Terms and Conditions

1. Definitions

Product names such as Customer Feedback Simplified identify the software you are using. The legal contracting party remains Tech Stack Simplified, unless a separate written agreement expressly names a different legal entity.

2. Acceptance of Terms

• You are at least 18 years old and legally capable of entering into a binding contract.
• If you register on behalf of a business, you have authority to bind that entity.
• You have read, understood, and agree to these Terms in full.
• You accept our Privacy Policy, incorporated by reference.
• You accept our Refund Policy, incorporated by reference.
• Where applicable, you accept the Data Processing Agreement incorporated for self-serve accounts.

We may update these Terms from time to time. Material changes will be communicated by email at least 30 days before taking effect.

3. Description of Service

Customer Feedback Simplified provides a cloud-based platform that enables Business Users to create questionnaires, collect structured and free-text feedback, review analytics, manage DSRs, configure retention, and perform anonymisation.

Tech Stack Simplified may offer additional SaaS products, websites, applications, or domains in the future. Those products may have separate names and user interfaces, but they are owned, operated, and managed by Tech Stack Simplified unless a product-specific notice says otherwise.

The Service is hosted on Hetzner Online GmbH infrastructure located within the European Union.

4. Fees, Billing, Auto-Renewal and Taxes

• Paid subscriptions are billed in advance and automatically renew at the end of each billing cycle until cancelled.
• Payments are processed by Dodo Payments acting as our Merchant of Record; Dodo Payments' terms apply to the payment transaction itself.
• We may change prices with at least 30 days' notice before the change takes effect.
• Applicable taxes such as GST, VAT, or sales tax may be added to your charges and are collected by the Merchant of Record where required by law.

Refunds are governed by our Refund Policy, incorporated into these Terms by reference.

5. Account Registration and Security

5.1 Registration requirements

To use the Service, you must provide accurate and complete business account information and keep it current.

5.2 Account security

• You are responsible for maintaining the confidentiality of your login credentials.
• You must not share credentials with third parties.
• You must notify us immediately at support@customerfeedbacksimplified.com if you suspect unauthorised access.

5.3 One account per business

Each business entity may maintain one active account unless a multi-seat arrangement has been expressly agreed.

6. Acceptable Use Policy

6.1 Permitted uses

• Create questionnaires related to legitimate business activities.
• Collect feedback from customers, employees, or stakeholders who have consented where required.
• Access analytics and export data within the scope of your subscription.

6.2 Prohibited uses

• Collect personal data without a valid lawful basis under GDPR or the DPDP Act.
• Collect data from children under 18 without verifiable parental or guardian consent.
• Conduct deceptive, misleading, or fraudulent data collection.
• Collect sensitive data without explicit consent and appropriate safeguards.
• Send spam, scrape the platform, reverse engineer the Service, or upload malicious code.
• Attempt to access other accounts, systems, or networks without authorisation.
• Resell, sublicense, or white-label the Service without prior written consent.

6.3 Survey invitation email

Survey invitations let you email a feedback request to your own customers through the Service. This capability is provided on strict conditions, because misuse of it damages email delivery for every customer of the platform, not only for you.

Access is by approval, not by plan alone. Invitation sending is released to individual accounts on request. A plan that includes the feature makes you eligible to apply; it is not itself a grant of access, and we may decline or withdraw access at our discretion, including where we are not satisfied that a recipient list was collected as warranted below. You can request access from the Invitations page in your dashboard.

Sending is subject to volume limits. Your plan sets the number of invitations you may send in each billing period, and a separate daily limit paces how many may go out in any one day (measured in UTC). Both are shown on the Invitations page. A campaign larger than the daily limit is not refused — it is delivered over successive days until it completes. We may adjust these limits where necessary to protect delivery for other customers, and will tell you if we do so for your account.

You must:

• Send only to people who are existing customers of your business, or who have consented to receive email from you.
• Confirm, for every campaign, how the list was obtained. We record that confirmation.
• Supply a genuine, current postal address, which we include in the footer of every invitation, and keep it current for as long as invitations are sent.
• Supply a reply-to address you control. We verify ownership before you can send.
• Ensure the sender name, reply-to address and subject line you configure are accurate, and not false or misleading as to who is writing or what the message is about.

You must not:

• Send to purchased, rented, scraped, appended, or otherwise third-party-sourced lists, or to any address obtained by automated harvesting or dictionary attack.
• Send to addresses that have unsubscribed, or that have previously bounced. An unsubscribe applies permanently within your account and cannot be undone by re-uploading the address, editing a list, or asking support.
• Remove, obscure, or attempt to defeat the unsubscribe link or the footer we append.
• Use invitations for marketing, promotion, or any purpose other than requesting feedback (see Invitation content below).
• Relay invitations through any system so as to disguise their origin.
• Send on behalf of another business, or resell invitation sending.

You further confirm that you are not subject to any order, injunction, or regulatory undertaking restricting your sending of commercial electronic messages.

Invitation content. A survey invitation exists to request feedback on a transaction or interaction the recipient has already had with you. It is not a marketing channel, and keeping it free of promotional content is what keeps it outside the scope of most commercial-email law. You must not include, in an invitation or in any subject line you configure for one:

• any advertisement or promotion of goods, services, offers, discounts, vouchers, loyalty rewards, or events;
• any incentive conditional on completing the questionnaire;
• any content whose primary purpose, applying 16 CFR §316.3, would be commercial advertisement or promotion rather than the feedback request itself;
• any content unrelated to the feedback request.

The composer provides no field for an offer, discount, or incentive, and you must not introduce one through the subject or message fields. We screen invitation content for promotional material and may refuse, remove, or decline to transmit content that does not conform.

You are the sender. Where you use the survey invitation feature, you are the sender and the initiator of every invitation within the meaning of the CAN-SPAM Act of 2003 (15 U.S.C. §7701 et seq.) and its implementing rules at 16 CFR Part 316, and you are the sender of record in every other jurisdiction whose law attaches obligations to a sender. We provide the technical means of transmission on your documented instruction and are not the sender. Each invitation is transmitted from a sending identity assigned to your account alone, identifies your business in the "from" line, and carries the postal address you supply.

We apply an unsubscribe link and your postal address to every invitation and these cannot be removed or suppressed. We give effect to an unsubscribe request immediately, and in every case well inside the ten (10) business days required by 15 U.S.C. §7704(a)(4), applying it across your account without further action by you. You must not send to an address that has unsubscribed, by any means and through any channel, other than as permitted by applicable law.

Recipients in Canada. Where any recipient is in Canada, Canada's Anti-Spam Legislation (S.C. 2010, c. 23) may apply. You confirm that for each such recipient you hold either express consent, or implied consent that is still valid at the time of sending, and you acknowledge that:

• implied consent arising from a purchase, lease, or contract expires two (2) years after the most recent such transaction, and implied consent arising from an inquiry or application expires six (6) months after that inquiry;
• the burden of proving consent rests on you as the sender. You must keep records sufficient to evidence, for each recipient, the form of consent, the date it was given or the transaction it arises from, and how it was obtained, and produce them on request;
• the contact information in your invitations must remain valid for at least sixty (60) days after each invitation is sent.

We do not verify consent on your behalf. Our record of your confirmation is evidence of your instruction to us, not evidence of consent by any recipient.

We monitor bounce and spam-complaint rates for each account separately. If your rates exceed our thresholds we may pause your invitation sending automatically and without notice, and we may require evidence of how a list was collected before re-enabling it. A pause affects outbound invitations only — your feedback forms, links, QR codes, embeds and stored data continue to work normally.

Indemnity for invitations. You will indemnify, defend, and hold harmless Tech Stack Simplified against any claim, proceeding, investigation, fine, penalty, damages, settlement, and reasonable legal costs arising out of or relating to survey invitations sent from your account. This includes claims by recipients, action by regulators or email providers, and claims under the CAN-SPAM Act of 2003, Canada's Anti-Spam Legislation, any US state commercial email statute, the UK Privacy and Electronic Communications Regulations, the ePrivacy Directive as implemented in any EEA member state, the GDPR, and the DPDP Act — and including any claim that a recipient did not consent or had no existing relationship with you. This obligation is not subject to the limitation of liability in §15.

Attestation. Before invitation sending is enabled, and for every campaign, you must confirm the obligations in this §6.3 and in clause 8a of the Data Processing Agreement. We record that confirmation, its timestamp, and the account that gave it, as evidence of your instruction to us.

7. Controller and Processor Responsibilities

7.1 Your responsibilities as controller / data fiduciary

• Ensure you have a valid lawful basis for collecting personal data.
• Provide appropriate privacy notices before data collection.
• Obtain valid consent where required.
• Respond to DSRs within applicable statutory timeframes.
• Ensure questionnaires comply with laws in all relevant jurisdictions.
• Do not collect sensitive personal data without proper legal basis and safeguards.

You are responsible for ensuring that your use of the Service is lawful in your own jurisdiction.

7.2 Our responsibilities as processor

For account, billing, support, and product usage data that we determine how to process, Tech Stack Simplified is the Data Fiduciary under the DPDP Act. For feedback respondent data you collect through questionnaires, we generally act as your processor and process that data on your documented instructions.

• Process data only on your documented instructions.
• Implement technical and organisational security measures.
• Maintain confidentiality of processed data.
• Assist with DSR fulfilment through the tools we provide.
• Notify you of personal data breaches within 72 hours of awareness.
• Delete or return data upon termination, subject to legal retention requirements.

7.3 Data Processing Agreement

A Data Processing Agreement governs processing of feedback respondent data. Self-serve accounts accept this DPA electronically on registration, and the acceptance is recorded as evidence. Enterprise accounts may request a separately executed DPA via support@customerfeedbacksimplified.com.

8. Intellectual Property Rights

• We retain all rights, title, and interest in the Service and our Intellectual Property.
• You receive a limited, non-exclusive, non-transferable, revocable licence to use the Service within your Subscription.
• You retain ownership of your questionnaires, feedback data, and business information.
• You grant us a limited licence to process and display your content only to provide the Service.
• You must not reverse engineer, decompile, or derive the source code of the Service.

9. Data Ownership and Portability

You own all feedback data collected through your questionnaires. We act as custodian and processor of that data on your behalf.

• You may export questionnaire data in CSV or JSON format.
• Upon account termination, you have 60 days to export your data before deletion.
• You may delete individual responses, questionnaires, or your account.
• Anonymised and aggregated data that cannot be linked to an individual may be retained.

10. Privacy and Data Protection

Your use of the Service is subject to our Privacy Policy, incorporated into these Terms by reference.

10.1 GDPR support

• DSR management tools for access, erasure, and portability
• Customer-configured retention: a rolling anonymisation age, or a one-off cut-off date, each subject to a 12-month minimum
• Irreversible anonymisation that preserves your aggregate analytics
• Subprocessor transparency for EU-based hosting

10.2 DPDP support

• Processing only on your instructions as Data Fiduciary
• Security safeguards aligned with DPDP Rules
• Audit log support
• Assistance with Data Principal requests within statutory windows

11. Security Obligations

11.1 Our security measures

• AES-256 encryption for data at rest
• TLS 1.3 for data in transit
• Role-based access controls
• Periodic internal security reviews
• Nightly encrypted backups to EU-region storage, each verified before it is stored

We have not undertaken third-party penetration testing, and we hold no SOC 2 or ISO 27001 certification. Because backups are taken nightly rather than continuously, the maximum data loss in a recovery scenario is up to 24 hours.

11.2 Your security obligations

• Maintain secure account credentials
• Share questionnaire links only with intended recipients
• Avoid collecting unnecessary sensitive data
• Promptly notify us of suspected breaches involving the Service

12. Personal Data Breach Notification

• We will notify you within 72 hours of becoming aware of a breach affecting data we process on your behalf.
• Notification will include the nature of the breach, affected categories, likely consequences, and measures taken.
• You are responsible for notifying respondents and authorities where required by law.

13. Service Availability

The Service is provided on an as available basis. We do not offer a service level agreement or an uptime commitment, and no uptime figure is warranted. We aim to keep the Service available, to carry out planned maintenance outside peak hours, and to give reasonable notice of planned maintenance where practicable. Availability may be affected by third-party infrastructure failure, cyberattack, force majeure events, or scheduled maintenance.

If you require a contractual service level, contact support@customerfeedbacksimplified.com to discuss a separately executed agreement.

14. Warranties and Disclaimers

We warrant that the Service will materially perform as described, that we will maintain reasonable security measures, and that we will process Personal Data in accordance with our DPA and applicable law.

Except as expressly stated, the Service is provided "as is" and "as available" without implied warranties of merchantability, fitness for a particular purpose, or non-infringement.

15. Limitation of Liability

• We are not liable for indirect, incidental, special, consequential, or punitive damages.
• Our aggregate liability is capped at the greater of fees paid in the prior 12 months or INR 10,000 (or its equivalent in your billing currency) where no fees were paid.
• These limits do not apply where liability cannot be excluded by law, including fraud or certain statutory obligations.

15.1 What this section does not limit. The limits above apply to our liability to you. They place no limit on, and do not apply to, your payment obligations or your obligations under §6.3 (Survey invitation email) and §16 (Indemnification).

16. Indemnification

You agree to indemnify, defend, and hold us harmless against any claim, proceeding, investigation, fine, penalty, damages, settlement, and reasonable legal costs arising from your breach of these Terms, your failure to comply with data protection or commercial-email laws, unlawful questionnaire content, survey invitations sent from your account (as set out in §6.3), or your unauthorised use of the Service. We will indemnify you against qualifying third-party IP infringement claims relating to the Service, subject to customary conditions.

Your obligations under this §16 are not subject to the limitation of liability in §15.

17. Termination

17.1 Termination by you

You may terminate your account at any time through the dashboard or by contacting support@customerfeedbacksimplified.com.

17.2 Termination by us

• Breach of these Terms or the Acceptable Use Policy
• Unlawful data collection or missing consent
• Non-payment of applicable fees after notice
• Threats to Service security or integrity
• Insolvency or equivalent proceedings

17.3 Effect of termination

• Access to the Service ceases immediately on termination.
• You have 60 days to export data before permanent deletion.
• We delete Personal Data processed on your behalf within 60 days unless law requires retention.

18. Confidentiality

Each party will keep the other's confidential information confidential, except where disclosure is required by law or the information is already public, previously known, or independently developed. This obligation survives termination for 3 years.

19. Governing Law and Dispute Resolution

• These Terms are governed by the laws of India, with GDPR and EU law applying where required.
• For India-based Business Users, courts in Pune, Maharashtra have jurisdiction, subject to arbitration.
• Disputes not resolved amicably within 30 days may be referred to arbitration in Pune, Maharashtra under Indian law.
• EU-based Business Users may also use alternative dispute resolution mechanisms available in the EU.

20. Force Majeure

Neither party is liable for delays or failures caused by events beyond reasonable control, including natural disasters, government actions, internet failures, cyberattacks, epidemics, or hosting outages. If such an event continues for more than 60 consecutive days, either party may terminate the agreement.

21. Changes to These Terms

• Minor updates may be posted on this page with an updated effective date.
• Substantive updates will be emailed at least 30 days before they take effect.
• Urgent legal or security updates may take effect immediately with concurrent notice.

22. General Provisions

• These Terms, the Privacy Policy, the Refund Policy, and any applicable DPA form the entire agreement.
• If any provision is unenforceable, the remainder stays in effect.
• Failure to enforce a right is not a waiver.
• You may not assign rights without prior written consent.
• The parties are independent contractors.
• Legal notices must be sent in writing to support@customerfeedbacksimplified.com.

23. Contact Information

These Terms and Conditions were published on September 11, 2026 and are effective from October 15, 2026.