactional and operational communications;
- administer trials, subscriptions, billing status, refunds, and entitlements;
- detect, investigate, and prevent security incidents, fraud, abuse, and service failure;
- maintain backups, continuity, auditability, and disaster recovery;
- respond to support, privacy, legal, and security requests;
- comply with law, enforce agreements, establish or defend legal claims, and improve reliability.
5. Legal bases
Depending on the person, jurisdiction, and activity, processing may rely on performance of a contract or pre-contract steps; compliance with legal obligations; legitimate interests in operating, securing, supporting, and improving a B2B service; consent where required, including optional device notifications; or establishment, exercise, and defense of legal claims.
Where a customer organization is controller, it is responsible for identifying and communicating its legal basis for workplace and operational data. Consent is not treated as the basis where it is not freely given or another basis is required. Consent can be withdrawn for future processing through the supported control or [email protected], without affecting earlier lawful processing.
6. Service providers and recipients
We disclose only data reasonably needed for the following functions:
- Railway: application, PostgreSQL, job, log, and recovery hosting.
- Cloudflare: DNS/edge protection, private R2 object and independent backup storage, and controlled access infrastructure.
- Better Auth components: authentication and session processing within the INSINTA application and database.
- Resend: transactional email delivery.
- Apple Push Notification service, Firebase Cloud Messaging, and browser push services: optional device notification delivery.
- Paddle: independent Merchant of Record for checkout, tax, payment, invoicing, subscription, customer portal, refund, and fraud operations.
- GitHub: source/CI and independent availability monitoring, using minimized operational evidence.
- Professional advisers, authorities, courts, or counterparties when lawfully required or necessary to protect rights.
Providers may use subprocessors and process data in other countries. We use contractual, confidentiality, security, and international-transfer safeguards where applicable, require processors handling customer-directed data to protect it, and assess material provider changes through the service's security and privacy process. Current provider entities, regions, and terms may change; [email protected] may be used to request information relevant to a customer's processing assessment.
We do not sell personal data and do not use customer operational content for advertising.
7. Security
Measures include verified authentication, scoped roles, tenant checks, private object storage, separate backup credentials, encryption in transit, file validation and normalization, rate and abuse controls, signed provider webhooks, bounded logging, health monitoring, and recovery verification. Access is limited by role and operational need.
No system is completely secure. Users must protect credentials and devices and report suspected compromise to [email protected] without sending passwords, tokens, or full payment-card information.
8. Retention
We retain data only for as long as reasonably needed for service delivery, security, accountability, legal obligations, disputes, and recovery. Current enforceable technical periods include:
- Better Auth browser sessions expire after 30 days unless ended earlier.
- Browser theme and locale preference cookies are set for up to 365 days and may be refreshed when the preference is used.
- Sanitized diagnostic events are opportunistically removed after 30 days; diagnostic issue and alert records after 90 days.
- Railway database snapshots are configured for daily copies retained 6 days, weekly copies retained 27 days, and monthly copies retained 89 days.
- Independent portable database backups use a minimum 35-day object lock and 45-day lifecycle expiry.
- Evidence backup objects and manifests use a minimum 365-day object lock and a 400-day lifecycle expiry.
- Incomplete multipart backup uploads expire after 7 days.
Organization, asset, location, incident, lifecycle, evidence, billing, acceptance, audit, access, and security records may remain while the organization is active and afterward where needed for read-only access, evidentiary integrity, legal obligations, claims, fraud prevention, or a verified request. Superseded evidence may remain in operational history and protected backups. Provider-side deletion may occur after, not exactly at, a configured lifecycle boundary.
Primary organization and operational records do not currently follow a fixed automatic deletion schedule. They remain while needed to provide active or read-only service, preserve incident and evidence history, maintain billing and acceptance records, protect accounts and tenants, comply with law, resolve disputes, establish or defend claims, respond to a verified request, or maintain a legal hold. When deletion is approved and technically supported, removal from primary systems is followed by expiry from protected backups under the periods above rather than an immediate deletion promise.
Ending a trial, canceling a subscription, receiving a refund, or deleting a personal account does not automatically delete organization data.
9. Access, correction, export, and deletion requests
Send a request to [email protected] from the account email where possible. State the person or organization, the right requested, and enough detail to locate the relevant records. Do not send passwords, access tokens, full payment-card data, or unnecessary identity documents.
We will:
- acknowledge the request through a safe channel;
- verify identity and, for organization data, the requester's OWNER authority or other lawful authorization;
- identify whether INSINTA or the customer organization is responsible for the request;
- search relevant current systems and assess applicable rights, other persons' rights, evidentiary integrity, legal obligations, security, and legal hold;
- provide the supported result or a reasoned limitation and available escalation route;
- record only the evidence necessary to demonstrate handling.
Users can correct some account and organization information in the product. There is no current self-service bulk organization export or organization-deletion control. Assisted export or deletion is assessed case by case and may be partial, structured from available records, delayed for protected backups, or refused where retention is lawful and necessary. Deleting a personal account is unavailable while memberships remain and does not delete organization content.
Depending on applicable law, a person may have rights of information, access, correction, deletion, restriction, objection, portability, consent withdrawal, and complaint to a competent authority. Rights are not absolute and may differ by jurisdiction. For processing governed by Georgian data-protection law, a complaint may be submitted to the State Audit Office of Georgia or a competent court. People elsewhere may contact the competent authority available under their applicable law.
10. Children and sensitive information
INSINTA is a B2B service and is not directed to children. Account users and purchasers must be at least 18. Customers and public reporters should not submit special-category, highly sensitive, or children's data unless necessary, lawful, authorized, and appropriately protected. Contact [email protected] if such data was submitted unintentionally.
11. International processing
INSINTA and its providers may process data outside the person's country. Where law requires safeguards for an international transfer, the responsible controller will use an available lawful mechanism and supplementary measures appropriate to the transfer. No statement in this Policy guarantees that all data remains in Georgia or any single region.
12. Security incidents
INSINTA investigates suspected incidents and will notify affected customers, people, regulators, or providers where required by applicable law and the circumstances. Report suspected security issues to [email protected]. Do not publicly disclose active credentials or exploitable personal data.
13. Policy changes
A published Policy will identify a version and effective date. Material changes will be communicated through an appropriate product or email channel where required. Earlier published versions and acceptance evidence will be retained where necessary to establish the terms that applied.
14. Contact and complaints
- Privacy requests: [email protected].
- Product support: [email protected].
- Security reports: [email protected].
- Legal notices: [email protected].
- Operator: Ivan Butakov, Individual Entrepreneur registered in Georgia, registered Georgian name ივან ბუტაკოვ, identification number 305807847.
- Public business/contact address: 6 Chabua Amirejibi Highway, Tbilisi, Georgia.
For processing governed by Georgian data-protection law, individuals may complain to the State Audit Office of Georgia or seek a judicial remedy. Individuals in another jurisdiction may complain to the competent data-protection authority or court available under applicable law. These routes do not require a person to give up mandatory rights or first resolve the matter through INSINTA.