This Privacy Policy explains how FeedbackRobot collects, uses and protects information when you use our website (www.feedbackrobot.com) and our feedback and reputation platform.
Two different relationships are covered here. For your account data, we are the data controller. For your customers’ data — the people you collect feedback from — you are the controller and we are the processor, acting on your instructions. A plain-language summary is available in Privacy and your data; this policy is the authoritative document.
1. Information We Collect
Account information. Name, email address, company name, and billing details provided during registration.
Your customers’ data. Names, email addresses, phone numbers and any other details you upload, import, or connect through an integration. Where you connect Shopify or Salesforce, we also store the corresponding record identifiers and synced fields.
Feedback content. Survey responses, conversation messages, and reviews collected from platforms where they are already public (for example Google, TripAdvisor, Agoda and Booking).
Messaging content. Where you send surveys or replies by SMS or WhatsApp, we store the message content and the phone number it relates to, including inbound replies your customers send back.
Documents you upload. Files added to your knowledge base (PDF, DOCX, XLSX), and images such as your logo.
Usage and technical data. IP addresses, browser and device information, and product interaction data, collected through cookies and similar technologies.
Operational logs. We log requests to and from third-party integrations for troubleshooting. These logs can contain personal data present in the integration payload and are automatically deleted after 30 days.
2. How We Use Information
Delivering the service. Collecting feedback, analysing it, generating drafts and summaries, sending messages you have configured, and reporting results back to you.
Support and product improvement. Diagnosing problems and understanding how features are used.
Communication. Service updates, security notices and support responses.
Billing. Managing subscriptions and payments.
We do not sell personal data. We do not use one customer’s data to benefit another.
3. AI Processing
AI analysis is what the product does, so it is worth being specific about where it happens.
We do not train AI models on your data. No customer data is used to train, fine-tune or otherwise improve any model, ours or a third party’s. The models we use are pre-trained and used for inference only.
Processed on infrastructure we control. Sentiment scoring of review text, and extraction of names mentioned in reviews, are handled by a model we host ourselves. This content is not sent to any third-party AI provider.
Processed by OpenAI. Other AI features send content to OpenAI as our AI sub-processor, under its API terms, which do not permit use of the content for model training. These features are: survey-response analysis, the AI assistant, drafted replies to reviews and conversations, summaries, theme and insight generation, survey and template generation, and search across your knowledge base. Documents you upload to the knowledge base are converted into embeddings by OpenAI so they can be searched.
Automated content is reviewable. AI-generated replies and offers are drafts intended for your review. Where you configure automation to send without review, you remain responsible for that content — see our Terms.
Transparency. You may ask us how AI processing applies to your feedback data by contacting support.
4. Connected AI Clients (MCP)
FeedbackRobot can be connected to third-party AI clients through the Model Context Protocol (MCP). This is off unless you turn it on.
What connecting does. Authorising a client grants it access to a workspace you select, using your own permissions. A connected client can read data in that workspace — including customers, feedback, reviews and conversations — and can take actions that reach your customers, such as sending a survey or triggering a resolution.
Consent and control. Connection requires you to approve it explicitly and choose the workspace. Authorisations are time-limited and can be revoked at any time from your account settings.
Your responsibility. Data a connected client retrieves is handled by that client’s operator under their own privacy terms, not ours. Only connect clients you trust with your customers’ data.
5. Messaging Your Customers
When you send surveys, reminders or replies, we deliver them through email, SMS or WhatsApp providers acting on your behalf. Emails include an unsubscribe link, and unsubscribed contacts are suppressed from further sending. You are responsible for having a lawful basis to contact the people you upload — see “Your Responsibilities” below.
SMS opt-in data
When you give your mobile number and agree to receive a feedback request by text, that opt-in record and your number are used only by FeedbackRobot to send the survey invitation, its reminders and any follow-up about your visit. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. You can stop these messages at any time by replying STOP, and reply HELP for assistance.
6. Sharing
We do not sell personal data. We share it only in these circumstances:
Sub-processors. Vendors who provide infrastructure and services on our behalf: our AI provider (OpenAI), hosting and file storage, email delivery, SMS and messaging delivery, payment processing, and product analytics. Each is bound by contract to process data only as instructed.
Integrations you connect. Where you connect a platform such as Shopify, Salesforce, Klaviyo or a review site, data is exchanged with that platform to perform the action you configured.
Publishing actions you initiate. When you publish a reply or testimonial, the content is transmitted to the destination platform.
Legal requirements. Where required by law, or to protect the rights and safety of FeedbackRobot and its users.
We can provide a current list of sub-processors on request.
7. Where Data Is Stored
Our application servers and primary databases are located in Germany (EU). Uploaded files — knowledge-base documents and images — are stored in the United States. Some sub-processors operate in other jurisdictions.
This means data may be transferred across borders, including into and out of the EEA. Where such transfers involve personal data of EEA or UK residents, we rely on Standard Contractual Clauses or another recognised transfer mechanism.
8. Security
We use encryption in transit, access controls, and role-based permissions within workspaces. Enterprise plans support SAML single sign-on, and card details are handled by our payment processor and never stored on our systems.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Retention
While your account is active, we retain your account data and the feedback data in your workspace so the service can function.
Automatic deletion applies to a limited set of records: integration request logs are deleted after 30 days, generated AI artifacts are deleted when they expire, and single sign-on assertion records are deleted after one day.
Other data is retained until you delete it. Feedback, customers, reviews and conversations are kept until you remove them or ask us to. Deleting a contact removes their record; unsubscribing suppresses future messages but retains the record so the suppression is honoured.
On account closure, contact us and we will delete your workspace data. We do not currently delete it automatically on a fixed schedule, so if erasure matters to you, make the request explicitly. Some records, such as audit and billing records, are retained where required for legal, security or accounting purposes.
10. Your Privacy Rights
Depending on your jurisdiction, you may have the right to:
Access and portability — request a copy of the data we hold about you.
Correction and deletion — correct inaccurate data, or request deletion of your account and associated data.
Objection and restriction — object to or restrict certain processing.
Opt out — unsubscribe from marketing communications at any time.
To exercise these rights, contact [email protected].
If a request concerns data you hold about your customers, you can action it directly in your workspace, since you are the controller for that data. Contact us if you need help with a request spanning multiple systems.
11. Your Responsibilities
As the controller of your customers’ data, you are responsible for:
- Having a lawful basis to hold and contact the people you upload
- Telling people what their feedback will be used for
- Honouring access and deletion requests they make to you
- Obtaining consent before sending SMS or WhatsApp messages, where your jurisdiction requires it
- Getting permission before republishing a private survey response as public marketing
12. Changes to This Policy
We may update this policy as the product or the law changes. Material changes will be notified by email or in your dashboard, and the effective date above will be updated.
13. Contact
Questions about this policy or our data practices:
Email: [email protected] — Website: www.feedbackrobot.com/contact