Version 2026-09-26 · Solution4Mac
Draft pending legal review. This text describes what the product actually does with data and is not yet vetted language. It is published rather than withheld because a service with no privacy policy leaves you with less than an imperfect one — and saying so here is more honest than presenting unreviewed wording as final.
The short version: personal data in what you send us is masked before it is stored, we keep counts of what was found and never the values, screen recordings are the one thing masking cannot cover, your data lives in the region you chose for as long as your retention window says, and deleting a workspace deletes it.
InsightRecorder is operated by Solution4Mac. This policy covers the hosted service at insightrecorder.com, the browser extension, and the SDKs that send data to it.
On a self-hosted deployment the software runs in your infrastructure and Solution4Mac receives none of your data; this policy then describes what the software does with data, not what we hold.
Under the LGPD, for the data your systems send us you are the controller (controlador) and we are the operator (operador): we process it on your instructions, to provide the service, and for nothing else. For your account data we are the controller.
Account: your e-mail address, a password hash (Argon2id with a server-side pepper — never the password), the version of the terms you accepted with the time, IP address and browser it was accepted from, and, if you enable it, a TOTP secret encrypted at rest. Sign-in with Google or with your company's identity provider gives us your e-mail and whether the provider verified it; we store no provider tokens.
Billing: handled by Stripe. We store the Stripe customer and subscription identifiers and the plan; we never see or store card numbers.
Operational logs: each request is logged with its route, status, timing, a request id and the caller's IP address, for security and debugging. Credential-bearing path segments (invite, reset and verification links, capture and webhook tokens) are redacted from these logs before they are written.
Logs, metrics, traces, captured browser sessions (console output, network calls without bodies or headers, user steps without input values) and screen recordings, sent by your SDKs, your OpenTelemetry collector, the capture agent on your pages, or the browser extension.
Personal data inside logs, captures, metric labels and span attributes is masked before it is stored — e-mail, phone, card number, CPF, CNPJ, SSN, IBAN, plus credentials such as tokens and API keys — including inside base64 and percent-encoded values and in request URLs. Masking runs in the browser agent before transmission and again on the server before storage; the server pass is the enforced one. The detectors are pattern-based: they find the shapes they know, not every personal value, and they do not recognise sensitive personal data under Art. 5º, II (health, biometrics, race, religion, political opinion).
When a detector fires, we keep a count per day, class of data, emitting service and field — never the value, not a fragment, not a hash — so you can fix the source. That tally is what your privacy console and your leak alerts are built from.
Screen recordings are not redacted. A recording is pixels, and masking runs on text. Every surface that offers recording says so before you start.
The extension records the tab or screen you choose, only after you press Record, and stops when you press Stop. It collects: the video, the title you type, the address of the recorded page with its query string removed, and the time. It reads no browsing history, no keystrokes, no form values and no page content, and it contains no analytics, no advertising and no third-party code.
The video streams directly from your browser to the object storage of your workspace's deployment (Google Cloud Storage for the hosted service). It does not pass through our servers; the server only records that a recording exists, who made it, and how large it is.
The API key you paste is kept in the extension's local storage on your device and is sent only to the InsightRecorder server you configured. A key created for the extension can create recordings and can never play them back: watching needs a permission API keys cannot hold.
Permissions, and why: tabCapture and desktopCapture to record what you chose; offscreen to encode video in the background; storage for the key and your preferences; activeTab, tabs and scripting to read the current tab's title and address and to show the recording indicator; host access to the InsightRecorder server and to Google Cloud Storage to upload.
Each workspace is pinned to a region — United States, European Union or Asia-Pacific — and the deployment refuses to write its data anywhere else. Recordings are stored in the object storage of that deployment.
Sub-processors for the hosted service: Google Cloud (hosting and object storage), Stripe (billing), Resend (transactional e-mail). Integrations you connect — an issue tracker, Slack, a paging service, an AI provider — receive only what you send them and are governed by your agreement with them; for the AI provider we set the no-training signal on every request. The current list, with the purpose of each, is in your workspace under Settings → Sub-processors.
We do not sell personal data, and we do not use your data to train models.
Your workspace sets its retention window (90 days by default, up to the ceiling of your plan). A purge job hard-deletes captures, logs, metrics, traces and recordings past the window and records each purge on the audit trail. Per-stream rules can keep some logs shorter or longer than the default.
You can delete a capture at any time, and you can delete the whole workspace: one transaction removes every capture, log, trace, metric, credential, key, rule, setting and member account. Deleting a workspace queues every stored recording for removal from object storage; a removal that fails is retried, never dropped.
What is not deleted, and why: the audit trail. It records actions — who did what, when, to which resource — never content, and it is chained across the whole deployment so that any tampering is detectable. Removing entries would break that guarantee for every other workspace. The deletion screen states this before it asks you to confirm.
The app uses a session cookie (HttpOnly, SameSite=Lax, Secure in production), a CSRF cookie, and short-lived one-time cookies during sign-in flows. There are no analytics cookies, no advertising cookies and no third-party cookies, and the public site loads no third-party script.
Under the LGPD (Art. 18) and, where it applies, the GDPR, you may ask what personal data we hold about you, have it corrected or deleted, receive a copy, and object to its processing. Account holders can do most of this themselves: the workspace exports its data, the audit trail and the PII tally as CSV or JSON, and deletion is a button.
For anything else — including requests from the ANPD or another supervisory authority — write to security@insightrecorder.com. That is the one address we monitor for privacy and security matters, and it is the same one published in our security.txt.
For personal data inside the logs and captures a customer sends us, the customer is the controller: please contact them, and we will support them in answering you.
The service is for engineering teams and is not directed to anyone under 18. We do not knowingly collect data from children.
When this policy changes materially, the date at the top changes with it and account holders are told. The previous text stays available on request.
How the product is secured, and what it does not have, is on the security page; the agreement itself is in the terms of service.