Privacy Policy

Last updated: May 28, 2026

This Privacy Policy explains what data we collect, how we use it, the legal bases for processing, and your rights under the GDPR and similar laws.

1. Who we are

SMB Insights ("we", "us", "our") is a web application available at smb-insight.com that provides AI-powered business intelligence for small and medium businesses. The service is currently operated by an individual (a sole operator), not an incorporated company.

For any privacy-related inquiry, or to exercise your rights, contact us using the details in the Contact section below.

2. What data we collect

We collect the following:

Account information: when you sign in with Google, we receive your name, email address and profile picture via Google OAuth. We store your email and display name.
Usage data: the insights you generate, the statuses you assign (Starred, In Progress, Validated, Rejected), your source preferences and language settings.
Billing data: your credit balance and transaction history. Card details are handled entirely by Stripe — we never see or store them.
Authentication cookies: session tokens stored in secure HTTP-only cookies to keep you signed in.
Log and technical data: our hosting provider automatically records server logs including IP address, request time and response codes. An IP address is personal data under the GDPR; we use it only for security, abuse prevention and debugging, and retain it for up to 30 days.
Analytics and advertising data: subject to your consent, we use cookies and identifiers from Google Analytics and Google Ads (see sections 4 and 8).

3. Legal basis for processing (GDPR)

If you are in the EEA or UK, we process your personal data on the following legal bases under Article 6 GDPR:

Performance of a contract — to provide the service you sign up for (account, insights, billing).
Legitimate interests — to keep the service secure, prevent abuse and debug errors (server logs, IP address).
Consent — for non-essential analytics and advertising cookies. You give it via our cookie banner and may withdraw it at any time.
Legal obligation — where we must retain certain records to comply with applicable law.

4. Third-party services and data sharing

We share data with the following processors and third parties strictly to run the service:

Google OAuth — authentication. Privacy Policy.
Supabase — database and authentication, hosted in the EU. Privacy Policy.
Anthropic (Claude AI) — receives only article text to generate insights; never your account data. Privacy Policy.
Vercel — hosting and server logs. Privacy Policy.
Stripe — payment processing for credit purchases. Privacy Policy.
Google Analytics 4 — usage analytics, only with your consent. Privacy Policy.
Google Ads — conversion and remarketing measurement, only with your consent. Privacy Policy.
Plausible Analytics — privacy-friendly, cookieless aggregate analytics that does not track individuals. Privacy Policy.

We do not sell your personal data.

5. International data transfers

Some of our providers (Anthropic, Vercel, Stripe, Google) are based in the United States. Where personal data of EEA/UK users is transferred outside the EEA/UK, the transfer relies on the European Commission's Standard Contractual Clauses (SCCs) or an equivalent safeguard maintained by that provider. You can request more detail from us (see Contact below).

6. How we use your data

To authenticate you and maintain your session
To store and display your insights and their statuses
To process credit purchases and maintain your balance
To remember your source and language preferences
To send article text to Claude AI for insight generation — never your personal data
To monitor service health, prevent abuse and debug errors
With consent, to measure usage and advertising performance

7. Data retention

We keep your account data and insights for as long as your account is active. If you delete your account, we delete your personal data within 30 days. Server logs are kept for up to 30 days. Analytics and advertising data are retained according to the respective provider's settings.

8. Cookies and consent

We use two categories of cookies:

Essential cookies — required for the service to work. These do not need consent.
sb-access-token — your authentication token (HTTP-only, secure, session).
sb-refresh-token — refreshes your session without re-login (HTTP-only, secure, 30 days).
Analytics & advertising cookies — set by Google Analytics and Google Ads. These are not loaded until you accept them in our cookie banner. You can accept, reject, or change your choice at any time; rejecting them does not limit your use of the service. Plausible analytics is cookieless and runs without setting cookies.

If you reject non-essential cookies, Google Analytics and Google Ads are not activated.

9. Your rights

Depending on your location, you have the right to access, correct, delete, export, or restrict the processing of your personal data, to object to processing, and to withdraw consent for analytics and advertising at any time. EEA/UK users also have the right to lodge a complaint with their local data protection authority. To exercise any of these rights, contact us (see Contact below); we respond within 30 days.

10. Automated processing

Insights are generated by an AI model (Claude) from public news article text. This processing does not use your personal data and does not produce legal or similarly significant decisions about you. It is a content-generation tool, not automated decision-making about individuals within the meaning of Article 22 GDPR.

11. Data security

We use HTTPS encryption for all data in transit, HTTP-only secure cookies for authentication tokens, and row-level security in our database so users can only access their own data. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your data.

12. Children's privacy

SMB Insights is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

13. EU/EEA users

As the service is operated by an individual rather than a company, we have not appointed a formal Article 27 representative. EEA/UK users may contact us directly for any data-protection matter (see Contact below), and may also contact their national supervisory authority.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date and, where the change concerns consent or new data uses, by asking for your consent again. Continued use after changes constitutes acceptance.

15. Contact

For any privacy question or to exercise your rights:
info@smb-insight.com