Security & Compliance

European by default

Insights Hive LTD is established in Sofia, Bulgaria, and operates within the European Union. Customer data is processed under the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act. Our supervisory authority is the Bulgarian Commission for Personal Data Protection.

For European customers this means personal data does not need to leave the EU to be processed, and no additional transfer mechanism is required for standard use of the platform.

Where your data is stored

Customer data is hosted in data centres located in the European Union.

Where a customer requires a specific region, we confirm what is possible before contract.

Roles under GDPR

For data our customers put into the platform — user accounts, store records, imagery captured by field teams — the customer is the data controller and Insights Hive is the processor. We process that data on documented instructions, under a data processing agreement forming part of the contract.

For data we collect ourselves, such as enquiries submitted through this website, Insights Hive is the controller. See our Privacy Policy.

Store imagery and people

Insights Hive analyses photographs of shelves and store fixtures. The platform is designed to extract product, price and shelf information. It does not perform facial recognition and does not identify individuals.

Photographs taken in a working store can nonetheless capture people incidentally in the background. We treat this as a real obligation rather than an edge case: field workflows are designed to frame shelves rather than people, and customers are supported in setting capture guidance for their teams.

Encryption

Data is encrypted in transit between the field application, the platform and customer integrations using TLS. Data at rest is encrypted in our hosting environment.

Access control

Platform access is role-based: users see the stores, territories and KPIs their role permits. Administrative access to production systems is restricted to named personnel who need it, on a least-privilege basis.

Sub-processors

We use a small number of third-party providers to run the platform, covering hosting and operational tooling. Customers are told who they are before contract and are notified of changes.

Retention and deletion

Customer data is retained for the duration of the agreement. On termination, data is deleted or returned according to the terms agreed in the contract.

Certifications

Reporting a security issue

If you believe you have found a security vulnerability, contact us at [email protected]. We will acknowledge and respond.