Privacy Policy
Last updated September 24, 2026
This policy explains what personal data FeedbackBuddy ("we", "us") processes, why, and the choices you have. It covers our website feedbackbuddy.app, the dashboard at app.feedbackbuddy.app, our Shopify app, our website SDK and our APIs.
Two roles
- Controller for data about our own users: the people who sign up, belong to an organization and use the dashboard.
- Processor for data our customers collect with FeedbackBuddy: survey answers and information about the people who answer them (respondents). Our customers decide what to ask and are responsible for informing their respondents. We process that data only on their instructions.
What we collect
Account data
Name, email address, sign-in method (email link, password, Google or Apple), organization memberships and roles, billing status, and settings. Passwords are stored as salted hashes. Session cookies contain a random token; we store only its hash.
Feedback data (on behalf of our customers)
Survey answers, uploaded files, the page or channel where the answer was given, approximate technical context (such as browser and page URL), and, where the customer provides it, respondent details such as email, an external user ID, attributes, and for Shopify stores the related order and customer IDs.
Shopify data
When a store installs our app we receive store details and access tokens (stored encrypted), and read order and customer data needed to target surveys and link answers to orders. We respond to Shopify's customer data request and erasure webhooks.
Website visitors
This marketing website does not use advertising or analytics cookies. Our hosting provider keeps standard server logs (IP address, user agent, requested URL) for security and operations.
How we use data
- To provide the service: show surveys, store answers, build reports, send digests and alerts you configure.
- AI features: when enabled, answers are sent to our AI model provider to generate tags, summaries and answers to your questions. Results are stored with your data. AI features can be turned off.
- Billing, security, abuse prevention and support.
- Product emails about your account. Marketing emails only with consent, with an unsubscribe link in each.
We do not sell personal data.
Feedback emails
Email campaigns and post-purchase emails are sent through the customer's own email provider and sending domain, configured by the customer. We do not send feedback emails to respondents from our own servers. Team notifications (such as daily and weekly summaries) are sent by us and can be turned off in notification settings.
Sub-processors
We use a small number of vendors to run the service: cloud hosting (EU), our AI model provider, Stripe for card payments, Shopify for Shopify billing, and email delivery for account and team notification emails. An up-to-date list is available on request.
Retention
Feedback data is kept for the retention period of the organization's plan, or until deleted by the customer. Deleted organizations are purged from production systems within 30 days and from backups on their normal rotation. Account data is deleted when you delete your account.
Your rights
Depending on where you live (for example under the GDPR or CCPA) you can request access, correction, deletion, restriction or portability of your data, and object to processing. If you answered a survey, please contact the business that asked you; we will help them respond. Otherwise email privacy@feedbackbuddy.app. You may also complain to your local data protection authority.
Security
Data is encrypted in transit (TLS). Secrets such as access tokens and API credentials are encrypted at rest. Access is limited by role and every query is scoped to its organization.
International transfers
Where data is transferred outside the EEA or UK we rely on appropriate safeguards such as Standard Contractual Clauses.
Changes
We will post changes here and, for material changes, notify account owners by email.