Privacy Policy

Information we collect

• Account data. Name, work email, organization name, and authentication identifiers managed through our identity provider when you create an account.
• Billing data. Plan, subscription status, and payment metadata. Card details are handled exclusively by our payment processor; we never store full card numbers. All amounts are processed and stored in integer cents.
• Survey responses. Answers your end users submit through surveys you create (ratings, scores, and free-text feedback), processed on your behalf.
• Technical data. Approximate request metadata used for security and abuse prevention. IP addresses are never stored in raw form; we retain only a salted SHA-256 hash (ipHash) so that an address cannot be reconstructed.
• Usage data. Aggregate counts of widget submissions and dashboard activity used for metering, billing, and product analytics.

How we use information

• To provide, maintain, and secure the Service and your account.
• To meter usage and bill subscriptions accurately.
• To extract themes, sentiment, and summaries from free-text survey responses using automated AI processing, so you can understand feedback at scale. This processing is performed to deliver the core analytics features of the Service.
• To detect, prevent, and respond to fraud, abuse, and security incidents.
• To communicate with you about service updates, security, and support.

AI processing of responses

Free-text feedback is sent to large-language-model providers acting as our subprocessors to generate theme, sentiment, and summary metadata. Results are written back to your account. We instruct these providers not to train their models on your data and transmit content over encrypted connections. AI-derived insights are inferences and may contain errors; they are intended to assist, not replace, human judgment.

Data sharing and subprocessors

We do not sell personal data. We share data only with vetted subprocessors that help us run the Service under contractual confidentiality and data-protection obligations, including:

• Managed cloud database and cache providers (Neon Postgres, managed Redis).
• Our identity and authentication provider.
• Our payment and subscription processor.
• LLM providers used for theme and sentiment extraction.
• Application hosting, email delivery, and error-monitoring providers.

We may also disclose information where required by law or to protect the rights, safety, and security of Feedforward, our customers, or the public.

Data retention

We retain account data for as long as your account is active and as needed to provide the Service. Survey responses are retained according to your configuration and plan; you may delete responses or your account at any time, after which data is purged from active systems and removed from backups on a rolling schedule. Hashed technical data is retained only as long as necessary for security purposes.

Your rights (GDPR / CCPA)

Depending on your location, you may have the right to access, correct, export, restrict, or delete your personal data, to object to certain processing, and to withdraw consent. If you are an end user who submitted feedback, please contact the organization that operates the survey, as it is the controller of that data; we will support their response. To exercise your rights, contact us using the details below. We will not discriminate against you for exercising any of these rights.

Cookies

We use strictly necessary cookies for authentication and security, and limited analytics to understand product usage. The embeddable widget is designed to be privacy-respecting and does not set advertising or cross-site tracking cookies on host sites.

Security

We encrypt data in transit and at rest, isolate each organization's data, and follow least- privilege access controls. For more detail, see our Security page.

Contact

Questions about this policy or your data? Reach us through our contact page or email privacy@getfeedforward.com.