Privacy policy
Last updated: 8 October 2026
This policy explains how personal data is handled when you visit givefeedback.io, use the app at app.givefeedback.io, or send feedback through the GiveFeedback.io widget on a website that uses it. We collect only what we need to run the service.
Who is responsible
GiveFeedback.io is jointly owned by Realise 4 Consultancy Limited (company number 360889, 2 Bellevue Lawn, Delgany, Co. Wicklow, A63 DT63, Ireland) and Vidasoft Developments S.L. (CIF B67973354, Calle Enmedio 9-11, Paseo Ducal, 9º, 12001 Castellón, Spain). Together they are joint controllers of the data of website visitors and account holders: they decide jointly why and how it is used ("we" in this policy).
The essentials of their joint-controller arrangement:
- Realise 4 sells the subscriptions, handles billing and is your main point of contact;
- Vidasoft develops and maintains the software and runs the servers it operates on;
- both answer requests about your data, and you can exercise your rights with either of them. The simplest way is hello@givefeedback.io, which reaches both.
When people send feedback through the widget on a customer's website, that customer is the controller of the feedback and we process it on their behalf, as their processor (see "Feedback sent through the widget" below).
Website visitors
- Analytics, only with your consent. If you click "Accept analytics" in the cookie banner, we use Google Analytics 4 to count visits and see which pages are used: pages viewed, referring site, approximate location (country/city), device and browser type. Google Analytics 4 does not store IP addresses. Google signals and ad personalisation are off. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with "Cookie settings" in the footer. Details in the cookie policy.
- Emails you send us. If you email us, we use your address and message to reply. Legal basis: our legitimate interest in answering you (Art. 6(1)(f)), or taking steps before a contract (Art. 6(1)(b)).
- Server logs. Like any website, our hosting provider processes your IP address and browser details to deliver pages and protect the site from abuse. Legal basis: legitimate interest in running a secure website.
The website has no contact forms, newsletter forms, advertising pixels or social-media trackers, and its fonts and videos are served from our own domain.
Account holders and invited users
| Data | Why | Legal basis |
|---|---|---|
| Name, email address, password (stored hashed), language, and optionally your company, how you heard about us and a profile picture | Create and secure your account, sign you in, send service emails | Contract (Art. 6(1)(b)) |
| Your Google account name, email and language, if you choose "Sign in with Google" (we don't store your Google ID, photo or Google tokens) | Sign you in without a password | Contract |
| Date of your last sign-in; for active sessions, your IP address and browser user agent | Keep your account secure and detect misuse | Legitimate interest (Art. 6(1)(f)) |
| A Google reCAPTCHA check on the sign-up form (Google receives your IP address and browser signals) | Prevent automated fake sign-ups | Legitimate interest |
| Projects, website addresses, settings, team invitations (invitee email) | Provide the service you configure | Contract |
| Plan, subscription history, Stripe customer ID, and any cancellation reason you give in the billing portal (card details, billing address and invoices are held by Stripe, not by us) | Bill you, keep accounting records, understand why people cancel | Contract; legal obligation for invoices (Art. 6(1)(c)); legitimate interest for cancellation reasons |
| Access tokens for Notion or Asana, if you connect them | Create pages or tasks in the workspace you choose | Contract |
| Records of social shares you make to earn extra feedback credits | Apply the credits | Contract |
| Usage counters and technical logs | Enforce plan limits, keep the service secure, fix errors | Contract; legitimate interest |
We send you service emails: account verification, password resets, invitations, plan changes, cancellations and warnings when you approach your feedback limit. When you reach 80% of the free limit we also send one email about upgrading; you can ask us not to send it. We don't send newsletters or other marketing emails unless you separately opt in.
Feedback sent through the widget
When someone clicks "Give Feedback" on a website that uses GiveFeedback.io, the report sent to the website owner contains:
- the screenshot they took and their annotations (the screenshot shows whatever was visible on their screen, which may include personal data);
- the title, description and feedback type they wrote or chose;
- technical information: page URL, browser and version, operating system and version, screen resolution, whether it is a mobile device, browser language, time zone and whether cookies are enabled.
The report doesn't include the reporter's name, email or IP address, reporters don't need an account, and the widget doesn't set cookies or use browser storage. Our servers, like any web server, briefly log the IP address of each request for security (see "How long we keep data").
The screenshot is taken in the reporter's browser. Only if the website owner turns on our optional server-side screenshot feature, the widget sends the page's HTML, screen size and browser user agent to our screenshot server (operated by Vidasoft Developments S.L.) to render the image. The website owner (our customer) decides why and how this feedback is used and is the controller; we store and process it on their behalf under the data processing terms in our terms of service. If you sent feedback on a website and want to exercise your rights, contact the owner of that website; we'll help them respond.
Who processes data for us
We use these service providers (sub-processors), each bound by a contract to protect the data:
| Provider | Purpose | Location |
|---|---|---|
| OVHcloud | Storage of screenshots and profile pictures | Germany (EU) |
| Mailjet (Sinch Mailjet SAS) | Sending service emails | France (EU) |
| Stripe Payments Europe Ltd | Payment processing and invoicing | Ireland (EU); may transfer to the US |
| Google Ireland Limited | "Sign in with Google" (if used); reCAPTCHA on the sign-up form; Google Analytics on the website (only with consent) | Ireland (EU); may transfer to the US |
| Notion Labs, Inc. | Only if you connect Notion: creating pages in your workspace | United States |
| Asana, Inc. | Only if you connect Asana: creating tasks in your workspace | United States |
We don't sell personal data, and we don't share it with anyone else unless the law requires it.
Transfers outside the EEA. Where a provider processes data outside the European Economic Area, the transfer is protected by the EU–US Data Privacy Framework (where the provider is certified) or by the European Commission's Standard Contractual Clauses.
How long we keep data
- Account data and your projects' feedback: while your account is open. Feedback you delete disappears from your dashboard straight away. To close your account and have your data permanently erased (including screenshots in storage), email us: we do it within 30 days, except for what the law requires us to keep.
- Server and application logs (which may contain IP addresses and account IDs): 30 days.
- Feedback above your plan's limit: kept hidden until you upgrade or free up space.
- Invoices and payment records: 6 years, as required by Irish tax law.
- Analytics: according to our Google Analytics retention setting, at most 14 months.
- Emails with us: as long as needed to handle your request, and no longer than 2 years after our last exchange.
Your rights
You can ask us to access, correct, delete, restrict or export your personal data, and you can object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting what happened before. Email hello@givefeedback.io; we reply within one month.
You also have the right to complain to a data protection authority. Our lead authority is the Data Protection Commission in Ireland (dataprotection.ie), and you can also contact the authority where you live (in Spain, the AEPD).
Security
Data is sent over encrypted connections (HTTPS), passwords are stored hashed, access to production systems is limited to the people who need it, and each widget only accepts reports from the website registered for its project.
Children
GiveFeedback.io is a business tool and isn't intended for anyone under 18. We don't knowingly collect data from children.
Changes
If we change this policy in a way that matters, we'll update the date above and, for account holders, tell you by email before the change applies.