Privacy Policy

Inserto is operated by Inserto Operations Ltd. (“we”, “our”, “us”). It is a premium business operations and financial management dashboard built for social commerce merchants and social business owners. You record your products, inventory batches, client orders, and advertising expenses, and Inserto automatically computes live Profit & Loss (P&L) metrics and bookkeeping arithmetic.

This policy covers the Inserto web application and its installable (PWA) version across all platforms. Questions or privacy inquiries go directly to support@inserto.app.

This distinction runs through the whole policy, so it comes first:

Your Account Data (We are the Controller)

The email address you sign up with, your password (stored only as an irreversible, salted bcrypt hash), and your UI preferences. We manage the infrastructure to authenticate and protect your workspace.

Your Customers’ Data (You are the Controller, We are the Processor)

The recipient names, phone numbers, and delivery addresses you record in client orders belong exclusively to your customers, not to us. You decide what to collect and why; we only securely store and process it on your explicit instructions.

All obligations to those customers — answering their access requests, updating records, or deleting entries — remain yours. We provide the built-in tooling: every record is editable, searchable, and deletable in real time, and a complete data export is available in one click from Settings.

Your products, orders, customers, expenses, goals and tax figures are encrypted on your own device, with a key derived from your passphrase, before anything is sent to us. What arrives on our servers is ciphertext. We store it, we back it up, we serve it back to you — and at no point do we hold anything that would turn it back into words and numbers.

Connected Inbox is an exception: when you connect WhatsApp, Messenger, or Instagram, Inserto's backend processes message content to receive and send it. Tokens and synced message copies are encrypted at rest with a server-held key, but they are not part of the zero-knowledge vault.

How the key works

• Your passphrase never reaches us. Your browser runs it through Argon2id, a deliberately slow, memory-hard key derivation function, and splits the result into two independent halves. One half becomes a verifier, which is what we receive and check at sign-in; the other stays on your device and unlocks your data. Holding the verifier gives no path back to the passphrase and no path across to the encryption key.
• Records are sealed with AES-256-GCM — a 256-bit authenticated cipher — with a fresh random initialisation vector for every write, and each record cryptographically bound to its own position in the database so that ciphertext cannot be moved between rows or between accounts.
• Uploaded images are encrypted too, including their filename and file type, and are stored in a private bucket rather than at a public URL.
• Keys never leave your browser in a usable form. They exist as non-exportable browser key handles, so even code running on the page cannot copy them out.

What this costs you, honestly

Encryption is not free, and we would rather set expectations than surprise you:

• Unlocking takes about a second. That pause is the protection working — it is what makes guessing your passphrase expensive for anyone who steals a copy of the database.
• Global search runs in your browser rather than on our servers, because our servers cannot read the fields it would need to search. For a very large order book this means search covers the records currently loaded.
• If you lose both your passphrase and your recovery key, your data is gone. See section 09.

A claim you cannot verify is worth very little, so here is the complete list rather than a reassuring summary. This is the same list shown inside the app at Settings → Account → End-to-End Encryption, and the two are kept identical on purpose.

Visible to us

• Your email address, and when you signed in.
• How many products, orders, expenses, goals and other records exist in your workspace.
• When each record was created and last changed.
• Approximately how large each record is, and how large each uploaded image is.
• Your subscription, plan and billing status, and plan browsing activity.
• Whether you have opened Inserto as an installed app.
• Technical error reports, which carry no record contents.
• If Inbox is connected: channel names, platform-scoped account/customer IDs, conversation timing/counts, and message content while our server receives or sends it.

Sealed from us

• Every customer name, phone number, city and delivery detail you record.
• Every product title, SKU, category, cost price, selling price and stock level.
• Every order — items, quantities, discounts, courier details, tracking codes, totals and notes.
• Every expense, amount, currency, VAT figure, tax profile and financial goal.
• Your store name, slogan, branding, contact details, invoice terms and tax registration number.
• Every product photograph and brand logo you upload.
• Your to-do list, saved searches and workspace preferences.
• Inbox tokens, customer names, previews, and stored message copies are encrypted at rest with a server-held key; unlike the records above, they are not zero-knowledge.

On our database (Supabase, PostgreSQL), stored encrypted:

• Account Credentials & Sessions — Email address, active authentication sessions, linked Google SSO identity.
• Wrapped Encryption Keys — Your workspace key, sealed under your passphrase and recovery key.
• Shop & Brand Profile — Store name, slogan, customized logos, brand colors, base currency, exchange rates, and social channels.
• Products & Inventory Batches — Product titles, SKUs, categories, cost prices, selling prices, stock levels.
• Orders & Customer Records — Order numbers, items, quantities, tracking numbers, customer name, phone number, and delivery address.
• Operational Expenses — Expense titles, category classifications, currency conversions, ad spends.
• Connected Inbox — Channel identifiers, encrypted provider tokens, conversation metadata, and server-key encrypted message copies.

Strictly to operate the workspace you requested: organizing your business ledger, computing live profit margins, generating invoices, exporting records, and enforcing multi-tenant isolation.

• Supabase — Cloud database hosting, user authentication, and secure asset storage.
• Meta — WhatsApp, Messenger, and Instagram message delivery when you connect Inbox channels.
• Cloudflare Turnstile — Privacy-preserving bot protection on authentication routes.
• Google — Only if you explicitly choose “Sign in with Google”, or for custom fonts.
• open.er-api.com — Real-time currency exchange rates for USD-to-BDT conversions.

Every table in the Inserto database is strictly isolated using PostgreSQL Row Level Security (RLS) scoped to `user_id = auth.uid()`. One merchant can never view, query, modify, or delete another merchant’s records.

When encryption is switched on, your browser generates a 50-character recovery key. Lose your passphrase and your recovery key and nobody can bring your records back.

For the lifetime of your active workspace. When you request account deletion, all records are permanently purged immediately.

• Encrypted backup — Export a lossless copy of your workspace.
• 1-Click Complete Export — Export all products, inventory, orders, expenses in JSON and CSV.
• Irreversible Account Deletion — Accessible in Settings.

Inserto is a commercial business operations tool designed for entrepreneurs and adult merchants. We do not knowingly collect data from individuals under 18.

Whenever material updates are made to our data practices, we will post an in-app notice prior to the change taking effect.

Inserto Operations Ltd.
Dhaka, Bangladesh
Official Contact: support@inserto.app