Privacy Policy

This Privacy Policy explains how Insite Labs Ltd. ("Company", "we", "us", or "our") collects, uses, stores, discloses, and protects information in connection with the Insite AI platform, website at insiteai.app, administrative dashboard, applications, widgets, APIs, and all related services, and our product Visitor Simulator, which tests websites with simulated visitors (collectively, the "Service"). Section 5A describes what applies specifically to Visitor Simulator. This Privacy Policy is governed by and subject to our Terms and Conditions. If you are a business customer whose use of the Service involves processing personal data of your end users or personnel on your behalf, our Data Processing Agreement (DPA) also applies and is incorporated herein by reference.

This Privacy Policy applies to information processed by us when customers, account administrators, site owners, and end users interact with the Service. It does not apply to third-party websites, services, plugins, payment providers, or platforms that are not controlled by us, each of which has its own privacy policy.

2.1 Account and Administrative Data • name, email address, company name, billing information, account role, and subscription plan details; • administrative actions, settings, permissions, site configuration, App Keys, and support requests. 2.2 Customer Content • website pages, structured content, FAQ entries, uploaded text, configuration data, and site-related metadata submitted for indexing, crawling, retrieval, or AI response generation; • custom prompts, assistant configurations, and persona settings. 2.3 Interaction and Usage Data • queries, prompts, searches, conversations, interactions, clicks, navigation events, voice requests, and engagement signals generated by end users on customer sites; • session-level metadata such as language, approximate geolocation (country or region level), browser type, device type, referring page, and timestamps; • analytics signals, response quality indicators, and interaction outcomes. 2.4 Technical Data • IP address or partial IP-derived metadata used for security, fraud prevention, analytics, troubleshooting, or regional functionality; • cookies, local storage identifiers, session tokens, or similar technologies where used (see Section 13); • API request metadata, infrastructure logs, error logs, and network telemetry.

We process data for the following purposes: • to provide, operate, maintain, secure, and support the Service; • to index content, perform retrieval, generate AI outputs, rank results, and enable Service functionality; • to produce analytics, insights, FAQ suggestions, improvement recommendations, and administrative tools; • to secure the Service, detect and prevent abuse, investigate incidents, and enforce our agreements; • to debug, test, improve, train, tune, validate, and develop the Service and related technology; • to communicate with customers regarding service, billing, security, updates, legal notices, or support; • to comply with legal obligations applicable to us and to protect our legal rights; • to carry out or facilitate corporate transactions, restructurings, or due diligence.

The Service uses artificial intelligence, machine learning, natural language processing, automated ranking, retrieval logic, and machine-driven processing to analyze content and generate outputs. Such outputs are produced automatically and may be incomplete, inaccurate, or otherwise imperfect. Customers are solely responsible for determining whether and how AI-generated outputs are used in their businesses, customer interactions, and user-facing experiences. End users should not rely on AI outputs for legal, medical, financial, or regulatory decisions without independent verification.

Visitor Simulator sends an automated browser to a website that the site owner connects, acting as one or more simulated visitors with a goal the site owner sets, and produces a report of each visit. It is available, among other ways, as an app in the Wix App Market. This section adds to the rest of this Policy. Information we collect. From the app marketplace: the app installation ID, the site ID and address, the site owner's ID and e-mail address, the dashboard language, and plan and billing status. From the site owner: test goals, site settings, test accounts (logins and passwords) and a site password if the site is protected, visitor profiles they create, an e-mail address for notifications, support messages and, if they sign in for support, the e-mail address and name of the account they sign in with (Google, Microsoft or Facebook). From each simulated visit: the addresses of the pages visited, the text and screenshots of those pages, the actions and reasoning of the simulated visitor, timings and the report. From use of the dashboard: which pages are opened, report downloads, time zone and display settings. Our role. We are the controller of the site owner's account information. Pages of the owner's website, including any personal data shown on them (for example, names in public reviews), are recorded during simulated visits on behalf of the site owner, who decides which site and pages are tested. Site owners should not use real customer accounts for tests. AI processing. Page text and screenshots from simulated visits, with the goal and the visitor profile, are sent to third-party AI providers to decide each next step of the visitor and to write the report, under the same restrictions as described in the section "Artificial intelligence processing". Passwords for test access are used only by our automated browser to sign in; they are not sent to AI providers, are not shown in reports and are not written to logs. E-mails. We use the site owner's e-mail address for service e-mails, such as notices about scheduled tests and messages from our team. Schedule e-mails can be turned off in the app. AI assistant of the platform. If the site owner asks the platform's AI assistant (Wix Aria) about Visitor Simulator, we send it summaries of the site's tests and results to answer the question. Retention. Reports and test history are shown in the app for the history period of the owner's plan. We keep account data, settings and test data while the account exists, including after the app is removed from the site, so that history and settings are available if the app is installed again. A site owner can ask us to delete this data at any time by writing to privacy@insitelabs.ai from the site owner's e-mail address or including the site address; we delete it within 30 days, except where we must keep it by law.

We process data in compliance with applicable data protection law, including the Israeli Privacy Protection Law, 5741-1981, and its regulations (including the Privacy Protection Regulations (Data Security), 5777-2017), and, where our processing falls within its scope, the EU General Data Protection Regulation (GDPR) and equivalent laws. Where a legal basis is required, we rely on one or more of the following, as applicable: • Contract performance — to provide the Service to customers who have agreed to our Terms; • Legitimate interests — to operate, secure, improve, and commercialize the Service, provided such interests are not overridden by data subjects' rights; • Legal obligation — to comply with applicable law, court orders, or regulatory requirements; • Consent — where required by law and where we have obtained it (e.g., for certain cookies or direct marketing communications).

We do not sell personal data. We may disclose data to: • cloud hosting, infrastructure, storage, monitoring, analytics, and email service providers who process data on our behalf subject to appropriate data protection obligations; • AI model providers, NLP services, and machine learning infrastructure providers necessary to deliver Service functionality; • payment processors, merchants of record, and billing service providers; • professional advisers, legal counsel, auditors, and insurers; • regulatory authorities, courts, law enforcement, or government bodies where required or permitted by applicable law; • an acquirer, investor, successor, or affiliate in connection with a corporate transaction, merger, acquisition, restructuring, or sale of all or substantially all of our assets, subject to appropriate confidentiality obligations; • any other party with your explicit consent.

Data may be processed, stored, or accessed in countries other than the country where it was originally collected, including countries outside the European Economic Area or Israel that may not offer the same level of data protection. Where required by applicable law, we implement appropriate safeguards for such transfers, which may include standard contractual clauses, adequacy decisions, or other recognized transfer mechanisms. By using the Service, you acknowledge that such international transfers may occur.

We retain information for as long as necessary for the purposes described in this Privacy Policy, including to provide the Service, maintain records, resolve disputes, enforce agreements, improve products, comply with legal obligations, and protect our legal rights. Specific retention periods may vary by data category, customer configuration, legal requirements, and technical constraints. When data is no longer required for these purposes, we delete, anonymize, or aggregate it in accordance with our internal practices.

We implement reasonable technical and organizational measures designed to protect information against unauthorized access, loss, destruction, misuse, alteration, or disclosure. These measures are aligned with the requirements of the Israeli Privacy Protection Regulations (Data Security), 5777-2017, and, where applicable, with Article 32 of the GDPR. No method of electronic transmission or storage is fully secure, and we cannot guarantee absolute security.

We may aggregate, anonymize, de-identify, transform, and use data derived from the Service for analytics, benchmarking, product development, model improvement, diagnostics, marketing, security, and other lawful business purposes. Data that has been rendered non-identifiable and cannot reasonably be re-attributed to an individual is not subject to the restrictions in this Privacy Policy.

Subject to applicable law, individuals may have the following rights regarding their personal data: • Access — to request confirmation of whether we hold personal data about you and, if so, a copy of that data; • Correction — to request correction of inaccurate or incomplete personal data; • Deletion — to request deletion of personal data where it is no longer necessary or where you withdraw consent; • Restriction — to request restriction of processing in certain circumstances; • Objection — to object to processing based on legitimate interests; • Portability — to receive personal data in a structured, commonly used format where technically feasible and legally required. To exercise these rights, contact us at legal@insitelabs.ai. We will respond to verifiable requests within 30 days, or within the timeframe required by applicable law. You also have the right to lodge a complaint with the relevant data protection authority in your jurisdiction — in Israel, the Privacy Protection Authority (PPA); in the EU, the competent supervisory authority in your EU member state.

The Service is not directed to children under the age of 18. We do not knowingly collect or process personal information from individuals under 18 years of age as a primary audience. If you become aware that a child under 18 has provided personal data through the Service, please contact us at legal@insitelabs.ai and we will take steps to delete such data.

The Service and our website may use cookies, local storage, or similar technologies for purposes including authentication, session management, security, functionality, analytics, and preference storage. You may control cookie settings through your browser. Disabling certain cookies may affect the functionality of the Service or our website. We do not use cookies to build advertising profiles or sell data to third-party advertisers.

The Service may integrate with or display links to third-party platforms, AI providers, payment processors, and other services. We are not responsible for the privacy practices, content, or security of any third-party service. Their respective privacy policies and terms govern their processing of your information.

We may update this Privacy Policy from time to time. The revised version becomes effective when posted. If changes are material, we may provide additional notice (such as email or an in-product notice). We encourage you to review this Policy periodically.

This Privacy Policy is governed by the laws of the State of Israel. Any dispute arising out of or relating to this Privacy Policy is subject to the jurisdiction provisions set forth in our Terms and Conditions.

For privacy-related enquiries, rights requests, or complaints: Insite Labs Ltd. Email: legal@insitelabs.ai Website: insiteai.app