Privacy Policy

How we collect, use, and protect your data

Last updated: October 2026

Data controller

The data controller for this service is:

This Is Ish AB
Org.nr 559546-0162
Hallandsgatan 50A, 118 57 Stockholm, Sweden
info@ishlabs.io

1. Information we collect

Account data

  • Name and email address
  • Company name and role
  • How you found us (the referring page and campaign tags in the link you signed up from)
  • Authentication credentials (via Google or Figma OAuth)

Product data

  • Simulation configurations and study parameters
  • Uploaded design files and prototypes (e.g. from Figma)
  • Session recordings and screenshots generated during simulations
  • AI-generated simulation results and analysis
  • Audio transcription data

Billing data

Payments are processed by Stripe. We do not store payment card details. We retain records of credit purchases, consumption, and transaction history.

Usage data

  • Feature usage and credit consumption
  • Platform interactions and preferences

Automatically collected information

  • Product analytics (page views, feature usage, errors) via PostHog (EU instance)
  • IP address and general location for security and analytics

2. How we use your information

We use your information to:

  • Provide and operate the Ish platform
  • Run AI-powered simulations of user behavior
  • Process and store simulation results
  • Handle billing and credit management
  • Send service notifications and product updates
  • Improve our platform and develop new features
  • Prevent fraud and maintain security

Legal basis (GDPR)

We process your data based on:

  • Contract performance: To provide the services you have signed up for
  • Legitimate interests: To improve our platform, ensure security, communicate about our product, and contact and manage business contacts (see section 13)
  • Consent: For marketing emails to private individuals and for optional features
  • Legal obligation: To comply with accounting and tax requirements

3. AI and automated processing

Ish uses AI to simulate user behavior in digital products. AI inference runs on Google Vertex AI.

  • Customer data is not sent to third-party AI providers outside of Google Cloud
  • Your data is not used to train AI models
  • We do not make automated decisions that produce legal or similarly significant effects on individuals (GDPR Article 22)

4. How we protect your data

Security measures

  • Encryption in transit (TLS 1.2+) and at rest
  • Strict access controls and role-based permissions
  • Secrets management with typed, non-loggable credentials

For full details on our security practices, see our security page.

What we don't do

  • We never sell your personal information
  • We don't share your data with third parties for their marketing purposes
  • We don't use your data for purposes beyond those stated here

5. Data retention

We retain your information only as long as necessary:

  • Account data: While your account is active, plus 30 days after deletion
  • Simulation data: While your account is active, deleted on request
  • Billing records: As required by Swedish accounting law (up to 7 years)
  • Analytics data: Up to 26 months
  • Business contacts and prospects: See section 13

You can request deletion of your data at any time.

6. Third-party services

We use third-party services to operate our platform, including cloud infrastructure (Google Cloud Platform, which also hosts our self-hosted CRM), database and authentication (Supabase), design integration (Figma), browser automation (Browserbase), audio transcription (ElevenLabs), product analytics (PostHog, EU instance), billing (Stripe), transactional email (Resend), and business email (Google Workspace).

A complete list of subprocessors with their locations and certifications is available on our security page.

7. International data transfers

We process and store data primarily within the European Economic Area (EU, Belgium). Business contact data is held in our own CRM on Google Cloud in the EU. Business email runs on Google Workspace, which can process email in other Google regions under Google's data processing terms. AI inference runs on Google Vertex AI and is not yet pinned to the EU, so some of that processing can take place in other Google Cloud regions under Google Cloud data protection terms. We intend to process fully within the EU and are working toward it. Some of our other subprocessors operate in the United States (Figma, Browserbase, Stripe, Resend, Google Workspace). Where data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, and we assess the data protection laws of the receiving country.

8. Your rights under GDPR

Under the General Data Protection Regulation (GDPR), you have the right to:

  • Access your personal information
  • Rectify inaccurate or incomplete information
  • Erasure (right to be forgotten)
  • Data portability – receive your data in a portable format
  • Object to processing based on legitimate interests
  • Restrict processing in certain circumstances
  • Withdraw consent at any time without affecting prior processing
  • Opt-out of marketing communications

To exercise these rights, contact us at info@ishlabs.io. We will respond within one month as required by GDPR.

9. Cookies

We use cookies for the following purposes:

  • Essential: Authentication and session management (required for the platform to function)
  • Product analytics: PostHog for page views, feature usage, and errors

You can change your choices any time from the Privacy preferences link in the footer. Disabling essential cookies may affect platform functionality.

10. Children's privacy

Our services are not directed to individuals under 16 (the age of digital consent under GDPR). We don't knowingly collect information from children under 16 without parental consent.

11. Changes to this policy

We may update this privacy policy as our service evolves. If we make significant changes, we'll notify registered users by email. Continued use after changes means you accept the updated policy.

12. Supervisory authority

If you have concerns about how we handle your data, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY):

13. Business contacts and prospects

This section is for people who are not ish users: people we would like to talk to about ish, and people we already work with in a business context, such as partners, investors and contacts at companies we talk to.

What we collect

  • Your name, work email address, role and company
  • Links to your public professional profiles, such as LinkedIn, GitHub or X
  • Public information about your company and its product, such as a launch post, a public website or a public job listing
  • Our correspondence with you, and notes on our conversations
  • Where and when we first came across you

Where it comes from

  • Public company websites and public professional profiles
  • Public launch platforms and communities, such as Product Hunt or Hacker News
  • Introductions from people who know you
  • You, when you write to us, meet us or reply to us

We do not buy contact data from data brokers or list vendors, and we do not collect sensitive information (such as health, political views or religion).

Why we use it

  • To contact you about ish, when we think it is relevant to your work
  • To manage our business relationships and remember what we have discussed

Legal basis. Our legitimate interest in finding customers and partners for ish and in running our business relationships (GDPR Article 6(1)(f)). We have weighed that interest against your privacy in a written assessment. You can ask us for a copy.

Email. We send unsolicited email only to work addresses. We do not cold-email personal addresses (such as a private Gmail account). A person on our side reviews and approves each message before it is sent, and we contact a small number of people at a time. We do not contact people in Germany or Austria unless they have written to us first.

How long we keep it

  • If you tell us to stop, we stop. We keep only a minimal do-not-contact record (your email address, profile link and company domain) so that we do not contact you again.
  • If we work together, we keep your details for as long as the relationship continues, and delete or minimise them after it ends.

From our CRM migration (October 2026):

  • If we note you as a possible contact but never reach out, we delete your details within 28 days.
  • If we contact you and you never reply, after 18 months we reduce your record to a do-not-contact record.
  • We check do-not-contact records before anyone on our side adds a new contact.
  • Records created before the migration are reviewed at the migration and either kept as an active business relationship or reduced to a do-not-contact record.
  • Deleted records can remain in our encrypted backups for up to 90 days before they expire.

Where it is stored. Our contact records live in our own self-hosted CRM, running on our own Google Cloud in the EU. Our email correspondence is handled by Google Workspace (Gmail). See the subprocessor list on our security page.

Your rights, and how to stop us contacting you. You can object at any time, and we will stop. Reply "unsubscribe" to any message from us, or email info@ishlabs.io. You do not have to give a reason, and it is free. You also have the rights in section 8: access, correction, erasure, restriction and objection, and you can complain to IMY (section 12).

Questions?

For privacy questions or to exercise your rights, contact us at: info@ishlabs.io