Feedlo

    Privacy Policy

    Platform Feedlo available at . Data protection contact: contact@feedlo.pl

    PART B — Privacy Policy

    Prepared in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

    § 10. Data Controller

    The controller of your personal data is Piotr Włodarczyk, conducting sole proprietorship under the name "Piotr Włodarczyk", Tax ID (NIP) 8381704913, Statistical ID (REGON) 015343518, ul. Ludwika Pasteura 6A lok. 33, 02-093 Warszawa.

    Contact the Controller:

    § 11. Roles: Data Controller and Processor

    Depending on the processing context, Feedlo acts in the following roles:

    1. Data Controller – with regard to personal data of Clients (Platform Service Users), i.e., data provided during registration, billing data, and data related to Account usage.
    2. Data Processor – with regard to personal data of End Users, collected through the Widget installed on Clients' websites. In this case, the Client is the Data Controller, and Feedlo processes data on their behalf and in accordance with their instructions, based on the Data Processing Agreement constituting Part C of this document (Article 28 GDPR).

    The further provisions of this Part apply to situations where Feedlo acts as a data controller, unless expressly stated otherwise.

    § 12. Purposes and Legal Bases for Processing

    12.1. Visiting the Platform

    Each time you visit the Platform, we process your IP address, date and time of the visit, browser type, and operating system. The IP address constitutes personal data within the meaning of CJEU case law (Case C-582/14, Breyer).

    This data is processed:

    1. under Article 6(1)(a) GDPR – for purposes specified in the consent given;
    2. under Article 6(1)(b) GDPR – for the purpose of providing electronic services;
    3. under Article 6(1)(f) GDPR – for purposes arising from the Controller's legitimate interests (security, analytics, fraud detection).

    12.2. Registration and Account Usage

    During registration, we require an email address and password. Providing this data is a contractual requirement necessary to create an Account (Article 13(2)(e) GDPR). Failure to provide this data prevents registration.

    Registration is also possible via a Google account (OAuth). In such case, we receive the email address, display name, and profile picture.

    12.3. Data Collected by the Widget

    Through the Widget, Feedlo may process the following categories of End User data on behalf of the Client:

    • screenshots – screen captures that may contain visible personal data;
    • session recordings – recordings of interactions with the website;
    • browser console logs – diagnostic data;
    • browser data – type, version, operating system, resolution, language;
    • page URL of the report;
    • email address – if voluntarily provided;
    • report content – text description or voice recording.

    Voice recordings are processed solely as report content (speech-to-text transcription). Voice recordings are not used for biometric identification and do not constitute biometric data within the meaning of Article 9 GDPR. Recordings are stored solely for the purpose of documenting the report.

    Note on special categories of data: The Feedlo Platform is not intended for processing special categories of personal data within the meaning of Article 9 GDPR (health data, sexual orientation, religious beliefs, biometric data, genetic data, etc.). Screenshots and session recordings may inadvertently contain such data – the responsibility for implementing sensitive data masking mechanisms rests with the Client as the data controller of End Users.

    The responsibility for ensuring a legal basis for processing End User data rests with the Client as their data controller.

    12.4. Third-Party Integrations

    The Client may configure integrations with Jira, GitHub, Asana, or Telegram. Report data may be synchronized with these systems. The Feedlo Controller is not responsible for data processing by the operators of these systems.

    12.5. Marketing

    The Controller may process data for direct marketing purposes only with prior express consent. You have the right to object at any time to processing for marketing purposes, without having to provide a reason (Article 21(2) GDPR).

    § 13. Data Retention Periods

    1. Account data – for the duration of the Account's existence. After Account deletion, data is deleted promptly, except for data necessary to fulfill legal obligations.
    2. Report data – for the duration of the project, then for 3 years (statute of limitations for claims, Article 118 of the Polish Civil Code).
    3. Billing data – 5 years from the end of the year in which the tax payment deadline fell (Polish Tax Ordinance).
    4. Data based on consent – until consent is withdrawn.
    5. Data based on legitimate interest – until a successful objection is raised.
    6. Server logs – 90 days from the date of recording.

    § 14. Data Recipients (Article 13(1)(e) GDPR)

    1. Cloud infrastructure providers – Supabase Inc., Amazon Web Services.
    2. Authentication service providers – Google LLC (OAuth).
    3. Email service providers – Resend Inc.
    4. AI service providers – Google LLC, OpenAI Inc.
    5. Analytics service providers.
    6. Integrated system operators – Atlassian (Jira), GitHub Inc., Asana Inc., Telegram FZ-LLC.
    7. Cooperating entities – legal services, postal services.
    8. Entities authorized by law – state authorities.

    § 15. Data Transfers Outside the EEA (Article 13(1)(f) GDPR)

    Data may be transferred outside the EEA (USA) based on:

    1. Standard Contractual Clauses (SCCs) – Decision 2021/914 (Article 46(2)(c) GDPR).
    2. EU-U.S. Data Privacy Framework – adequacy decision of 10 July 2023.

    § 16. User Rights

    You have the following rights:

    1. right of access to data (Article 15 GDPR);
    2. right to rectification (Article 16 GDPR);
    3. right to erasure – "right to be forgotten" (Article 17 GDPR);
    4. right to restriction of processing (Article 18 GDPR);
    5. right to data portability (Article 20 GDPR);
    6. right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw (Article 77 GDPR);
    7. right to object (Article 21 GDPR);
    8. right to withdraw consent at any time (Article 7(3) GDPR). Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

    Requests may be submitted to contact@feedlo.pl or in writing. The Controller will respond within 30 days (Article 12(3) GDPR), with the possibility of a 2-month extension.

    § 17. Automated Processing and Profiling

    The Platform uses AI mechanisms for categorization, prioritization, and analysis of reports. These mechanisms operate as assistive tools and do not make decisions producing legal effects or significantly affecting individuals within the meaning of Article 22(1) GDPR. Final decisions are made by humans.

    § 18. Technical and Organizational Measures

    The Controller implements measures appropriate to the risk (Article 32 GDPR), including:

    • SSL/TLS connection encryption;
    • password hashing;
    • access control mechanisms (Row-Level Security);
    • regular security reviews and updates.

    § 18a. Personal Data Breach Notification

    1. In the event of a personal data breach affecting Clients (natural persons) that is likely to result in a high risk to the rights and freedoms of natural persons, the Controller will notify the affected persons without undue delay, in accordance with Article 34 GDPR.
    2. The notification will include at least:
      1. a description of the nature of the breach;
      2. the Controller's contact details;
      3. a description of the likely consequences of the breach;
      4. a description of the measures taken or proposed to address the breach.
    3. Regardless of the above, the Controller will report the breach to the President of the Polish Personal Data Protection Office within 72 hours of becoming aware of it, where the breach is likely to result in a risk to the rights and freedoms of natural persons (Article 33 GDPR).

    § 19. External Links

    The Platform may contain links to websites operated by other controllers. These websites operate independently and are not supervised by the Controller.

    § 20. Cookies and Local Data Storage

    The Platform uses:

    1. Essential cookies and local data – for the proper functioning of the Platform (login session, authentication token).
    2. Functional local data – user preferences (theme, language), stored in localStorage.
    3. Analytical cookies – information about visits and traffic sources.

    Essential cookies do not require consent (Article 173(3) of the Polish Telecommunications Law). Consent is required for analytical cookies.

    Full terms of service and Data Processing Agreement (DPA): /terms · Data deletion: /data-deletion
    Effective date: March 15, 2026