1. About this policy
This Privacy Policy explains how Userlens, Inc. ("Userlens," "we," "us," or "our") processes personal information when you visit userlens.io and its subdomains, use the Userlens platform and related services (the "Services"), or communicate with us.
Userlens is a customer adoption and retention platform. It connects to data selected by our business customers, understands how their customers use their products, and helps deliver useful, personalized guidance.
This policy does not cover third-party services that you choose to visit or connect to Userlens. Those services have their own privacy practices.
2. Our role
For information about our customers, prospective customers, website visitors, and Users who operate Userlens, Userlens generally acts as the controller and decides why and how the information is processed.
When a customer sends us information about the Accounts and People who use its product, the customer is the controller and Userlens acts as its processor. We process that customer data according to the customer's instructions, our agreement with the customer, and applicable law. If you are an end user of one of our customers and have a question about that customer's use of your information, please contact the customer directly.
3. Information we collect
Information you provide
- Contact and account information: name, work email address, company, role, login details, and account identifiers.
- Billing and transaction information: billing contact, billing address, plan, and transaction records. Payment card details are handled by our payment provider.
- Communications: messages, meeting details, support requests, feedback, and other information you send to us.
- Business information: product context, campaign instructions, goals, rules, and other material a customer provides when using the Services.
Information processed through the Services
Our customers choose which data sources to connect and what information to provide. Depending on those choices, the Services may process:
- product usage and behavioral data, such as events, sessions, feature interactions, and activity over time;
- Person data, such as name, work email, role, identifiers, product state, and communication history;
- Account data, such as company name, plan, subscription status, configuration, and relationships between People and Accounts;
- content generated, reviewed, or sent through the Services, along with delivery and outcome information; and
- technical data, such as browser, device, IP address, log, and security information.
Customers must not use the Services to collect sensitive personal information unless that use is expressly agreed with Userlens and permitted by law.
Information collected from the website
We receive basic technical information needed to deliver and secure the website, such as request, device, browser, and log information. If you accept analytics cookies, we also collect page views, interactions, referrer information, session activity, and similar usage information through PostHog.
Information from other sources
We may receive business contact information from referrals, service providers, public professional sources, and integration partners. We may combine it with information we already hold when permitted by law.
4. How we use information and our legal bases
| Purpose | Typical legal basis |
|---|---|
| Provide, operate, support, and bill for the Services | Performance of a contract and steps requested before entering a contract |
| Authenticate Users, prevent abuse, maintain security, and troubleshoot | Performance of a contract and our legitimate interests in protecting Userlens, our customers, and others |
| Communicate about the Services and respond to requests | Performance of a contract and our legitimate interests in operating our business |
| Analyze and improve the website after you accept analytics cookies | Your consent |
| Improve the Services using aggregated or de-identified information | Our legitimate interests in developing and improving the Services |
| Send marketing where permitted and manage your preferences | Your consent where required, or our legitimate interests where permitted |
| Comply with law, enforce agreements, and protect legal rights | Legal obligations and our legitimate interests |
Where we rely on legitimate interests, we consider whether those interests are outweighed by your rights and reasonable expectations. You may ask us for more information about that assessment.
5. Artificial intelligence and automated processing
The Services use artificial intelligence to analyze product context and behavior, identify adoption opportunities, and prepare personalized guidance. We may use AI service providers, including Anthropic, to process information only as needed to provide these features.
Customers determine which data is connected, define campaign goals and boundaries, and authorize campaigns. Userlens is not intended to make decisions that produce legal or similarly significant effects about website visitors or our customers' end users.
7. When we share information
We do not sell personal information. We may share information in these circumstances:
- Service providers: providers of hosting, analytics, AI, payments, email delivery, communications, support, and security that process information for us under appropriate obligations.
- Customer-selected integrations: third-party services a customer chooses to connect. The customer controls these connections and can disconnect them.
- Legal and safety reasons: when required by law or reasonably necessary to protect rights, safety, security, and the integrity of the Services.
- Business transactions: in connection with a financing, merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and data protection measures.
- With your direction or consent: when you ask us to share information or otherwise authorize us to do so.
8. International transfers
Userlens and its service providers may process information in countries other than the country where it was collected. Our primary service infrastructure is hosted in AWS regions in Frankfurt and Stockholm. Some providers, including website analytics and AI providers, may process information in the United States or other countries.
When required, we use recognized safeguards for international transfers, such as adequacy decisions or standard contractual clauses.
9. Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including providing the Services, meeting contractual commitments, resolving disputes, and complying with law.
Customer data is retained according to the applicable agreement and customer instructions. Unless otherwise agreed, the standard service retention period covers the current rolling year and the two previous calendar years. We delete or return customer personal data after termination or a valid customer request, subject to legal requirements and limited backup retention.
Consent preferences remain in your browser until they are cleared or replaced. PostHog analytics identifiers may remain for up to one year after consent. Aggregated or de-identified information that can no longer identify a person may be kept longer.
10. Security
We use technical and organizational safeguards designed to protect personal information against unauthorized access, loss, alteration, and disclosure. These safeguards include access controls, confidentiality obligations, and measures appropriate to the nature of the information. No system can be guaranteed to be completely secure.
11. Your rights and choices
Depending on where you live and the circumstances, you may have the right to:
- access personal information we hold about you;
- correct inaccurate or incomplete information;
- request deletion or restriction of processing;
- object to processing based on legitimate interests or direct marketing;
- receive certain information in a portable format;
- withdraw consent at any time; and
- lodge a complaint with your local data protection authority.
To exercise a right, contact us using the details below. We may need to verify your identity. Rights can be subject to exceptions under applicable law. If Userlens processes your information for one of our customers, please direct the request to that customer.
You may lodge a complaint with the supervisory authority where you live or work. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.
12. Children
The website and Services are intended for businesses and are not directed to children. We do not knowingly collect personal information directly from children.
13. Changes and contact
We may update this policy as our Services or legal obligations change. We will update the date at the top of the page and provide additional notice when a change is material and required by law.
For privacy questions or requests, contact ankur@userlens.io.