Privacy policy

The data controller is Observability Insight (Tax ID Pendiente de asignación), located at Barcelona, España, which operates Observability Insight through the website www.observabilityinsight.com (the “Website”) and the portal portal.observabilityinsight.com (the “Portal”).

You can contact us at info@observabilityinsight.com.

• Browsing the Website. Usage data and analytics cookies (page visited, device, approximate location) to measure and improve the Website. Legal basis: your consent (Art. 6.1.a GDPR).
• Contact and report forms. Name, email, company and the message you write, to answer your enquiry or prepare the report you request. Legal basis: pre-contractual measures at your request (Art. 6.1.b) and, failing that, your consent.
• Portal account. Name, email and picture of the Google account you sign in with, plus your workspaces, projects and settings. Legal basis: performance of the contract (Art. 6.1.b).
• Connections to your sources. When you connect Google Analytics 4, Google Search Console, TikTok or other sources, you authorise us through OAuth to read their metrics. We store access tokens encrypted and the imported metrics (sessions, pages, search queries, social metrics, performance test results). Legal basis: performance of the contract.
• AI analysis. To generate reports and answer questions we send aggregated metrics and the necessary context to the configured language-model provider (OpenAI, Anthropic or Google Gemini), which can be your own if you provide your key. Legal basis: performance of the contract.
• MCP access. If you connect an external assistant (for example ChatGPT or Claude), we log the accesses and queries made with your token for security and traceability. Legal basis: performance of the contract and legitimate interest in the security of the service (Art. 6.1.f).
• Security and technical logs. IP addresses and activity logs needed to protect the service and prevent abuse. Legal basis: legitimate interest.

The data you import from your tools may include personal data of your own users or visitors. For that data you are the controller and we act as processor: we process it only to provide the service to you and following your instructions.

You are responsible for having a legal basis to connect those sources. If you need a data processing agreement (Art. 28 GDPR), request it at info@observabilityinsight.com.

The Website uses Google Analytics, which sets analytics cookies (_ga and _ga_*) to measure how the site is used. They are the only non-essential cookies on the Website and are not loaded until you accept them in the notice shown on your first visit. You can accept or reject them equally easily, and change your decision at any time from “Cookie settings” in the footer. We store your choice for 12 months and then ask you again; you can also block cookies in your browser.

The Portal uses strictly necessary technical cookies to keep you signed in and, like the Website, may use Google Analytics.

We do not sell your data. We rely on providers that process it on our behalf under contract:

• Infrastructure: hosting (Vercel) and database, cache and queue providers.
• Google: sign-in, access to Google Analytics and Search Console, and Google Analytics on the Website.
• TikTok and Meta: only for the connectors you enable.
• Formspree: handling of the Website forms.
• AI model providers: OpenAI, Anthropic and Google, depending on your project configuration.

We may also disclose data to authorities and advisers where the law requires it.

Some of these providers are in the United States or other countries outside the European Economic Area. Where that happens, we rely on adequacy decisions (for example, the EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses.

• Account: while it is active and, afterwards, for as long as needed to handle possible legal liabilities.
• Data imported from your sources: according to your plan. The Portal deletes, every day, records that exceed your plan's retention period.
• Finished internal sync jobs: 14 days.
• Forms: for as long as needed to handle your enquiry and, afterwards, blocked for the statutory periods.

You can stop syncing a source whenever you want and also revoke access from your Google, TikTok or Meta account.

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent, by writing to info@observabilityinsight.com. Today, account deletion is handled by email: write to us and we will process it.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.

Encryption in transit (HTTPS), source credentials encrypted at rest (AES-256-GCM), revocable access tokens and workspace-level access control. No system is infallible; if a breach affecting you occurs, we will notify you as required by law.

The service is aimed at professionals and companies, not at people under 18.

We may update this policy. We will always publish the current version with its date and, if the change is substantial, let you know.