GDPR & DPDP Act 2023 Compliant

Privacy Policy

Last Updated: October 2026 • Applicable to partner businesses, administrative users, and end-consumers.

1. Privacy by Design & Data Minimization

FeedbackDesk is built around the fundamental principle of data minimization (GDPR Art. 5(1)(c) and India DPDP Act Sec. 6). We do not collect unnecessary consumer personal data to distribute feedback links or record ratings.

What We Collect

Rating (1-5), qualitative feedback comments, optional email (if consumer chooses to provide), and single-use link tokens.

What We NEVER Collect

NO hardware canvas fingerprinting, NO battery API or MAC address scraping, and NO advertising tracking cookies.

2. Automated PII Sanitization for AI Processing

Before any review text is analyzed by our artificial intelligence engine (Google Gemini 2.5 Flash), it passes through an automated pre-processor (sanitizeForAi) that detects and scrubs credit card numbers, social security numbers, Aadhaar patterns, and secret keys. Data is never used to train public machine learning foundation models.

3. Anti-Spam Security & Local Storage

We use HTML5 localStorage strictly for functional anti-spam security (such as remembering a 30-day device cooldown per product). Under the EU ePrivacy Directive (Directive 2002/58/EC Art. 5(3)), strictly functional security tokens are exempt from banner consent requirements.

4. Data Roles (Controller vs. Processor)

Under global privacy legislation:

The Business is the Data Controller / Data Fiduciary: They manage customer relationships and decide to collect feedback.
FeedbackDesk is the Data Processor: We host, sanitize, analyze, and present the feedback solely on behalf of the business.

5. Your Data Subject Rights

Regardless of your location, you have the right to request access to, correction of, or deletion of your feedback record. To submit a Data Subject Access Request (DSAR), contact our Data Protection Officer at privacy@feedbackdesk.com.