This Privacy Policy describes how [COMPANY_NAME] ("we", "us", "our") collects, uses, stores, and protects personal information in connection with the [PLATFORM_NAME] platform (the "Service") available at [WEBSITE_URL].
This Policy applies to:
This Policy does not apply to:
By using the Service, you acknowledge that you have read and understood this Privacy Policy.
[COMPANY_NAME]
[COMPANY_LEGAL_ADDRESS]
Email: [PRIVACY_CONTACT_EMAIL]
Website: [WEBSITE_URL]
For GDPR purposes:
For EEA/UK/Swiss residents: contact our Data Protection representative at [DPO_EMAIL].
When registering or being invited, we collect: name, email address, password (stored only in hashed form), Google account identifiers (if using Google sign-in), company information (name, email, phone, logo), user role, and timestamps.
We use token-based authentication. Session tokens are stored in your browser's local storage. We track failed login attempts to prevent brute-force attacks. We do not use tracking cookies.
When a Respondent submits feedback, we collect: feedback content, submission timestamp, browser information (for anti-fraud), and optionally name and email (only if the Respondent chooses to share their identity). Voice recordings, if submitted, are transcribed and not permanently stored after transcription.
Respondents: feedback is collected on behalf of Customers, who are the data controllers. To exercise your data rights, contact the company whose form you used. If you cannot reach them, contact us at [PRIVACY_CONTACT_EMAIL].
Feedback is analyzed by AI to generate summaries, sentiment analysis, emotional traits, intent signals, and semantic search capabilities. This involves sending feedback content to third-party AI providers (see Section 6).
We track AI feature usage for billing and plan management.
We maintain logs of security-relevant actions (logins, logouts, administrative actions) including user identifiers, event type, IP address, and timestamp. Audit logs are automatically deleted after a short retention period.
We use browser localStorage and sessionStorage for session tokens and user preferences (language, theme, layout). No data stored in browser storage is shared with third parties. You can clear this data at any time by logging out or clearing your browser storage.
We do not use tracking pixels, behavioral advertising, or third-party analytics.
If you are in the EEA, UK, or Switzerland, we process your data under the following bases:
A current list of sub-processors is maintained in our Data Processing Agreement.
Our infrastructure is hosted in the United States. If you are in the EEA, UK, or Switzerland, your data will be transferred to and processed in the US.
We rely on Standard Contractual Clauses (SCCs), Data Processing Agreements with all sub-processors, and the EU-U.S. Data Privacy Framework where applicable.
You may request a copy of the relevant transfer mechanisms at [PRIVACY_CONTACT_EMAIL].
On-demand: Customers may delete their account at any time from account settings. Deletion is immediate, irreversible, and removes all associated data.
Inactive accounts: we automatically delete inactive accounts — after 6 months without sign-in (accounts that never had a paid subscription) or 12 months (accounts that previously had a paid subscription). Accounts with an active paid subscription are never auto-deleted. A warning email is sent 30 days before auto-deletion. Signing in cancels the deletion.
Feedback imported from third-party platforms follows the same retention rules, unless the source platform's terms require shorter retention.
You have the right to: access, rectify, erase, restrict processing, data portability, object to processing, withdraw consent, and object to automated decision-making.
Email [PRIVACY_CONTACT_EMAIL] with subject "Data Subject Request". We respond within 30 days.
Respondents: contact the Customer (data controller) directly.
You may lodge a complaint with your local supervisory authority.
The Service is not directed to individuals under 16 (or 13 in the US). We do not knowingly collect data from children.
We implement appropriate technical and organizational measures to protect your data, including encryption in transit, hashed password storage, short-lived authentication tokens, brute-force protection, strict data isolation between customers, role-based access control, and monitored support access.
No method of electronic transmission or storage is 100% secure. In the event of a data breach, we will notify affected individuals and authorities as required by law.
If you are a California resident, you have the right to know what personal information is collected, delete your information, correct inaccuracies, and opt out of sale or sharing.
We do not sell personal information. We do not share it for cross-context behavioral advertising.
Email [PRIVACY_CONTACT_EMAIL] with subject "CCPA Request". We respond within 45 days.
We may update this Policy. Material changes will be communicated via updated date, email notification where required, and in-app notice. Continued use after the effective date constitutes acceptance.
[COMPANY_NAME]
Email: [PRIVACY_CONTACT_EMAIL]
Address: [COMPANY_ADDRESS]
Website: [WEBSITE_URL]
EEA/UK residents: [DPO_EMAIL]
We aim to respond within 5 business days.