Privacy Policy
Last updated: 23 September 2026
This policy explains what personal data FeedbackDesk handles, why, and what rights you have. We follow the UK GDPR and the Data Protection Act 2018.
1. Who we are
FeedbackDesk is a product of Positive Internet Marketing Ltd (company number SC357489), MB10 King James VI Business Centre, Friarton Road, Perth, PH2 8DY. We are registered with the Information Commissioner's Office (ICO), registration number ZC253791.
Contact us about privacy at support@feedbackdesk.io.
2. Two kinds of people, two roles
Businesses that use FeedbackDesk (account holders)
If you sign up for an account, we decide how your account data is used. In law we are the data controller for that data.
Customers of those businesses
If a business asked you for feedback through FeedbackDesk, that business decides how your data is used. The business is the data controller. We only handle your data on their instructions, as their data processor. You can contact the business directly, or contact us and we will pass your request to them.
3. What data we handle
| Who | Data | Why | Lawful basis |
|---|---|---|---|
| Account holders | Name, email address, password (stored as a one-way hash), business name, address, logo, plan and subscription status | To create and run your account, send service emails, and give support | Contract |
| Account holders | Billing details. Card details go straight to Stripe. We never see or store your card number. | To take payment and keep tax records | Contract; legal obligation |
| Customers of a business | Name, email address, phone number (if the business adds it), service notes, feedback score, written feedback, and whether you unsubscribed | To send a feedback request and up to two reminders, record your answer, and show it to the business | Set by the business (normally its legitimate interest in improving its service) |
| Customers of a business | Positive written feedback, shown with your first name and last initial | The business may choose to show it as a testimonial on its website | Set by the business |
| Members of the public | Public reviews on Google and Trustpilot (reviewer name, rating, text, date) | To let a business see, answer and display its own public reviews | Legitimate interest |
| Website visitors | Usage data from Google Analytics, only if you accept cookies | To understand how people use the site | Consent |
| Everyone | IP address and request logs | Security, rate limiting and fault finding | Legitimate interest |
We do not sell personal data. We do not use it for advertising.
4. Emails and unsubscribing
Every feedback request and reminder has an unsubscribe link. One click stops all further feedback emails from that business through FeedbackDesk.
5. Automated processing and AI
A business can ask for an AI summary of its reviews, or an AI draft reply to a review. For this, review and feedback text is sent to Anthropic. The output is advice for the business only. We make no automated decisions that have a legal or similarly significant effect on you.
6. Who we share data with
We use these service providers. Each one only gets the data it needs for its task.
| Provider | Task |
|---|---|
| Supabase | Database for customer, feedback and review data; logo file storage |
| Airtable | Database for business accounts and settings |
| Railway | Application hosting |
| Resend | Sending email |
| Stripe | Payments and subscriptions |
| Anthropic | AI review summaries and draft replies |
| Outscraper | Collecting a business's public Google and Trustpilot reviews |
| Google (Analytics) | Website analytics, only with your consent |
We may also share data when the law requires it.
7. Transfers outside the UK
Some of these providers are in the United States or process data there. Where data leaves the UK, we rely on a UK adequacy decision (including the UK Extension to the EU–US Data Privacy Framework) or on standard contractual clauses with the UK Addendum.
8. How long we keep data
- Account data: while your account is open. If you close your account, email us and we delete your account data and your customers' data within 30 days.
- Customer and feedback data: until the business deletes it or closes its account. A business can delete a customer at any time in its dashboard.
- Billing records: six years, because tax law requires it.
- Request logs: a short period, for security and fault finding.
9. Security
Data is encrypted in transit. Passwords are stored as one-way hashes. Each business's customer data is kept separate from every other business's data. Access to production systems is limited to staff who need it.
10. Your rights
You have the right to:
- get a copy of your data;
- have wrong data corrected;
- have your data deleted;
- restrict or object to how your data is used;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
To use a right, email support@feedbackdesk.io. We answer within one month. If you are a customer of a business, we will work with that business to answer you.
You can also complain to the ICO at ico.org.uk. We would like the chance to fix the problem first.
11. Cookies
| Name | Type | Purpose |
|---|---|---|
fd_token, re_user | Essential (browser storage) | Keep you signed in to the dashboard |
fd_cookie_consent | Essential (browser storage) | Remembers your cookie choice |
_ga, _ga_* | Analytics (Google) | Set only if you accept. Counts visits and page views. Lasts up to two years. |
Analytics cookies are off until you accept them. .
12. Changes to this policy
If we change this policy, we post the new version here and change the date at the top. If the change is important, we also email account holders.