Privacy Notice

Who is responsible for your information

Information we collect

We collect account details, workspace settings, subscription and billing information, support correspondence, and limited service-usage information. Businesses may add customer contact details, job records, private feedback, public review records, testimonial permissions, and improvement actions. With consent, Google Analytics may also receive limited public-website usage information such as the page path, browser or device information, approximate location derived from network information, and interaction timing. We may also receive limited account, payment, delivery, or support information from providers that help us operate the service.

Purposes and lawful bases

• We use account, workspace, support, and billing information to take steps requested before signup and to perform the service contract.
• We use limited product-usage, security, fraud-prevention, fault-diagnosis, audit, and service-reliability information where necessary for our legitimate interests in operating and improving FeedbackPilot.
• We use Google Analytics on selected public website pages only after the visitor gives consent, which can be withdrawn through the Cookie and Storage Notice.
• We process information where necessary to meet tax, accounting, regulatory, or other legal obligations.
• Where a specific optional use relies on consent, it will be requested separately and can be withdrawn without affecting earlier lawful processing.

Product analytics

Product analytics is currently disabled. If enabled, we may use limited account-level activity information, including exact activity times, to understand aggregate product use, onboarding, and service reliability. It is retained for 35 days, is not used for advertising or customer profiling, and does not include form answers, feedback text, or customer records. Account holders can opt out through Account and security settings.

Public website analytics

With visitor consent, we use Google Analytics to measure visits and page use on selected public marketing, support, and legal pages. The tag is not loaded on signed-in workspace routes, hosted customer feedback forms, testimonial-permission pages, account-access reports, or authentication callback routes. FeedbackPilot sends the page path without its query string and keeps Google advertising storage and personalisation consent denied. Visitors can reject or withdraw consent at any time through the Cookie and Storage Notice.

Customer information

A business using FeedbackPilot is normally responsible for the customer and job information it adds to its workspace. Businesses must collect only what they need, have an appropriate lawful basis, provide their own privacy information where required, and respond to customer rights requests. FeedbackPilot processes that information to provide the service on the business's instructions, except where limited processing is required for our own legal obligations or to protect the service.

Required and optional information

Fields marked as required are needed to create an account, provide the selected service, secure access, or manage payment. Without them, we may be unable to provide the relevant feature. Optional fields can be left blank unless a business decides they are needed for its own lawful workflow.

Automated decisions and external actions

FeedbackPilot does not make solely automated decisions that produce legal or similarly significant effects. Product rules organise records and highlight possible next steps, but users review and carry out external actions. FeedbackPilot does not automatically send review requests, post reviews, publish testimonials, or post public replies.

Service providers and sharing

We use service providers for hosting, authentication, database services, payments, transactional email, and consented public-website analytics. We may also share information with professional advisers, insurers, auditors, regulators, courts, or law-enforcement bodies where reasonably necessary and lawful. We do not sell personal data or use customer data to create advertising profiles.

The current providers and their purposes are listed on the Subprocessor List.

International transfers

Some service providers may process information outside the United Kingdom or the country where a user or customer is located. Where data-protection law restricts a transfer, we use an applicable adequacy decision or approved contractual and organisational safeguards. Details of relevant safeguards can be requested through the privacy contact.

Retention

We keep personal information only for as long as needed for the purpose it was collected for, including providing the service, account recovery, billing, dispute handling, and legal obligations. Limited product-analytics information is retained for 35 days when analytics is enabled. Google Analytics cookies may remain for up to 2 years unless the visitor rejects analytics or clears browser data, subject to Google Analytics configuration and browser controls. Billing and accounting records may be kept for legally required periods, while permission and audit evidence may need to be retained longer than ordinary operational records. Backups expire on a separate controlled schedule.

Security

We use appropriate technical and organisational measures designed to protect personal information. No online service can guarantee absolute security, so users should keep account credentials secure and avoid storing information that is not needed for the service.

Your rights

Depending on the applicable law and lawful basis, individuals may request access, correction, deletion, restriction, objection, or portability. Where we rely on consent, it can be withdrawn using the provided control or by contacting support@feedbackpilot.co.uk. Customer requests should usually be directed first to the business that collected the information. Account holders can contact FeedbackPilot for account-related requests and workspace exports or deletion.

Cookies and browser storage

FeedbackPilot uses limited browser storage for requested account and sign-in functions, to remember appearance and analytics choices, and, after consent, for Google Analytics on selected public pages. We do not use advertising cookies, cross-site advertising profiles, or session replay. Further details and controls are available in the Cookie and Storage Notice.

Your right to object

You may object to processing based on FeedbackPilot's legitimate interests. Signed-in account holders can opt out of product analytics in Account and security settings, or contact support@feedbackpilot.co.uk. Public-website analytics relies on consent and can be rejected or withdrawn through the Cookie and Storage Notice. We will stop relevant processing unless we have compelling legitimate grounds to continue or it is needed for legal claims.