Privacy Policy

1. Introduction

This Privacy Policy explains how FeedSense collects, uses, discloses, and safeguards information when you and your users interact with our feedback intelligence platform.

FeedSense is operated by Mahir Can Yuksel (sole proprietorship), located in Turkey. We comply with the Turkish Personal Data Protection Law (KVKK), the EU and UK General Data Protection Regulations (GDPR / UK GDPR), and the California Consumer Privacy Act (CCPA / CPRA). Where these regulations grant overlapping rights, we apply the most protective standard.

We act in two distinct roles depending on the data:

• Data Controller for our customers' administrators (the people who sign up to operate FeedSense): account, billing, and dashboard usage data
• Data Processor for end-user feedback that flows through our customers' widgets, integrations, and AI analysis pipeline. Our customers are the controllers of that data; their separate privacy notices govern its collection from end-users.

By creating an account or embedding the FeedSense SDK, you agree to the practices described here.

2. Information We Collect

2.1 Customer Administrator Information

When you register and use the FeedSense dashboard, we collect:

• Account information: email, name, password (stored hashed with bcrypt), avatar URL
• Company and project information: company name, website domain, project metadata you create
• Billing information: processed entirely by Paddle.com Market Limited as our Merchant of Record. We do not store credit card details.
• Communications: messages you send via email or in-app support
• Consent records: when you accept Terms, Privacy Policy, or analytics cookies, we log the version, timestamp, IP address, and user agent (GDPR Article 7 audit trail).

2.2 End-User Feedback Data (processed on behalf of our customer)

When end-users submit feedback through your widget or when you connect a third-party source (Intercom, Zendesk, Slack, Jira), we receive and store:

• Feedback content: comment text, rating, submission metadata, source URL where the widget rendered
• Submitter identity (optional): only if you call the SDK identify() method to attach a user ID, email, name, and custom properties (max 20 custom properties, 256 characters each, 2 KB total)
• Integration-sourced messages: when you connect Intercom, Zendesk, Slack, or Jira via OAuth, we ingest conversation messages, ticket descriptions, channel messages, or issue content so we can analyze them as feedback. Each integration is gated behind your explicit OAuth authorization.
• External identifiers: when feedback originates from a connected source, we keep the original source identifier (e.g., Intercom conversation ID, Slack message timestamp) so we can deduplicate and link back.

We do not store IP addresses or user agents on individual feedback submissions.

2.3 AI-Generated Derivative Data

Our AI pipeline produces additional data from the feedback it analyzes:

• Sentiment and emotion labels per feedback item (positive / negative / neutral; emotion categories)
• Vector embeddings stored in our database (PostgreSQL pgvector) using a locally hosted all-MiniLM-L6-v2 model; embeddings are derived representations and are not human-readable.
• Themes and clusters generated by BERTopic (locally hosted, no external API call) so similar feedback is grouped together
• Daily and keyword insights generated by a Large Language Model (LLM) routed via OpenRouter; see Section 3 and Section 9 for details
• AI Chat history: when you use AI Chat in the dashboard, we store your prompt, the AI response, and the feedback context the response cited, so the conversation persists across sessions

2.4 Automatically Collected Information

• Server logs: request method, URL, response status, latency, timestamp, IP address (Vercel and Railway edge logs)
• Paddle webhook payloads: when Paddle notifies us of a billing event we keep the full webhook body, including the source IP, for audit and chargeback evidence
• Cookies and similar storage: see our Cookie Policy for the full list

2.5 Information from Third Parties

When you connect a third-party source (Intercom, Zendesk, Slack, Jira), data flows to us only after you authorize the OAuth handshake within your account. We are not in possession of that data otherwise.

3. How We Use Information

We use the information collected to:

• Operate the service: ingest, store, classify, and surface feedback through your dashboard
• Run AI analysis: sentiment / emotion detection, theme clustering, daily insights, AI Chat, keyword extraction, bug and testimonial extraction
• Send notifications and alerts via your chosen destination (email, Slack, Jira)
• Manage your account and billing (in coordination with Paddle as Merchant of Record)
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations (Turkish KVKK, GDPR / UK GDPR, CCPA / CPRA, US state privacy laws, Turkish tax law for transaction records)
• Improve the platform using aggregated, anonymized usage telemetry (consent-gated)

4. Legal Basis for Processing

We rely on the following legal bases (KVKK Articles 5/6 and GDPR Article 6):

• Performance of contract: to provide the services you subscribed to (feedback ingestion, analysis, delivery)
• Legitimate interest: for service monitoring, fraud prevention, and aggregated usage analytics balanced against your privacy expectations
• Explicit consent: for non-essential cookies (analytics), marketing communications, and optional features. Consent can be withdrawn at any time via Cookie Settings or by contacting us.
• Legal obligation: to retain financial records under Turkish tax law (10 years) and to respond to lawful requests from authorities

5. How We Share Information

We do not sell personal information. We share data only with the categories of recipients listed below.

5.1 Core Sub-Processors

Sub-processors are vendors we engage directly to operate the service. The full live list with each vendor's published policy lives at /legal/subprocessors. The current list:

5.2 Authorized Integrations (Customer-Connected Services)

When you connect a third-party tool via OAuth, FeedSense becomes authorized to read or write data within that tool on your behalf. These services are not sub-processors in the strict GDPR Article 28 sense (you control the relationship through your own account with the third party), but we list them here so the full data flow is visible. Each integration only operates after your explicit OAuth consent and can be disconnected at any time from Project Settings.

5.3 International Transfers

Data is processed in Turkey, the European Economic Area (EEA), the United Kingdom, and the United States depending on the sub-processor. For transfers to recipients outside the EEA / UK / Turkey, we rely on the European Commission Standard Contractual Clauses (SCCs) Module 2 (Controller-to-Processor, 2021/914) plus the UK Addendum (IDTA) where applicable. We do not currently rely on the EU-US Data Privacy Framework.

5.4 Legal Disclosures

We may disclose information if required by Turkish or other applicable law, court order, or lawful government request. We do not disclose personal data voluntarily outside these channels.

5.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, your information may be transferred to the successor entity. We will notify you and provide an opportunity to object before any material change in controller.

6. How Long We Keep Information

We keep each category of personal data only as long as needed for the purpose disclosed above, or as required by law:

Automated retention enforcement for AI Chat history, LLM insights, webhook anonymization, consent audit logs, and export logs is being rolled out in stages. Categories not yet fully automated are governed by the same retention commitments and are anonymized or deleted on request in the meantime.

7. Your Rights

Subject to applicable law, you have the right to:

• Access a copy of the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten"), subject to legal retention obligations
• Restrict or object to certain processing
• Port your data in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with a supervisory authority (Turkish KVK Kurumu, an EU/EEA Data Protection Authority, or the UK Information Commissioner's Office)

How to exercise your rights:

• Use the self-service data export in your account settings to download a JSON copy of your data (covers user, company, projects, feedback up to 10,000 records, memberships, subscription, imports, invitations, and audit logs)
• Use the self-service account deletion in your account settings; there is a 30-day grace period during which you can cancel the deletion before it executes
• For end-user data subject requests (when an end-user of one of our customers reaches out to us directly), we forward the request to the customer who acts as the controller
• For all other requests, contact [email protected]. We respond within 30 days (KVKK / GDPR) or 45 days (CCPA) of receipt; complex requests may extend by an additional period as permitted by law, with notice to you.

8. Data Security

We protect personal data with the following technical and organizational measures:

• Encryption in transit: TLS 1.2 or higher on all public endpoints; service-to-service traffic to our private AI service authenticated with a rotating bearer token
• Encryption at rest: platform-managed encryption on Railway PostgreSQL; application-level AES-256-GCM encryption for OAuth credentials and webhook secrets stored in our integrations table
• Authentication: bcrypt password hashing (12 rounds), HMAC-SHA-256 API key hashing, JWT short-lived access tokens with refresh-token rotation
• Network and edge: Cloudflare (DDoS, WAF), CSRF protection on dashboard write endpoints, Helmet-based security headers, route-aware CORS
• Access controls: least-privilege project membership model with role-based permissions; strict separation of customer data per company
• Monitoring: Sentry, Grafana Cloud, and BetterStack for incident detection; Pino structured logs
• Incident response: 72-hour breach notification commitment to affected customers (consistent with GDPR Article 33 / KVKK Article 12)

No method of transmission or storage is perfectly secure; we cannot guarantee absolute security but commit to maintaining and improving these measures.

9. Automated Processing and AI

FeedSense uses automated systems and AI to analyze feedback, surface themes, suggest priorities, and answer questions in AI Chat. We disclose this so you can decide whether and how to use those features:

• No legally significant decisions: FeedSense does not produce decisions that have legal or similarly significant effects on individuals (GDPR Article 22). The AI surfaces themes, classifications, and recommendations; humans (your team) decide what to do with them.
• You are interacting with AI: AI Chat responses, AI-generated insight cards, and outbound notifications produced by AI are labeled in-product so end-users and operators can tell them apart from human-authored content (EU AI Act Article 50, applicable August 2026).
• Verify before acting: AI output may contain inaccuracies. Do not rely on it for legal, medical, or other consequential decisions without human review.
• What goes to the LLM: see the AI processing disclosure in Section 3 above.
• No training on your data: FeedSense does not train any model on customer data. We rely on OpenRouter's default no-retention posture for the underlying providers; check the live sub-processor list for current routing.

10. Cookies and Tracking

See our Cookie Policy for the full list of cookies and similar storage we use, their purposes, and how to control them. Analytics cookies fire only after you grant consent through the cookie banner.

11. Children

FeedSense is a business-to-business product not directed to children. We do not knowingly collect personal data from individuals under 16. If you believe a child has provided data through your widget, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy as our service or applicable law changes. When we make a material change we bump the version, prompt you to re-accept inside the dashboard, and update the Effective Date at the top of this page. Past versions are available on request.

13. Notice for U.S. Residents

This section supplements the rest of this Privacy Policy for residents of U.S. states with comprehensive privacy laws. The substantive practices (what we collect, why, who we share with, retention) are the same as described in Sections 2 through 9 above; this section restates rights and disclosures in the form those state laws require.

13.1 California (CPRA): Categories of Personal Information

In the 12 months preceding the Effective Date, FeedSense collected the following categories of Personal Information from California residents:

We do not collect categories C (Characteristics of Protected Classifications), D (Commercial Information beyond billing), E (Biometric Information), G (Geolocation Data beyond IP-address-derived city resolution by sub-processors), H (Sensory Data), I (Professional or Employment Information), J (Education Information), or L (Sensitive Personal Information in the statutory sense).

13.2 Sensitive Personal Information (SPI)

FeedSense does not knowingly collect Sensitive Personal Information in the statutory sense (Cal. Civ. Code § 1798.140(ae)): no government identifiers, no precise geolocation, no race/ethnicity/religion/sexual orientation, no genetic or biometric data, no contents of private communications outside a customer-authorised integration. The Right to Limit Use of SPI does not apply because no SPI is collected to begin with.

13.3 Automated Decision-Making Technology (ADMT)

Effective January 1, 2026, the CPRA regulations require disclosure of Automated Decision-Making Technology used to make decisions producing legal or similarly significant effects on consumers.

FeedSense's AI processing produces sentiment / emotion classifications, theme clusters, summaries, and AI Chat responses that are advisory only. The output supports human decision-making by your team. It does not itself decide on credit, employment, housing, healthcare, education, criminal justice, or other matters with legal or similarly significant effects on individuals.

Workflow automation carve-out: some features (such as Jira auto-rules that create tickets when a cluster reaches a configured size, or sentiment alerts that post to Slack) act on AI signals to trigger an internal workflow inside the customer's own systems. These actions affect the customer's ticketing or notification queues. They do not affect the data subject (the end-user who submitted the feedback) in any legally cognizable way. The data subject is the source of the input, not the target of any decision. As such, these workflow features are not ADMT in the consumer-protection sense, and the Right to Opt-Out of ADMT does not apply.

If we ever introduce a feature that does produce decisions with legal or similarly significant effects on individuals, we will update this section and offer the opt-out.

13.4 California Rights (CPRA)

California residents have the right to:

• Know what Personal Information we collect, the sources, the business purposes, and the categories of recipients we share with (the table above)
• Delete Personal Information we have collected from you (subject to legal retention obligations)
• Correct inaccurate Personal Information
• Access / Port your Personal Information in a portable, machine-readable format (the dashboard data export covers this)
• Opt out of Sale / Sharing: FeedSense does not sell Personal Information and does not share it for cross-context behavioural advertising. There is nothing to opt out of, but you may confirm this in writing if you wish.
• Non-discrimination for exercising any of the above. We do not condition service, price, or quality on the exercise of these rights.

13.5 Other U.S. States (Virginia, Colorado, Connecticut, Texas, and others)

Residents of states with comprehensive privacy laws, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Indiana (INCDPA), Iowa, Tennessee, Montana, Florida, Oregon, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island, Kentucky, and similar, have substantively similar rights to California: access, deletion, correction, portability, and opt-out of sale / targeted advertising / certain profiling.

Important state-specific notes:

• Texas (TDPSA): applies to any business doing business in Texas, regardless of revenue or volume thresholds. There is no small-business exemption.
• Sensitive data consent: several states (CO, CT, VA, MN, NH, NJ, OR, TX) require opt-in consent before processing "sensitive data" in the statutory sense. We do not process such data, so this consent is not collected.
• Targeted advertising / profiling opt-out: we do not engage in targeted advertising and do not profile in furtherance of decisions producing legal or similarly significant effects.

13.6 How to Exercise Your Rights

Three paths, in order of speed:

1. Self-service: the dashboard Settings → Privacy area provides data export and account deletion that satisfy access, portability, and deletion rights for the FeedSense customer administrator account.
2. End-user requests: when an end-user of one of our customers reaches out to us directly, we forward the request to the customer (the Controller) for response.
3. Email: for all other requests, contact [email protected]. We respond within 45 days (CCPA / CPRA) or per your state's required timeline. Complex requests may be extended by an additional 45 days with notice. We may verify your identity before fulfilling a request, typically by confirming ownership of an email associated with your account.

Authorised agents: California and several other states allow you to designate an agent to exercise rights on your behalf. We will require written authorisation from you and may verify the authorisation directly with you.

13.7 Notice of Right to Opt Out of Sale / Sharing

FeedSense does not sell Personal Information and does not share Personal Information for cross-context behavioural advertising. No "Do Not Sell or Share My Personal Information" link is required because there is nothing to opt out of. If our practices ever change, we will publish the required link and notice 30 days before any such processing begins.

14. Contact Us

For privacy-related questions, requests, or complaints:

You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, KVKK), with an EU/EEA Data Protection Authority, or with the UK Information Commissioner's Office.