Insight Bench, powered by MoDuet (“Insight Bench”, “we”, “us”), is operated by MoDuet. This policy explains what we collect when you use insightbench.com and the Insight Bench app, why, who helps us process it, how long we keep it, and the choices you have. For privacy law purposes (including the EU and UK GDPR and the CCPA), we are the controller (or “business”) for your account data.
What we collect
- Account data: your email address, your first and last name if you give them, your role and team seat, sign-in records, a scrambled (hashed) form of your password if you set one, two-factor settings, and your organization’s profile and settings.
- Website and diagnostics data: the website addresses you check, up to 10 key page paths per site, competitor domains, target keywords, your answers to the Marketing Strategy Scorecard and onboarding questions, and the results of our checks of public information about your site (search metadata, sitemap entries, speed, hosting and security, domain and email settings, and whether AI search crawlers can read it).
- Marketing integration data (if you connect it): read-only access to Google Analytics 4, Google Search Console, Google Ads (including Local Services Ads) and Meta Ads, and the statistics we read from them (visits, visitors, key events, top channels and landing pages, clicks, impressions and top search queries, ad spend, clicks, conversions and lead counts, and campaign names). We don’t read the personal details of your customers or leads. You can disconnect at any time; the statistics are then deleted.
- WordPress plugin data (if you connect the Insight Bench plugin): your WordPress, PHP and database versions; the names, versions and update status of your plugins and themes; security and search settings as yes/no values (for example whether file editing, XML-RPC or “Discourage search engines” is on, or whether a user named “admin” exists); and counts (posts, pages, images without alt text, pages without a meta description). It is sent once a day, after changes and when you re-scan, and only after you click Connect. We never receive your content, user names or emails (other than yours when you connect), passwords, keys, form entries, orders or customer data. Disconnecting stops it.
- Requests you send us: feature suggestions, and strategy call requests with the name, phone number and preferred times you give.
- Billing data: your plan, invoices and subscription status. Card details are collected and held by Stripe; we never see or store full card numbers.
- Technical data: a one-way scrambled (hashed) form of your IP address to enforce rate limits and prevent abuse, how you arrived (for example a referring site or campaign tag), and the cookies described below.
How we use it
- To provide the service: run scans, calculate your Insight Score, build your action plan, send sign-in links, reports, alerts and summary emails, and process payments (necessary to perform our contract with you).
- To keep the service secure and working: rate limits, fraud and abuse prevention, troubleshooting and backups (our legitimate interests).
- To improve Insight Bench using aggregated, de-identified statistics (our legitimate interests).
- To show industry benchmarks (“How you compare”): your website’s scores are combined with those of other websites in the same industry and business type into totals such as the middle score. A group is only shown once it has at least 10 websites, and no business’s name, website or individual score is ever shown to anyone else (our legitimate interests).
- To follow up with you: when you create an account, ask for a strategy call or change your subscription, your contact details and your latest report are shared with MoDuet’s sales team (in our customer support system) so they can help (our legitimate interests, and for strategy calls, your request). This is separate from marketing email, which you only get if you opt in.
- To support you: MoDuet account representatives can open your account read-only (for example to prepare for a strategy call you booked, or to answer a question). They can’t change anything, and each visit needs a recorded reason, ends after a few hours and is logged so we can check how customer accounts are accessed (our legitimate interests).
- To send marketing emails (benchmark reports, tutorials, product updates and offers) only if you tick the box to opt in. You can unsubscribe from any marketing email or in your account settings.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
Who processes it for us
We share only what each service needs to do its job, under a data processing agreement:
| Service | What it does for us | Data involved | Agreement |
|---|---|---|---|
| Stripe, Inc. | Payments and subscriptions | Name, email, billing address, payment card details (held by Stripe, never by us), transaction history | Stripe Data Processing Agreement with EU Standard Contractual Clauses and UK Addendum. Stripe is an independent controller for fraud prevention and PCI compliance. |
| Brevo (Sendinblue GmbH) | Sign-in links, reports, alerts, summaries and, if you opt in, marketing emails | Email address, name, organization name, website scores and alerts | Brevo Data Processing Agreement under the EU GDPR, with data hosted in Europe. |
| Google LLC | PageSpeed Insights and Safe Browsing checks; Sign in with Google; Google Analytics 4, Search Console, Google Ads and Local Services Ads, if you connect them | Website addresses; for Google sign-in, your Google account email and name; for connected accounts, read-only access tokens and site and ad statistics | Google Cloud and API Data Processing Terms. Access to your analytics is read-only and limited to what the features need. |
| Meta Platforms, Inc. | Meta (Facebook and Instagram) Ads statistics, if you connect them | A read-only access token; ad account names, spend, clicks and lead counts | Meta Platform Terms and Data Processing Terms. Access is read-only (ads_read). |
| Anthropic, PBC | AI visibility checks (asking an AI assistant about your business) | Domain, business name, business category, target keywords and public page text | Anthropic Commercial Terms and Data Processing Addendum. Data sent through the API is not used to train models. |
| Cloudflare, Inc. | Bot protection on the free check (Turnstile) | IP address and browser signals during the check | Cloudflare Data Processing Addendum. |
| Liquid Web, LLC | Server hosting | All data stored by Insight Bench | Liquid Web Data Processing Addendum. |
Some of these services are in the United States. Where data leaves the EU or UK, it is protected by the European Commission’s Standard Contractual Clauses (and the UK Addendum) or an equivalent safeguard. We may also disclose information if the law requires it, or to a buyer if our business is sold (they would be bound by this policy).
How long we keep it
- Scan history follows your plan: the last 2 scans on Free, 12 months on Starter and 24 months on Growth.
- After a downgrade or cancellation, data beyond your new plan (older scans and paused sites) is kept read-only for 30 days, then permanently deleted.
- Free checks you don’t save are deleted after 30 days. Sign-in links expire after 15 minutes, and signed-in sessions after 30 days.
- When you delete your account, we delete your data straight away; copies in our encrypted backups are overwritten within 14 days. We keep invoices and payment records for as long as tax law requires.
Your choices and rights
Depending on where you live, you have the right to access, correct, export, or delete your personal data, to object to or restrict some processing, and to withdraw consent at any time. You can do most of this yourself:
- Export your data: Account settings → Download my data (a machine-readable file).
- Delete your account: Account settings → Delete my account.
- Marketing emails: unsubscribe from any email, or turn them off in Account settings.
For anything else, email [email protected]. We respond within 30 days and won’t treat you differently for using your rights. You can also complain to your local data protection authority.
Cookies
- Essential cookies keep you signed in (
ib_session) and remember your cookie choices (ib_consent). The service can’t work without them, so they don’t need consent. - Analytics cookies help us understand how the site is used. They are only set if you choose “Accept” in the cookie banner. You can change your choice at any time with “Cookie settings” at the bottom of every page.
Your light or dark theme choice is stored in your browser only and is never sent to us.
Security
Connections are encrypted (HTTPS). Sign-in links, sessions and passwords are stored only in hashed form, two-factor authentication is available (and required for MoDuet staff who open customer accounts), access to saved reports is limited to your organization, and our servers are patched and backed up regularly. No system is perfectly secure; if a breach affects you, we’ll tell you as the law requires.
Children
Insight Bench is a business tool and isn’t meant for anyone under 16. We don’t knowingly collect data from children.
Changes to this policy
If we make significant changes, we’ll email account owners before they take effect and update the date above. Our Terms of Service explain the rules for using Insight Bench.
Contact
MoDuet. Email [email protected].