Privacy Policy

1. Introduction and Scope

Customer Feedback Simplified is a product owned, operated, and managed by Tech Stack Simplified. For the purposes of the Digital Personal Data Protection (DPDP) Act, Tech Stack Simplified acts as the Data Fiduciary determining the purpose and means of processing your digital personal data.

This Privacy Policy applies when you use Customer Feedback Simplified at https://customerfeedbacksimplified.com/, and when you use any other software applications, websites, dashboards, APIs, or domains that are owned, operated, or managed by Tech Stack Simplified. Individual products may have separate names, branding, or domains, but your privacy relationship is with Tech Stack Simplified unless a product-specific notice clearly says otherwise.

2. Controller and Processor Roles

2.1 Registered business users

When you create a business account with Customer Feedback Simplified or any other Tech Stack Simplified product, Tech Stack Simplified determines the purposes and means of processing your account information. In that context, Tech Stack Simplified is the Data Controller under GDPR and the Data Fiduciary under the DPDP Act.

2.2 Feedback respondents

When feedback respondents submit responses to questionnaires created by our customers, Tech Stack Simplified acts only on the instructions of that business customer. The business that collected the feedback is the responsible controller / fiduciary for that data.

• DSR requests from respondents should be directed to the business that collected the feedback.
• We assist business customers with processor obligations under their instructions.
• We maintain Data Processing Agreements with registered business customers.

Business customers may request our DPA template at support@customerfeedbacksimplified.com.

3. Information We Collect

3.1 Registered business users

• Business name and registered address
• Contact person details, email address, and login credentials
• Subscription tier, billing history, and questionnaire settings
• Password hashes stored securely using bcrypt

3.2 Feedback respondents

• Name, email address, or phone number if a business chooses to collect them
• Ratings, scores, structured answers, and free-text comments

How long your response is kept is decided by the business that collected it, within the limits in Section 8. You can ask them, or us, to erase it at any time — see Section 9.

3.3 Technical and usage data

• IP address and browser (user-agent) details captured when you give consent or accept our legal documents, retained as part of the consent record as proof of consent (Art. 7(1) GDPR / Sec. 6 DPDP Act)
• Browser type, device type, operating system, and session activity for consented product analytics
• Server access logs retained for 90 days

4. Lawful Basis for Processing

We process personal data only where a lawful basis exists under Article 6 GDPR and Section 4 of the DPDP Act.

5. How We Use Information

5.1 For business users

• Provide, maintain, and improve the platform
• Manage subscriptions, support requests, and service notices
• Detect and prevent fraud, abuse, and security threats
• Comply with legal and contractual obligations

5.2 For feedback data

• Store and display responses for the relevant business customer
• Generate anonymised analytics and reports
• Fulfil DSR instructions received from the business customer

6. Data Sharing and Subprocessors

We share data only with trusted subprocessors under contractual obligations to maintain confidentiality and security.

• Hetzner Online GmbH for EU-hosted server infrastructure, with a signed DPA
• Amazon Web Services EMEA SARL (Amazon Simple Email Service) as our primary provider for transactional email delivery, including account verification, password reset, and service notifications. Sending is carried out from the AWS Europe (Frankfurt) region. AWS also processes delivery event data (deliveries, bounces, complaints, and delivery delays) that we use to keep our systems able to reach you
• Amazon Web Services EMEA SARL (Amazon Simple Email Service) also for the delivery of survey invitations that our business customers send to their own customers. These are sent on the business customer's documented instruction from a separate sending domain and under a separate, per-business sending identity, so that each business's sending is isolated from every other and from our own account email. AWS processes the recipient email address, the message content composed by the business, and the resulting delivery events
• Resend (by Resend Inc.) and Mailtrap (by Railsware Products Inc.) as configured fallback providers for our own account email only. They are not used to deliver survey invitations
• Dodo Payments or other payment providers for subscription, billing, tax, and payment support where paid plans are used
• Cloudflare, Inc. for content delivery, DNS, protection against attacks, and bot and abuse prevention on our contact form and public feedback forms (via Cloudflare Turnstile); Cloudflare proxies traffic to our platform and processes visitor IP addresses, request metadata, and interaction signals needed to distinguish humans from bots, for security and performance purposes

We use a self-hosted Umami analytics instance only when you opt in through the analytics preference. Umami is configured without cookies, without cross-site tracking, without user identification, and without collecting form contents. Search strings and URL hashes are excluded so tokens or other query data are not sent. Your IP address is used only to derive a short-lived, non-reversible visit identifier and an approximate country; the IP address itself is not stored. Analytics is not collected on the public feedback forms our business customers publish. The Umami database runs on our own infrastructure, is deleted after 12 months, and we do not share this analytics data with advertising networks.

7. International Data Transfers

Personal data is stored on Hetzner servers located within the European Union. For Indian users, where cross-border restrictions apply under the DPDP framework, we will maintain and update appropriate safeguards in line with notified requirements.

Transactional email and survey invitations are sent through Amazon Simple Email Service in the AWS Europe (Frankfurt) region, so email content and recipient addresses are processed within the European Union. Our contracting entity is Amazon Web Services EMEA SARL (Luxembourg), under the AWS GDPR Data Processing Addendum. Where any limited support or operational data reaches Amazon Web Services, Inc. in the United States, AWS is certified under the EU-U.S. Data Privacy Framework and additionally relies on the European Commission's Standard Contractual Clauses.

Where Cloudflare provides content delivery, network security, and bot prevention (via Cloudflare Turnstile), limited technical data (such as IP addresses and request metadata) may be processed by Cloudflare, Inc. in the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection.

8. Data Retention

We retain personal data only for as long as necessary for the stated purpose or as required by law.

For feedback data we act as a processor. The business customer that collected the feedback decides how long it is kept, within the limits set out here. Where they make no choice, feedback is retained while their account is active and is deleted or anonymised within 60 days of the account being closed.

8.1 Customer-configured retention

A business customer can shorten retention for the feedback they collect, in two ways:

• A rolling limit. Responses are automatically anonymised once they reach a chosen age. The shortest age that can be set is 12 months.
• A one-off cut-off date. Responses submitted before a chosen date are anonymised. That date must be at least 12 months in the past.

Both are limits on bulk housekeeping, and the 12-month minimum exists so that a single setting cannot destroy a business's recent operating record. It does not limit anyone's rights: an erasure request from a respondent, or a deletion instruction from the business customer about identified records, is actioned whatever the age of the data. Neither control affects records placed under restriction of processing, which are retained but not otherwise used.

8.2 What anonymisation removes

Anonymisation is irreversible and is not the same as deletion. We remove the respondent identifier, any free-text answer identified as containing personal data, the link to the business customer's own customer records, and the text of any internal follow-up note attached to the response.

What remains is the part that is no longer about an identifiable person: ratings, scores, multiple-choice selections, timestamps and the aggregate counts built from them. That remainder is not personal data, and we retain it indefinitely so that a business does not lose its historical trend by meeting its retention obligations.

9. Your Privacy Rights

9.1 GDPR rights

9.2 DPDP rights

Under the DPDP Act, users whose digital personal data is processed are referred to as Data Principals. As a Data Principal, you may exercise the rights below, subject to applicable law and the nature of the data involved.

• Right to access information about personal data being processed
• Right to correction and erasure of inaccurate or outdated personal data
• Right to grievance redressal within a reasonable timeframe
• Right to nominate a representative in case of death or incapacity
• Right to withdraw consent at any time
• Right to lodge a complaint with the Data Protection Board of India

9.3 How to exercise rights

• Submit a DSR in the platform or email support@customerfeedbacksimplified.com
• We aim to acknowledge requests within 72 hours
• Standard fulfilment target is 30 days, with complex cases up to 90 days on notice
• Feedback respondents should contact the business that collected their feedback

9.4 California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act grants you the right to know and access, delete, and correct the personal information we hold about you, the right to opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising any of these rights.

To exercise your California privacy rights, email support@customerfeedbacksimplified.com.

9.5 Canada (PIPEDA)

For users in Canada, we handle personal information in accordance with the ten fair information principles of the Personal Information Protection and Electronic Documents Act (PIPEDA): accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance.

Rohit Ugale is the accountable individual responsible for our compliance with these principles. To request access to or correction of your personal information, email support@customerfeedbacksimplified.com.

9.6 Brazil (LGPD)

For users in Brazil, we process personal data in accordance with the Lei Geral de Proteção de Dados (LGPD). Our Data Protection Officer (Encarregado) is Rohit Ugale, reachable at support@customerfeedbacksimplified.com.

As a data subject under the LGPD, you have the right to:

• Confirmation that your personal data is being processed
• Access to your personal data
• Correction of incomplete, inaccurate, or outdated data
• Anonymisation, blocking, or deletion of unnecessary or excessive data
• Portability of your data to another service provider
• Deletion of personal data processed with your consent
• Information about the public and private entities with whom we share data

10. Data Security

• AES-256-GCM application-level encryption for sensitive tokens and identifiers
• HTTPS / TLS encryption for data in transit
• bcrypt password hashing
• Audit records for consent and legal acceptances
• Role-based access controls and annual security reviews
• Backups with tested restoration procedures

11. Data Breach Notification

• Notify affected business customers without undue delay, and in any event within 72 hours of becoming aware of a breach
• Notify competent authorities where required by law
• Notify affected individuals without undue delay where high risk exists
• Maintain records of incidents and breaches for at least 1 year

12. Cookies and Tracking Technologies

We use only essential cookies needed for the operation of the platform. With your separate analytics preference, we load self-hosted Umami for cookieless, aggregated product usage analytics; Umami does not set an analytics cookie. We do not use advertising or cross-site tracking. Where Cloudflare Turnstile protects our contact form and public feedback forms, Cloudflare may set security cookies (such as __cf_bm) strictly for bot mitigation and network protection.

13. Children's Data

Our platform is intended for business users aged 18 and over. We do not knowingly collect personal data from children under 18 for our own purposes. Where a business customer collects feedback from children, that customer is responsible for obtaining any required parental or guardian consent.

14. Right to Lodge a Complaint

We encourage you to contact us first at support@customerfeedbacksimplified.com so we can try to resolve your concern directly.

15. Data Processing Agreement

In accordance with Article 28 GDPR and Section 8 of the DPDP Act, registered business customers are required to enter into a Data Processing Agreement with us. Self-serve accounts accept the DPA electronically at registration, and the acceptance is recorded as evidence. A separately executed DPA is available for enterprise accounts on request.

16. Changes to This Privacy Policy

• Minor updates will be posted on this page with an updated effective date
• Material changes will be notified to registered business users by email in advance
• Continued use of the Service after the effective date constitutes acceptance
• Previous versions are available to registered users within their account, or to others on request to support@customerfeedbacksimplified.com

17. Contact Us

This Privacy Policy was last updated on August 13, 2026.