Privacy Policy

1. Service Overview & Data Controller/Processor Role

betterfeedback ("we," "our," or "us") operates a visual feedback collection widget that customers embed on their websites. When you use betterfeedback as our customer, we act as a data processor on your behalf—you are the data controller for the feedback and visitor data collected through our widget. This Privacy Policy explains how we collect, use, disclose, and safeguard information.

2. What Information We Collect

When a reviewer uses the betterfeedback widget on your website, we collect and process:

Feedback Content

• Page screenshot — rendered via snapDOM; captures visible page content and may include sensitive data unless masked client-side
• Page metadata — URL, page title
• Element information — CSS selector, visible text, viewport-relative coordinates of tapped/hovered elements
• Viewport data — viewport size, scroll position
• Voice recording (optional) — audio file, transcribed via Deepgram; original audio deleted after transcription, only text retained
• Reviewer contact info (optional) — name and email address, if provided by guest reviewers

Account Information

For betterfeedback customers (account holders):

• Email address and account credentials
• Billing and subscription information
• API keys and configuration settings
• Communication preferences

3. Purposes & Lawful Bases for Processing

We process personal information for the following purposes and under these lawful bases:

AI Processing Disclosure

Feedback text, transcripts, and element context may be sent to Anthropic Claude Haiku to auto-generate developer tickets (title, summary, suggested fix). Anthropic's commercial API does not use data for model training.

4. Sub-Processors & Third Parties

We engage the following sub-processors to deliver and secure our service:

• Cloudflare — R2 object storage (screenshots), CDN, DNS, DDoS protection (US/EU data centers)
• Deepgram — Voice transcription; audio files deleted post-transcription (US)
• Anthropic — AI-powered feedback triage via Claude Haiku API (US)
• SendGrid — Transactional email delivery (US)
• Twilio — SMS delivery for account notifications (US)
• Hetzner — Hosting infrastructure and PostgreSQL database (Germany)

For details on sub-processor terms, data transfers, and DPAs, see our Sub-Processors page.

5. International Data Transfers

Our infrastructure is hosted in Germany (Hetzner), but feedback and metadata may be transmitted to sub-processors in the United States (Cloudflare, Deepgram, Anthropic, SendGrid, Twilio) for processing. For EU residents and organizations, transfers to the US are governed by Standard Contractual Clauses (SCCs). By using betterfeedback, you consent to these transfers.

6. Data Retention & Deletion

Voice audio: Deleted immediately after successful transcription (typically seconds).

Feedback & metadata: Retained while your account is active. Upon account deletion, all feedback, screenshots, and personal data are purged within 30 days, subject to any legal retention obligations.

Logs & backups: System logs and database backups may retain data for up to 90 days for security and disaster recovery purposes.

7. Your Privacy Rights & Data Subject Access

Depending on your location and role, you have the following rights:

• Access (GDPR Art. 15, CCPA § 1798.100): Request a copy of personal data we hold
• Correction (GDPR Art. 16, CCPA § 1798.106): Request correction of inaccurate data
• Deletion (GDPR Art. 17, CCPA § 1798.105, LFPDPPP Art. 33): Request deletion of your data (right to be forgotten)
• Portability (GDPR Art. 20, CCPA § 1798.100): Request export of your data in a portable format
• Opt-out of Sale/Sharing (CCPA § 1798.120, CPRA): We do not sell or share personal information
• Objection (GDPR Art. 21): Object to processing for direct marketing or legitimate interests
• Withdraw Consent: Withdraw consent at any time (does not affect past processing)

How to Exercise Your Rights

To exercise any of these rights, email [email protected] with:

• Your name and email address
• A clear statement of your request (e.g., "I request access to my personal data")
• Proof of identity (we may require verification to prevent unauthorized access)

We will respond within 30 days (or 45 days under GDPR if complex). If we cannot fulfill your request, we will explain why.

8. Customer Responsibility & Lawful Basis Attestation

As our customer, you are the data controller for feedback collected on your website. You must:

• Obtain a lawful basis (consent, contract, legitimate interest, etc.) to collect feedback from your visitors
• Provide clear notice about feedback collection in your privacy policy
• Mask or exclude sensitive data (e.g., credit card fields) before capture
• Ensure compliance with all applicable laws (GDPR, CCPA, PIPEDA, LFPDPPP, etc.)
• Execute a Data Processing Agreement (DPA) with betterfeedback (available upon request)

9. Children & Age Restrictions

betterfeedback is not intended for children under 13. We do not knowingly collect feedback or account information from children under 13. If you believe we have collected information from a child under 13, contact us immediately at [email protected].

10. Cookies & Tracking

Our website (betterfeedback.dev) uses:

• Essential cookies — for authentication and security
• Analytics — aggregated, anonymized usage data via Cloudflare Analytics

The feedback widget itself does not set tracking cookies; it only transmits feedback data to our servers. Your customer dashboard may use session cookies for authentication.

11. Jurisdiction-Specific Notice

GDPR (European Union)

We comply with GDPR for residents of the EU/EEA. You have rights to access, rectification, erasure, restriction, portability, and objection. Our Data Protection Officer can be reached at [email protected].

CCPA/CPRA (California)

California residents have rights to know, delete, and opt-out. We do not sell personal information. To exercise CCPA rights, email [email protected].

PIPEDA (Canada)

We comply with PIPEDA for Canadian personal information. You have the right to access, correct, and request deletion.

LFPDPPP (Mexico)

We comply with Mexico's Federal Data Protection Law. Mexican residents have rights to access, rectification, cancellation, and objection.

12. Security & Confidentiality

We implement technical and organizational safeguards including:

• End-to-end encryption for data in transit (HTTPS/TLS)
• Encryption at rest on Cloudflare R2 and Hetzner infrastructure
• Access controls and authentication (API keys, OAuth)
• Regular security audits and monitoring

However, no transmission or storage is 100% secure. We are not liable for any breach of your information beyond our reasonable control.

13. Changes to This Policy

We may update this Privacy Policy at any time. Material changes will be posted to this page with an updated "Last updated" date. Continued use of betterfeedback after changes constitutes acceptance.

14. Contact Us

For privacy questions, data subject requests, or to request a Data Processing Agreement:

Operated by Get X Media.