Privacy Policy

1. Scope and Who We Are

This Privacy Policy describes how Radulf Group, LLC, doing business as Micro Insights ("Micro Insights," "we," "us," or "our"), collects, uses, discloses, and retains personal information through microinsights.org, our client and expert workspaces, and our expert recruitment, interview, market research, scheduling, and related services.

This policy applies to website visitors, prospective and current clients, account users, experts, interview participants, and professional contacts. It does not govern personal information we process solely on behalf of a client under a separate agreement when the client determines the purposes and means of processing. It also does not apply to our employees or job applicants.

2. Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information:

• Identifiers and contact information, such as name, business email address, telephone number, company, job title, account identifier, and professional profile URL
• Account and authentication information, such as workspace membership, role, sign-in records, and authentication tokens maintained by our identity provider
• Client inquiry and project information, such as research questions, target profiles, business objectives, files, feedback, communications, and project status
• Expert and professional information, such as employment history, professional experience, areas of expertise, qualifications, availability, screening responses, interview participation, and payment status
• Commercial and transaction information, such as services requested, contracts, credits, invoices, payment status, and payout status
• Communications and scheduling information, such as messages, call or meeting details, scheduling preferences, selected time, time zone, and booking metadata
• Internet and device information, such as IP address, browser and device type, operating system, referring URL, pages viewed, interaction timestamps, and advertising identifiers
• Cookie and consent information, such as consent choices, consent identifier, date and time of consent, and the domain and device information associated with the consent record
• Inferences used for our services, such as an assessment of whether a professional profile may match client-approved research criteria

Connected calendar information

If you choose to connect Google Calendar or Microsoft Outlook Calendar, we receive the account identifier associated with the connection, authorization credentials including refresh tokens, connection status, time zone, and free/busy time windows. We may store provider event identifiers and scheduling metadata for Micro Insights interview events that we create or manage at your direction.

We use free/busy results to identify available times and avoid conflicts. We do not retrieve or store the titles, descriptions, attendees, attachments, meeting notes, or other content of unrelated calendar events.

Payment and sensitive information

Payment processors may collect payment card, bank account, tax, or identity verification information directly from you. Micro Insights generally receives transaction references, account status, and payment or payout status rather than complete card or bank account numbers. Authentication credentials and calendar authorization tokens may be treated as sensitive personal information under some laws. We use them only to provide and secure the requested account or calendar feature, and not for advertising.

Please do not submit government identification numbers, health information, precise geolocation, account passwords, or other sensitive personal information in an open-text form unless we specifically request it through an appropriate secure process.

3. Sources of Personal Information

We collect personal information from you, your organization, other participants in a research project or interview, publicly available professional sources, professional networking sites, referrals, clients seeking relevant experts, data and research providers, identity and calendar providers you connect, payment and scheduling providers, and automatically from your browser or device when permitted by your privacy choices.

When a client asks us to identify professionals with particular experience, we may collect and review publicly available professional information before contacting a potential expert. We do not treat a public source as permission to use personal information for an unrelated purpose.

4. How We Use Personal Information

We use personal information to:

• Respond to inquiries and communicate about our services
• Create and administer accounts, organizations, projects, and permissions
• Define research criteria, identify and evaluate potential experts, coordinate interviews, and deliver research services
• Display availability, prevent scheduling conflicts, and create, update, or cancel authorized interview events
• Prepare contracts, administer credits, issue invoices, process payments and payouts, and maintain business records
• Operate, secure, troubleshoot, test, and improve our website, workspaces, and services
• Detect fraud, abuse, security incidents, and violations of our terms
• Measure advertising performance and attribute inquiries or scheduled meetings when marketing consent is active
• Send service communications and, where permitted, marketing communications
• Comply with law, enforce agreements, establish or defend legal claims, and protect people, property, and our services

AI-assisted features

Our authenticated workspace may use artificial intelligence service providers to process project prompts, files, and instructions and return requested research-planning, search, matching, or workflow outputs. We use those outputs to assist our services and do not rely on them to make decisions that produce legal or similarly significant effects about an individual. Users should review generated output before relying on it. Dictation audio used to create text is not retained by Micro Insights after transcription.

We do not use connected-calendar information for advertising, credit decisions, or training generalized artificial intelligence or machine-learning models.

5. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients for the purposes described in this policy:

• Service providers and contractors that support hosting, databases, authentication, security, communications, email delivery, scheduling, analytics, consent management, payments, payouts, document processing, and AI-assisted features
• Clients, experts, and interview participants when disclosure is reasonably necessary to evaluate a potential match, coordinate an authorized interview, or deliver the requested service
• Advertising and measurement partners when you have permitted marketing technologies
• Professional advisers, auditors, insurers, and financial institutions
• Government authorities, courts, and other parties when required by law or reasonably necessary to protect rights, safety, and security
• A buyer, successor, or other relevant party in connection with a financing, merger, acquisition, reorganization, or sale of all or part of our business, subject to appropriate confidentiality protections

Our service providers include or may include Railway for hosting and data infrastructure, Clerk for identity and authentication, Resend for email delivery, Calendly for scheduling, Cookiebot by Usercentrics for consent management, PostHog for public-website analytics and privacy-masked session replay, Stripe or another payment provider for payments and payouts, Google and Microsoft for connected calendars, and OpenAI for AI-assisted features. The provider involved depends on the feature you use.

When you schedule through an embedded Calendly page, Calendly processes the contact and scheduling information needed to display availability, create the booking, send confirmations and reminders, and support cancellation or rescheduling. Calendly may use cookies or similar technologies under its own privacy notice.

We do not sell personal information for money. As explained below, some privacy laws may define our consent-based disclosure of online identifiers and hashed contact identifiers to Meta for advertising measurement as a sale, sharing, or processing for targeted advertising. You may opt out at any time.

6. Meta Advertising Measurement

With marketing consent, we use Meta Business Tools, including the Meta Pixel and Conversions API, to measure whether Meta advertising leads to website visits, inquiries, or scheduled meetings, deduplicate browser and server events, create or refine advertising audiences, and improve campaign performance.

Depending on the event and information available, we may disclose to Meta the event name and time, event identifier, page URL, form or offer name, IP address, browser user agent, Meta click and browser cookie identifiers, and cryptographically hashed contact identifiers such as email address, phone number, first and last name, and an internal lead identifier. Hashing changes the form of an identifier but does not make it anonymous to a recipient that can match it. We do not send Meta the narrative content of your research request, uploaded files, connected-calendar information, or unrelated project content.

For visitors in regions where our consent banner is displayed, the Meta Pixel is not loaded and Meta Conversions API events are not sent unless our consent system records marketing permission. Outside those regions, marketing measurement may be active by default. We continue to honor a prior opt-out and supported Global Privacy Control signals. You may opt out or change your choice through Do Not Sell or Share in the website footer. A change applies to future processing and does not reverse processing that already occurred.

7. Cookies, Consent, and Global Privacy Control

We use cookies and similar technologies that are categorized as necessary, preferences, statistics, or marketing. Necessary technologies support functions such as security, consent storage, and account access. Visitors in regions where our consent banner is displayed receive choices for optional technologies; outside those regions, optional technologies may be enabled by default.

Cookiebot by Usercentrics records and applies available consent choices. Its consent record may include a consent identifier, timestamp, domain, browser information, IP-derived location information, and the categories you accepted or rejected. You can accept or decline optional technologies, customize categories, or change your choices later through Do Not Sell or Share in the website footer.

We use PostHog Session Replay on public website and landing pages to understand navigation, clicks, scrolling, and where visitors encounter difficulty in our request forms. Replay is limited to public-page sessions. We do not identify replay visitors; PostHog associates each replay with a randomly generated anonymous identifier and no PostHog person profile. Replay is configured to mask all text and input values and block images, video, canvas, and embedded frames. We do not enable replay in authenticated workspaces, sign-in and invitation flows, portal previews, or administrative areas, and we disable console-log, network-request, request-header, and request-body capture. URL query strings and fragments are removed before capture.

For visitors in California and Colorado, PostHog does not load or record unless Cookiebot records Statistics permission. Outside those states, Statistics technologies may be enabled by default. A supported Global Privacy Control signal disables this replay, and changing or withdrawing the Statistics choice stops future capture.

Where legally required, we treat a supported Global Privacy Control signal as a request to opt out of sale, sharing, and targeted advertising for that browser or device. Browser settings that merely block cookies may not communicate a legal opt-out request, but they can still limit cookie storage. Blocking necessary technologies may impair site functions.

8. Connected Calendars and API Data

We use Google APIs and Microsoft Graph only to provide the connected-calendar features described in this policy. We request the permissions needed to read free/busy availability and create, update, or cancel Micro Insights interview events. We do not sell connected-calendar information or transfer it to data brokers, advertising platforms, or unrelated third parties.

We may disclose the minimum scheduling information needed to authorized interview participants and service providers acting on our behalf. You can disconnect a calendar in Micro Insights or revoke access in your Google Account or Microsoft account settings.

Micro Insights' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Data Retention

We retain personal information for the period reasonably necessary to provide the services, maintain business and security records, honor privacy choices, resolve disputes, enforce agreements, and comply with legal, tax, accounting, and reporting obligations. We consider the amount, nature, sensitivity, purpose, and legal requirements associated with the information when setting retention periods. We delete, deidentify, or securely dispose of information when it is no longer required.

When you begin a website request but do not complete it, we may retain the email address, contact details you entered, campaign attribution, and form progress for up to 30 days so the request can continue securely and we can understand where the request process was abandoned. An incomplete request is not sent to Meta as a Lead event. Completed inquiries become ordinary business and service-request records subject to the other retention criteria in this policy.

PostHog session replays are retained for 30 days under our current plan. The privacy masking described above is applied before replay data leaves the visitor's browser.

Calendar access and refresh tokens are retained only while the calendar remains connected. Free/busy results are used transiently and are not retained as a copy of the calendar. When you disconnect a calendar, we revoke or disable the connection and remove active credentials promptly, subject to limited security, backup, and recovery cycles. Provider event identifiers and ordinary interview records may be retained to administer interviews, resolve disputes, and meet legal obligations.

Business records such as contracts, invoices, payments, and material client communications may be retained for up to seven years after the relevant transaction or relationship, or longer when required for a legal hold. Consent and opt-out records are retained as needed to demonstrate and honor your choices. Deidentified information may be retained where we maintain measures designed to prevent reidentification.

10. Data Security

We maintain reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. Safeguards include access restrictions, authentication controls, encryption for sensitive stored credentials, encrypted network transport, logging and monitoring, and procedures for reviewing access and security events.

Calendar access and refresh tokens are encrypted at rest, restricted to authorized application processes, and excluded from application logs and audit-event payloads. No security method is perfect, and we cannot guarantee absolute security.

11. Your Privacy Rights

Depending on your residence and applicable law, you may have the right to:

• Confirm whether we process your personal information and access that information
• Correct inaccurate personal information
• Delete personal information, subject to legal exceptions
• Receive personal information you provided in a portable and readily usable format
• Opt out of the sale or sharing of personal information, targeted advertising, or certain profiling
• Limit certain uses and disclosures of sensitive personal information
• Withdraw consent for future processing where processing is based on consent
• Appeal a refusal to act on a privacy request where applicable
• Receive equal service and not be discriminated against for exercising a privacy right

To exercise access, correction, deletion, portability, limitation, or appeal rights, email privacy@microinsights.org or call +1 (972) 632-3551. Describe the right you wish to exercise and provide enough information for us to locate the relevant records. To stop PostHog Session Replay, use Do Not Sell or Share in the website footer and decline Statistics. To opt out of consent-based Meta advertising disclosures, decline Marketing in the same control. A supported Global Privacy Control signal disables both for that browser or device.

We will verify a request to a degree appropriate to the sensitivity of the information and the risk of harm from unauthorized disclosure or deletion. We may ask for additional information and will use it only to verify and respond to the request. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct verification with the person concerned.

We generally respond within 45 days, with an extension where permitted and reasonably necessary. If we deny a request, our response will explain the basis and any available appeal process. To appeal, email privacy@microinsights.org with the subject line Privacy Appeal. We will respond to an appeal within the period required by applicable law and, if the appeal is denied, provide information about how to contact the appropriate regulator or attorney general.

Some rights apply only when a privacy law covers Micro Insights or the relevant processing. We may retain information when an exception applies, including to complete a transaction, maintain security, exercise legal rights, comply with law, or preserve records subject to a legal hold.

12. U.S. State Privacy Disclosures

For purposes of U.S. state privacy laws, the categories of personal information we have collected in the preceding 12 months are described in Section 2. The business purposes are described in Section 4, the sources in Section 3, the retention criteria in Section 9, and the categories of recipients in Sections 5 and 6.

The categories that may be disclosed to Meta for consent-based targeted advertising or cross-context behavioral advertising are identifiers, internet or electronic network activity, and inferences associated with advertising interactions. The recipient category is advertising and measurement partners. We do not knowingly sell or share the personal information of people under 16.

We do not use or disclose sensitive personal information for purposes that require a right to limit under California law. We do not process personal information to make decisions that produce legal or similarly significant effects concerning a consumer. We do not offer financial incentives or price differences in exchange for personal information.

13. Marketing Communications

You may unsubscribe from promotional email by using the unsubscribe mechanism in the message or contacting privacy@microinsights.org. We may still send non-promotional communications concerning an account, transaction, interview, security matter, or service request.

14. Children

Our website and services are intended for business and professional users and are not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact privacy@microinsights.org so we can investigate and delete it where appropriate.

15. International Processing

Micro Insights is based in the United States. Personal information may be processed in the United States and other countries where our providers operate. Those countries may have different data protection laws. Where required, we use appropriate contractual or other safeguards for cross-border processing.

16. Third-Party Services and Links

Our website and services may link to or embed third-party services. Their independent collection and use of personal information is governed by their own notices, except when they process information solely on our behalf. We encourage you to review the privacy terms presented by a third party before providing information directly to it.

17. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, services, or legal obligations. We will post the updated policy with a revised Last Updated date. If a change materially affects how we use personal information already collected, we will provide additional notice or seek consent when required by law.

18. Contact Us

For privacy questions, requests, or complaints, contact:

Radulf Group, LLC (DBA Micro Insights)

Email: privacy@microinsights.org

Phone: +1 (972) 632-3551

For a rights request, use the subject line Privacy Request. For an appeal, use the subject line Privacy Appeal.