This Privacy Policy explains how FeedbackRobot collects, uses and protects information when you use our website (www.feedbackrobot.com) and our feedback and reputation platform.
Two different relationships are covered here. For your account data, we are the data controller. For your customers’ data — the people you collect feedback from — you are the controller and we are the processor, acting on your instructions. A plain-language summary is available in Privacy and your data; this policy is the authoritative document.
1. Information We Collect
Account information. Name, email address, company name, and billing details provided during registration.
Your customers’ data. Names, email addresses, phone numbers and any other details you upload, import, or connect through an integration. Where you connect Shopify or Salesforce, we also store the corresponding record identifiers and synced fields.
Feedback content. Survey responses, conversation messages, and reviews collected from platforms where they are already public (for example Google, TripAdvisor, Agoda and Booking).
Messaging content. Where you send surveys or replies by SMS or WhatsApp, we store the message content and the phone number it relates to, including inbound replies your customers send back.
Documents you upload. Files added to your knowledge base (PDF, DOCX, XLSX), and images such as your logo.
Usage and technical data. IP addresses, browser and device information, and product interaction data, collected through cookies and similar technologies.
Operational logs. We log requests to and from third-party integrations for troubleshooting. These logs can contain personal data present in the integration payload and are automatically deleted after 30 days.
2. How We Use Information
Delivering the service. Collecting feedback, analysing it, generating drafts and summaries, sending messages you have configured, and reporting results back to you.
Support and product improvement. Diagnosing problems and understanding how features are used.
Communication. Service updates, security notices and support responses.
Billing. Managing subscriptions and payments.
We do not sell personal data. We do not use one customer’s data to benefit another.
3. AI Processing
AI analysis is what the product does, so it is worth being specific about where it happens.
We do not train AI models on your data. No customer data is used to train, fine-tune or otherwise improve any model, ours or a third party’s. The models we use are pre-trained and used for inference only.
Processed on infrastructure we control. Sentiment scoring of review text, and extraction of names mentioned in reviews, are handled by a model we host ourselves. This content is not sent to any third-party AI provider.
Processed by OpenAI. Other AI features send content to OpenAI as our AI sub-processor, under its API terms, which do not permit use of the content for model training. These features are: survey-response analysis, the AI assistant, drafted replies to reviews and conversations, summaries, theme and insight generation, survey and template generation, social post captions, and search across your knowledge base. Documents you upload to the knowledge base are converted into embeddings by OpenAI so they can be searched.
Automated content is reviewable. AI-generated replies and offers are drafts intended for your review. Where you configure automation to send without review, you remain responsible for that content — see our Terms.
Transparency. You may ask us how AI processing applies to your feedback data by contacting support.
4. Connected AI Clients (MCP)
FeedbackRobot can be connected to third-party AI clients through the Model Context Protocol (MCP). This is off unless you turn it on.
What connecting does. Authorising a client grants it access to a workspace you select, using your own permissions. A connected client can read data in that workspace — including customers, feedback, reviews and conversations — and can take actions that reach your customers, such as sending a survey or triggering a resolution.
Consent and control. Connection requires you to approve it explicitly and choose the workspace. Authorisations are time-limited and can be revoked at any time from your account settings.
Your responsibility. Data a connected client retrieves is handled by that client’s operator under their own privacy terms, not ours. Only connect clients you trust with your customers’ data.
5. The FeedbackRobot Slack App
This section covers the FeedbackRobot app for Slack. It applies in addition to the rest of this policy. The Slack app is a separate service from the main FeedbackRobot platform: it receives events from Slack, keeps the records listed below, and calls the FeedbackRobot platform on behalf of the Slack user who linked their account.
What the Slack app collects, and why
Workspace installation. Your Slack workspace ID and name, the Enterprise Grid ID if there is one, the Slack user ID of the person who installed the app, the bot user ID, the permissions (scopes) granted, and when the app was installed. We use these to know which workspace an event belongs to and which FeedbackRobot workspace it is connected to.
The bot token. Slack issues an access token when the app is installed. We store it encrypted at rest and use it only to call Slack on your workspace’s behalf, for example to post an alert or an approval card.
Linked users. When a Slack user links their account, we store their Slack user ID and the email address on their Slack profile. We use the email to find their existing FeedbackRobot login, or to create one, and we send the sign-in link to that address. We also store the ID of the matching FeedbackRobot user and the sign-in credentials the app uses to act as that user, encrypted at rest. Slack returns other profile fields (such as name and photo) with the email; we do not store them.
Channels you bind. When someone runs /feedbackrobot bind, we store the channel ID, who bound it, and that channel’s settings (review alert filter and digest day). We do not store channel names or member lists.
Message text, only in three cases. The app reads the text of a message only when:
- it is a command addressed to the bot, either an
@FeedbackRobotmention or a/feedbackrobotslash command, so we can tell what you asked for; - it is a reply inside a survey-response thread the app posted, in which case the reply is sent to that customer by email and saved in the customer’s conversation in your FeedbackRobot workspace;
- it is a CSV or plain-text file shared by a linked user in a channel or direct message the app can see. We download the file, look for email addresses in it, and show them on an approval card for sending surveys. We do not keep the file.
The approval ledger. Each approval card is recorded: what was proposed (for example the survey and the recipient email addresses, or the review page link), who asked for it, who approved or rejected it and when, and the result. Cards that nobody acts on expire after 24 hours. We keep this record so you can see who authorized what.
Delivery records. IDs of the reviews and survey responses already posted to your channels, and which Slack thread each survey response belongs to, so nothing is posted twice and replies reach the right customer. We also log the ID, type and time of each event Slack sends us, without its content, to discard duplicate deliveries.
Usage events. We record product events such as “survey sent from Slack” or “weekly digest sent” in our product analytics, tied to your FeedbackRobot user ID. These events do not contain message text or customer details.
Data Slack sends us that we do not use
Slack’s permissions are broad, so some data reaches us that the app ignores. In particular:
- Thread replies outside our threads. The
channels:historypermission is requested only so the app receives @mentions and thread replies in public channels. Slack delivers every threaded reply in a public channel the bot has joined. The app acts only on replies inside its own survey-response threads and discards the rest without storing them. - Top-level channel messages and direct messages that aren’t commands are dropped as soon as they arrive.
- Files that aren’t CSV or plain text, and files shared by people who haven’t linked an account, are not downloaded. For a linked user’s file, we read its type and channel from Slack to decide whether to download it.
- Notices that the bot left a channel, and Slack assistant-panel events, are received but not acted on.
Like any request to our service, these deliveries can appear briefly in operational logs. Those logs are deleted within 30 days.
What the Slack app does not do
- It does not read channel history. It never requests past messages from Slack; it only sees the events Slack delivers as they happen.
- It does not export, archive or back up your Slack messages or files.
- It does not use Slack data to train AI models, ours or anyone else’s.
- It does not read messages in private channels, and it does not request the permission that would allow it.
- It does not sell Slack data or share it for advertising.
AI and Slack data
The Slack app does not run an AI model itself. Three features use one: drafting a survey template from the topic you type, writing a social post caption from selected reviews, and summarizing a survey response. For these, FeedbackRobot’s core platform sends only the text that feature needs to OpenAI, as described in AI Processing. OpenAI does not use API data for training by default, and may keep it for up to 30 days for abuse monitoring before deleting it. AI output can be inaccurate, so drafts and captions are saved as drafts until someone chooses Keep or Approve, and summaries should be read with the original response.
Retention and uninstalling
While the app is installed, we keep the records above so the app can work.
When the app is removed from your workspace, or Slack revokes its token, we delete the bot token and mark the installation uninstalled straight away. The app stops posting to your workspace at that point. We delete the remaining Slack app records for that workspace, including linked users and their stored credentials, channel settings, the approval ledger and delivery records, within 30 days.
Approval ledger entries are kept for 12 months, then deleted. Duplicate-check event records are kept for 30 days.
Data created in FeedbackRobot through Slack, such as surveys sent, responses, conversations, review sources and kept drafts, belongs to your FeedbackRobot workspace. Removing the Slack app does not delete it; it follows the Retention section and you can delete it from FeedbackRobot.
Your choices and requests
A workspace admin can remove the app at any time from Slack’s Manage apps page, which triggers the uninstall steps above.
To get a copy of the Slack data we hold for you or your workspace, to unlink a Slack user, or to have it deleted before the 30-day window, email [email protected] from the workspace admin’s or the affected user’s address. Tell us the workspace name and, for one person, their Slack email. We will confirm the request and complete it within 30 days, and we may ask for proof that you control the workspace or account.
6. Messaging Your Customers
When you send surveys, reminders or replies, we deliver them through email, SMS or WhatsApp providers acting on your behalf. Emails include an unsubscribe link, and unsubscribed contacts are suppressed from further sending. You are responsible for having a lawful basis to contact the people you upload — see “Your Responsibilities” below.
SMS opt-in data
When you give your mobile number and agree to receive a feedback request by text, that opt-in record and your number are used only by FeedbackRobot to send the survey invitation, its reminders and any follow-up about your visit. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. You can stop these messages at any time by replying STOP, and reply HELP for assistance.
7. Sharing
We do not sell personal data. We share it only in these circumstances:
Sub-processors. Vendors who provide infrastructure and services on our behalf: our AI provider (OpenAI), hosting and file storage, email delivery, SMS and messaging delivery, payment processing, and product analytics. Each is bound by contract to process data only as instructed.
Integrations you connect. Where you connect a platform such as Slack, Shopify, Salesforce, Klaviyo or a review site, data is exchanged with that platform to perform the action you configured.
Publishing actions you initiate. When you publish a reply or testimonial, the content is transmitted to the destination platform.
Legal requirements. Where required by law, or to protect the rights and safety of FeedbackRobot and its users.
We can provide a current list of sub-processors on request.
8. Where Data Is Stored
Our application servers and primary databases are located in Germany (EU). Uploaded files — knowledge-base documents and images — are stored in the United States. Some sub-processors operate in other jurisdictions.
This means data may be transferred across borders, including into and out of the EEA. Where such transfers involve personal data of EEA or UK residents, we rely on Standard Contractual Clauses or another recognised transfer mechanism.
9. Security
We use encryption in transit, access controls, and role-based permissions within workspaces. Enterprise plans support SAML single sign-on, and card details are handled by our payment processor and never stored on our systems.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Retention
While your account is active, we retain your account data and the feedback data in your workspace so the service can function.
Automatic deletion applies to a limited set of records: integration request logs are deleted after 30 days, generated AI artifacts are deleted when they expire, and single sign-on assertion records are deleted after one day.
Other data is retained until you delete it. Feedback, customers, reviews and conversations are kept until you remove them or ask us to. Deleting a contact removes their record; unsubscribing suppresses future messages but retains the record so the suppression is honoured.
On account closure, contact us and we will delete your workspace data. We do not currently delete it automatically on a fixed schedule, so if erasure matters to you, make the request explicitly. Some records, such as audit and billing records, are retained where required for legal, security or accounting purposes.
11. Your Privacy Rights
Depending on your jurisdiction, you may have the right to:
Access and portability — request a copy of the data we hold about you.
Correction and deletion — correct inaccurate data, or request deletion of your account and associated data.
Objection and restriction — object to or restrict certain processing.
Opt out — unsubscribe from marketing communications at any time.
To exercise these rights, contact [email protected].
If a request concerns data you hold about your customers, you can action it directly in your workspace, since you are the controller for that data. Contact us if you need help with a request spanning multiple systems.
12. Your Responsibilities
As the controller of your customers’ data, you are responsible for:
- Having a lawful basis to hold and contact the people you upload
- Telling people what their feedback will be used for
- Honouring access and deletion requests they make to you
- Obtaining consent before sending SMS or WhatsApp messages, where your jurisdiction requires it
- Getting permission before republishing a private survey response as public marketing
13. Changes to This Policy
We may update this policy as the product or the law changes. Material changes will be notified by email or in your dashboard, and the effective date above will be updated.
14. Contact
Questions about this policy or our data practices:
Email: [email protected] — Website: www.feedbackrobot.com/contact