Privacy Policy

1. Who we are

Lukáš Drahý (“we”, “us”, “our”) operates MauticInsights, a SaaS analytics and monitoring dashboard for Mautic marketing-automation instances.

Data controller:
Lukáš Drahý
Chudenická 1059/30, 102 00 Praha 10 - Hostivař, Czech Republic
Company ID (IČO): 87439077
Contact: hello@mauticinsights.com

2. What data we process and why

2.1 Account holders (our customers)

• Name, email, billing details — account management and invoicing. Legal basis: contract (Art. 6(1)(b) GDPR).
• Usage data (logins, API calls) — operating and securing the service. Legal basis: legitimate interest (Art. 6(1)(f)).
• Support messages — answering your requests. Legal basis: legitimate interest (Art. 6(1)(f)).

2.2 Marketing contacts inside monitored Mautic instances

We process this data on behalf of our customers, who are the data controllers for it. For this data we act as a processor under Article 28 GDPR. It may include name, email address, email-engagement events (opens, clicks), form submissions, page-visit history, a calculated MQL score, and UTM attribution — as determined by the controller.

If you are such a contact and want to exercise your data rights, please contact the organisation whose Mautic instance holds your data. We will assist that organisation in honouring your request.

2.3 Visitors to this website

When you create an account we store the email address and credentials you provide so we can operate your MauticInsights account and contact you about the service. Legal basis: contract (Art. 6(1)(b)) and, where you opt in to marketing, consent (Art. 6(1)(a)), which you can withdraw at any time.

3. Automated profiling and MQL scoring

We calculate a Marketing Qualified Lead (MQL) score for contacts in monitored instances from behavioural signals such as email opens, clicks, page visits, and form submissions. This is profiling within the meaning of Article 4(4) GDPR. It is used only to help our customers’ teams prioritise outreach; no fully automated decisions with legal or similarly significant effects are made solely on this score. You can object to profiling for direct-marketing purposes at any time.

4. Cookies and analytics

We use cookies that are strictly necessary for sign-in and core functionality. We also use Google Analytics 4 to measure audience and usage. Analytics is loaded only after you acknowledge the cookie notice. Google processes this data as described in its own policies; where data is transferred outside the EEA it is covered by Standard Contractual Clauses. You can opt out using the Google Analytics opt-out browser add-on or your browser’s cookie controls.

5. Who we share data with

• Hetzner Online GmbH (hetzner.com) — infrastructure processor (Germany / EU); DPA in place.
• Google (Google Analytics) — analytics processor.
• Our customers — controllers of their contacts’ data.

We do not sell personal data and do not share it with advertisers or data brokers.

6. International transfers

Personal data is processed within the European Economic Area (EEA) or, where transferred outside the EEA, under Standard Contractual Clauses (Commission Decision 2021/914) together with a transfer impact assessment.

7. Your rights

Subject to applicable exceptions you have the right to access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time. To exercise any of these, email hello@mauticinsights.com. We respond within 30 days (extendable to 90 for complex requests).

You also have the right to lodge a complaint with a supervisory authority — in the Czech Republic, Úřad pro ochranu osobních údajů (uoou.cz), or the authority in your EU member state of residence.

8. Security

We use TLS for data in transit, role-based access control on the principle of least privilege, token-based API authentication with rotation, and HMAC-SHA256 validation of ingest payloads. Access is reviewed regularly and staff are bound by confidentiality obligations.

9. Retention

We keep account and contact data for the duration of the account plus a short grace period, then delete it. Billing records are retained as required by law (typically 7 years under Czech accounting rules). Historical event data is retained for analytics and then purged. When you remove an instance, its stored events, request logs, and metrics are deleted from our database.

10. Changes to this policy

We notify customers of material changes by email at least 30 days in advance. The current version is always available on this page.

11. Contact

Questions about this policy or your data: hello@mauticinsights.com.