Privacy Policy

1 Who We Are

EmbedInsight ("we", "us", "our") operates the EmbedInsight platform — a SaaS product for embedding Microsoft Power BI reports into white-label client portals. This Privacy Policy explains how we collect, use, store, and share personal data when you visit our website or use our platform.

For the purposes of the GDPR and equivalent data protection laws, EmbedInsight is the data controller of the personal data described in this policy. Where you process personal data about your own end users through the platform, you are the controller and we act as your data processor — a Data Processing Agreement (DPA) is available on request.

2 Data We Collect

Category	Examples	Source
Account data	Name, email address, organisation name, role	You, on registration
Authentication data	Microsoft Azure AD tokens, session identifiers	Microsoft / your Identity Provider
Billing data	Subscription plan, billing period, payment status	Paddle (we never see full card numbers)
Usage data	Pages viewed, reports accessed, features used, timestamps	Automatically collected
Technical data	IP address, browser type, operating system, time zone	Automatically collected
Configuration data	Branding settings, user roles, portal preferences, API keys you create	You
Support data	Messages you send us, attachments, conversation history	You
AI interaction data	Queries submitted to AI Q&A or AI Insights features	You and your end users

Power BI report content. We access your Power BI workspace using tokens you authorise. We render reports on behalf of your users but do not store report data or underlying dataset values beyond transient in-memory processing. Your data stays in your Microsoft environment.

3 How We Use Your Data

Providing the service — authenticating users, rendering reports, managing your tenant configuration, processing payments via Paddle.
Account management — onboarding, plan changes, licence allocation, support communications.
Service improvement — analysing usage patterns to improve features, performance, and reliability.
Security & fraud prevention — detecting abuse, monitoring for threats, enforcing our Terms.
Legal compliance — meeting our obligations under applicable law, responding to lawful requests.
Marketing communications — product updates, new features, and relevant offers sent to registered users. You can unsubscribe at any time.

We do not use your data for automated profiling that produces legal or similarly significant effects, and we do not sell your personal data to any third party.

4 Legal Basis (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we rely on the following legal bases:

Contract — processing necessary to provide the service you have subscribed to (account data, billing, authentication).
Legitimate interests — usage analytics, security monitoring, fraud prevention, and product improvement, where these do not override your rights.
Legal obligation — where required by law (e.g., tax record-keeping).
Consent — marketing emails. You may withdraw consent at any time by clicking "Unsubscribe" in any email or contacting us.

5 Sharing & Third Parties

We share personal data only as necessary to deliver the service or comply with the law. Our key sub-processors are:

Sub-processor	Purpose	Location
Microsoft Azure	Cloud infrastructure, hosting, Power BI integration	Global (your chosen region)
Paddle	Payment processing, invoicing, tax compliance	UK / USA
Anthropic (Claude API)	AI Q&A and AI Insights features (when enabled)	USA
SendGrid / SMTP provider	Transactional and notification emails	USA

All sub-processors are contractually obligated to protect personal data and process it only on our documented instructions. We do not share data with advertisers or data brokers.

We may also disclose data where required by law, court order, or to protect the rights and safety of our users or the public.

6 International Transfers

EmbedInsight and some of its sub-processors operate in countries outside the EEA. Where personal data is transferred to countries without an EU adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate safeguards, to protect your data.

You may request a copy of the relevant transfer mechanisms by contacting privacy@embedinsight.com.

7 Retention

Account & configuration data — retained for the duration of your subscription plus 30 days after cancellation to allow data export, then deleted.
Billing records — retained for 7 years to meet tax and accounting obligations.
Usage logs — retained for up to 12 months for security analysis and service improvement.
Support communications — retained for 3 years unless you request earlier deletion.
AI query data — queries are not retained by us beyond the immediate session. Anthropic's own retention policies apply to data processed via their API.

8 Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Encryption in transit (TLS 1.2+) and at rest for sensitive fields
Azure AD-based authentication with token-scoped access
Role-based access controls limiting internal staff access to personal data
Regular security reviews and dependency updates

No system is completely secure. If you believe your data has been compromised, contact us immediately at security@embedinsight.com. For more detail on our security posture, see our Security page.

9 Your Rights

Depending on where you are located, you may have the following rights regarding your personal data:

Access

Request a copy of the personal data we hold about you.

Rectification

Ask us to correct inaccurate or incomplete data.

Erasure

Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.

Restriction

Ask us to pause processing of your data in certain circumstances.

Portability

Receive your data in a structured, machine-readable format.

Objection

Object to processing based on legitimate interests, including for direct marketing.

To exercise any of these rights, email privacy@embedinsight.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

California residents (CCPA). You have the right to know what personal information we collect, to delete it, and to opt out of its sale (we do not sell personal information). Contact us to exercise these rights.

10 Cookies

We use a minimal set of cookies necessary to operate the platform:

Session cookies — to keep you signed in during a browser session. These are essential and cannot be disabled while using the platform.
Preference cookies — to remember your language, theme, and display preferences.

We do not currently use advertising or third-party tracking cookies. If this changes, we will update this policy and, where required, request your consent before setting them.

11 Children

The EmbedInsight platform is intended for business users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

12 Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify registered users by email at least 14 days before the changes take effect. The current version is always available at embedinsight.com/privacy.

13 Contact & DPO

For any privacy-related questions, data subject requests, or to request a Data Processing Agreement, contact us at:

Email: privacy@embedinsight.com
General enquiries: embedinsight.com/contact

If you are in the EEA and have unresolved concerns, you have the right to complain to your national supervisory authority (e.g., the ICO in the UK, the CNIL in France).

Contents