Privacy Policy

This Privacy Policy explains how Productsight LLC (“ProductSight,” “we,” or “us”) collects, uses, and protects personal information when you visit our website or use the ProductSight application (the “Service”).

The short version: we collect only what we need to run the Service. We send the feedback you import to Google’s Gemini API so it can be analyzed, and we don’t use it to train AI models. We don’t sell personal information. And you can export or delete your data yourself at any time.

We play two roles. For account and website data, we decide why and how it is used, so we are the “controller” (or “business”). For the customer feedback you import, you decide, so you are the controller (or business) and we act on your behalf as your “processor” (or “service provider”). Section 7 of our Terms covers that relationship.

• Account information: your email address, your password (stored only as a salted hash by our authentication provider, never in plain text), your company or workspace name, and sign-in times.
• Team information: the workspaces you belong to and your role in them. When a workspace owner invites someone, we store the invited email address and send them the invite. Members of a workspace can see each other’s email addresses.
• Acceptance records: the version of the Terms and Privacy Policy you accepted, the time, your IP address, and your browser details (see Section 12).
• Customer Data you import, collect, or create: the files and spreadsheets you upload or connect, and the feedback text and other columns in them. If you add Kai to your own website or app, also the feedback your users send through it, the page, platform (website, mobile web, iOS app, or Android app), device, operating system, and browser it came from, and any name, email address, or user ID you or they provide. These may include names, email addresses, ratings, dates, or other fields your own customers provided. Also the AI-generated classifications, insights, charts, PRD drafts, and the roadmap items you create.
• Connected services (optional): if you connect a third-party service to bring feedback into the Service, such as a support desk, a survey or form tool, an app store, or your Google account, we receive the credentials that let us access it (an access token when you sign in to that service, or an API key or service account key you give us), stored encrypted, and basic details that identify the connected account, such as its name, address, or email. We then read only the kinds of data needed to import feedback, such as support conversations and tickets, survey and form responses, app reviews, and spreadsheets you choose, with related details such as ratings, dates, channels, tags, and the name and email address of the person who wrote them. What we import becomes Customer Data. The services you can connect are listed in the Service and may change over time; each one works as this policy describes. For Google, we can read only the spreadsheets you pick with Google’s file picker, and create the documents you ask us to export to your Google Drive.
• Technical and usage information: IP address, browser and device type, pages requested, timestamps, and error logs, generated by our hosting provider and our servers when you use the Service.
• Waitlist and messages: the name, work email, and company you give us on our website, and anything you send us when you contact us.
• Feedback you send us through Kai, the feedback helper in the corner of our website and app: your message, the kind of feedback and how much it matters to you, the page you were on, and your browser details and screen size. If you’re signed in, we link it to your account email and workspace. If you aren’t, we only have your email if you choose to give it. To prevent abuse we also use a one-way scrambled (hashed) form of your IP address, which isn’t stored with your feedback.

Billing information: when a workspace subscribes, payment is handled by Stripe, and checkout may be provided by Link, a Stripe service that acts as the reseller (merchant of record). They collect the card and billing details needed for the payment and for taxes, such as name, email, and billing address. We don’t receive or store full card numbers. We receive and keep the workspace’s Stripe customer and subscription identifiers, its plan, billing period, subscription status, and renewal date.

We don’t use Customer Data to build advertising profiles or to train AI models, and we don’t sell it.

To classify feedback and generate insights, roadmaps, and PRD drafts, we send the relevant parts of your Customer Data to Google’s Gemini API. We use Google’s paid API service, under which Google’s terms state that prompts and responses aren’t used to improve Google’s products or train its models, and Google processes the data on our behalf. We send only what is needed for the task you asked for.

We also use the Gemini API, on the same terms, to sort and analyze the feedback you send us about ProductSight through Kai.

AI output can be inaccurate, so please review it before relying on it. The Service analyzes feedback text to help you prioritize product work. It doesn’t make automated decisions that have legal or similarly significant effects on individuals.

We use these service providers (sub-processors) to run the Service. Each is bound by terms that limit how it can use the data.

Services you connect. When you connect a third-party service (Section 2), we exchange data with its provider at your direction: we send it your access credentials and our requests, and it sends us the data you chose to import. These providers aren’t our sub-processors: you chose them, and your agreement with them and their privacy policies govern how they handle your data. We use what we receive from them only to provide the Service to you. We only read from a connected service, unless you ask us to create something in it (such as exporting a document to Google Docs); we never change or delete anything there.

We also share information: with people you direct us to (for example, when you publish a shared roadmap link); with professional advisers such as lawyers and accountants under confidentiality; if the law requires it or to protect rights, safety, or security; and in connection with a merger, financing, or sale of our business, in which case we’ll make sure the information stays protected.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We use only what is necessary to run the Service: cookies that keep you signed in, short-lived cookies that protect the sign-in process when you connect a service, a browser storage setting that remembers your light or dark theme, and one that remembers when Kai last checked in with you, so it doesn’t ask too often. When a customer adds Kai to their own website or app, Kai keeps the same check-in setting in that site’s browser storage. If bot protection is enabled on the sign-in forms, Cloudflare may set its own technical cookies.

We don’t currently use advertising or analytics cookies. If we add any, we will update this policy and ask for your consent where the law requires it.

We are based in the United States, and our providers may process data in the United States and other countries. Where the law requires a safeguard for transfers out of the EEA, UK, or Switzerland, we rely on approved mechanisms such as Standard Contractual Clauses, or on our providers’ participation in the EU-US Data Privacy Framework.

We protect information with encryption in transit, encryption at rest provided by our infrastructure providers, database rules that keep each customer’s data separate, encrypted storage of the tokens and keys for services you connect, and limited staff access. Our personnel access Customer Data only to operate and secure the Service, to give support you ask for, to investigate abuse or security issues, or when the law requires it.

No system is perfectly secure. If a breach affects your information, we will notify you and, where required, the authorities, as the law requires.

You can do most of this yourself in the app, under Settings:

• Download a copy of your workspace data (JSON).
• Delete your projects, or delete your account and all workspace data.
• Disconnect any service you connected: Google in Settings, and other services from a project’s Sources.

Depending on where you live, you may also have the right to access, correct, delete, or port your personal information, to object to or restrict certain uses, to withdraw consent, and to appeal a decision on your request. To make a request, email legal@productsight.ai. We may need to verify who you are, and we will respond within the time the law requires, generally within 30 to 45 days. You won’t be treated differently for exercising these rights.

If your feedback appears in data that one of our customers imported, collected with Kai in their product, or brought in from a service they connected (for example, you left an app review, contacted a company’s support team, answered its survey, or sent feedback through Kai in its app), that company decides how it is used. Please contact that company. If you contact us, we will point you to them and help them respond.

If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

In the last 12 months we collected these categories of personal information: identifiers (such as email address and IP address), commercial information (the plans and subscriptions a workspace buys), internet or network activity (technical logs), and content you provide (Customer Data). We collect them for the purposes in Section 3 from you, your use of the Service, and the services you connect, and we disclose them to the providers in Section 5 for business purposes. We don’t sell or share personal information for advertising, and we don’t knowingly collect sensitive personal information; our Terms ask you not to upload it.

California and several other states give residents rights to know, access, delete, and correct their personal information, and to opt out of sale or sharing (which we don’t do). To exercise them, email legal@productsight.ai.

When you accept our Terms and Privacy Policy, we keep a record of the version and a fingerprint (hash) of the exact text you accepted, the time, your email address and account, and your IP address and browser details. We do this so we can show what you agreed to and when, and we may email you a receipt. When we make a material change to the Terms or this policy, we email you a summary of the changes and keep a record of that email: the version, the time, and the address we sent it to. Our legal basis is our legitimate interest in proving what was agreed and what you were told. See Section 8 for how long we keep these records.

The Service is for businesses and adults. It isn’t directed to children, and you must be at least 18 to use it. We don’t knowingly collect personal information from children under 16. If you believe a child has given us information, email legal@productsight.ai and we will delete it.

We may update this policy. Every update changes the date at the top and is listed under “Recent changes” on this page. For material changes, such as collecting a new kind of personal information or using it in a new way, we will also email you a summary of what changed. An update applies from the date shown on this page (and in the email, for material changes).

Productsight LLC. Questions or requests about privacy: legal@productsight.ai.