Privacy policy

This policy explains how personal data is handled when you visit givefeedback.io, use the app at app.givefeedback.io or the GiveFeedback.io browser extension, or send feedback through the GiveFeedback.io widget on a website that uses it. We collect only what we need to run the service.

Who is responsible

GiveFeedback.io is jointly owned by Realise 4 Consultancy Limited (company number 360889, 2 Bellevue Lawn, Delgany, Co. Wicklow, A63 DT63, Ireland) and Vidasoft Developments S.L. (CIF B67973354, Calle Enmedio 9-11, Paseo Ducal, 9º, 12001 Castellón, Spain). Together they are joint controllers of the data of website visitors and account holders: they decide jointly why and how it is used ("we" in this policy).

The essentials of their joint-controller arrangement:

• Realise 4 sells the subscriptions, handles billing and is your main point of contact;
• Vidasoft develops and maintains the software and runs the servers it operates on;
• both answer requests about your data, and you can exercise your rights with either of them. The simplest way is hello@givefeedback.io, which reaches both.

When people send feedback through the widget on a customer's website, that customer is the controller of the feedback and we process it on their behalf, as their processor (see "Feedback sent through the widget" below).

Website visitors

• Analytics, only with your consent. If you click "Accept analytics" in the cookie banner on the website, or in the app's cookie prompt, we use Google Analytics 4 to count visits and see which pages and features are used: pages viewed, referring site, approximate location (country/city), device and browser type. Google Analytics 4 does not store IP addresses. Google signals and ad personalisation are off. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with "Cookie settings" in the footer. Details in the cookie policy.
• Messages and emails you send us. If you use the contact form or email us, we use your name, email address and message to reply. The form goes through our app server, which keeps it in our support inbox and emails it to us through our email provider (currently Resend); to block spam, it keeps a count of messages per IP address for 10 minutes. Legal basis: our legitimate interest in answering you (Art. 6(1)(f)), or taking steps before a contract (Art. 6(1)(b)).
• Server logs. Like any website, our hosting provider processes your IP address and browser details to deliver pages and protect the site from abuse. Legal basis: legitimate interest in running a secure website.

Apart from the contact form, the website has no forms (no newsletter sign-up), advertising pixels or social-media trackers, and its fonts and videos are served from our own domain.

Account holders and invited users

If a project uses the Email integration, we email its feedback reports to the project owner, or to the owner and the project's members, as the owner chooses: each report as it arrives, or one daily digest listing the day's reports.

If a project sends to Slack or Discord, choosing the channel shows you the channels the app can post to (their names and IDs, read from the tool when you open the list), and we keep only the ID of the one you pick. When someone clicks Resolve or Reopen on one of our messages there, the tool sends us details of the click, including who clicked (their user ID and name in that tool). We use only the workspace or server, the channel, the message and the button clicked, to find the report and update it; we don't use or store who clicked.

We send you service emails: account verification, password resets, invitations, plan changes, cancellations, warnings when you approach your feedback limit, one reminder a few days after you sign up if your website isn't set up yet, and an email when a friend you invited starts using GiveFeedback.io. That email gives your friend's first name, so if you signed up with someone's invite link, they are told your first name when the first feedback from your website arrives. When you reach 80% of the free limit we also send one email about upgrading; you can ask us not to send it. We don't send newsletters or other marketing emails unless you separately opt in.

Feedback sent through the widget

When someone clicks "Give Feedback" on a website that uses GiveFeedback.io, the report sent to the website owner contains:

• the screenshot they took and their annotations (the screenshot shows whatever was visible on their screen, which may include personal data; on phones it is drawn from the page in their browser, and anything the website marks as private appears as a locked box);
• the title, description and feedback type they wrote or chose;
• technical information: page URL, browser and version, operating system and version, screen resolution, whether it is a mobile device, browser language, time zone and whether cookies are enabled, and, on phones, how the screenshot was made and which content from other websites it couldn't include;
• the page element they point at, if they choose one: its CSS selector and a short excerpt of its visible text (never what is typed in form fields);
• a log of the page's console messages, errors and failed requests (request addresses without query strings), up to the last 200 entries. It is kept in the reporter's browser and only sent with a report, and the website owner can turn it off.

The report doesn't include the reporter's name, email or IP address (unless they send it with our browser extension, see below), reporters don't need an account, and the widget doesn't set cookies. It keeps only two choices in the reporter's own browser, never sent to us: the language they pick in the form and, if they opened the website with its testers' link, that they did, so they keep seeing the button. Our servers, like any web server, briefly log the IP address of each request for security (see "How long we keep data").

The screenshot is taken in the reporter's browser. Only if the website owner turns on our optional server-side screenshot feature, the widget sends the page's HTML, screen size and browser user agent to our screenshot server (operated by Vidasoft Developments S.L.) to render the image.

On phones, the reporter's browser can't read images, fonts and stylesheets hosted on other websites unless those websites allow it. Only if the website owner turns on "Include images from other sites in phone screenshots" (a paid-plan option), the reporter's browser fetches those files through our server, so they appear in the screenshot. Our server then receives the reporter's IP address and the addresses of those files. It keeps the IP address only in hashed form, in a counter that limits use and expires after a day; it keeps fonts and stylesheets for up to an hour so other visitors of the same website don't fetch them again, and never keeps images; and when it refuses a file, its log records the other website's name, not the file's address.

The website owner (our customer) decides why and how this feedback is used and is the controller; we store and process it on their behalf under the data processing terms in our terms of service. If you sent feedback on a website and want to exercise your rights, contact the owner of that website; we'll help them respond.

The browser extension

The GiveFeedback.io extension for Chrome lets you and your team send feedback on your own projects' websites. It has no account of its own: on app.givefeedback.io it uses your signed-in session to read your name and your projects (their names, addresses and tokens), and keeps that list in your browser, together with any website you add with a project's token. It runs only on those websites and on app.givefeedback.io.

On those websites, when you send feedback, it takes a screenshot of the visible tab and records the page's console messages, errors and failed requests from the moment the page loads (kept in your browser and sent only with a report). The report is sent only to us, with the same content as a report sent through the widget, plus a code that tells us which account sent it, so the project's dashboard shows your name. The extension has no analytics or advertising, and we don't sell or share what it reads.

The use of the information the extension receives adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements: it's used only to send your feedback to your project, it's passed on only to deliver it (to the tools you connect to the project), it's never used for advertising, and our staff don't read it unless you ask us to (for support) or security or the law require it.

Who processes data for us

We use these service providers (sub-processors), each bound by a contract to protect the data:

If you choose Custom API for a project, we send its feedback reports to the address you enter, and if you connect Claude or another AI assistant, it reads the feedback of the projects you choose for it (screenshots included) with the token you create. That software is yours or your provider's, not our sub-processor: what happens to the data there is governed by your own agreement with its provider.

We don't sell personal data, and we don't share it with anyone else unless the law requires it.

Transfers outside the EEA. Where a provider processes data outside the European Economic Area, the transfer is protected by the EU-US Data Privacy Framework (where the provider is certified) or by the European Commission's Standard Contractual Clauses.

How long we keep data

• Account data and your projects' feedback: while your account is open. Feedback you delete disappears from your dashboard straight away. You can close your account yourself in the app, in your profile under "Privacy and your data": your account is anonymised and signed out everywhere at once, and its projects, feedback and screenshots are then permanently erased in the background. You can also email us and we do it within 30 days. Either way, we keep what the law requires us to, such as payment records.
• Server and application logs (which may contain IP addresses and account IDs): 30 days.
• Feedback above your plan's limit: kept hidden for 30 days from the first hidden report, then deleted with its screenshots unless you upgrade.
• Feedback on the Free plan: deleted with its screenshots 3 months after it arrives (the account owner is told by email before this first applies).
• Invoices and payment records: 6 years, as required by Irish tax law.
• Analytics: according to our Google Analytics retention setting, at most 14 months.
• Messages from the contact form and the app's Help page, and emails with us: as long as needed to handle your request, and no longer than 2 years after our last exchange.

Your rights

You can ask us to access, correct, delete, restrict or export your personal data, and you can object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting what happened before. You can download a copy of your data and close your account yourself in the app, in your profile under "Privacy and your data". For anything else, email hello@givefeedback.io; we reply within one month.

You also have the right to complain to a data protection authority. Our lead authority is the Data Protection Commission in Ireland (dataprotection.ie), and you can also contact the authority where you live (in Spain, the AEPD).

Security

Data is sent over encrypted connections (HTTPS), passwords are stored hashed, access to production systems is limited to the people who need it, and each widget only accepts reports from the website registered for its project.

Children

GiveFeedback.io is a business tool and isn't intended for anyone under 18. We don't knowingly collect data from children.

Changes

If we change this policy in a way that matters, we'll update the date above and, for account holders, tell you by email before the change applies.