These terms have been prepared in accordance with Article 8 of the Polish Act of 18 July 2002 on the Provision of Electronic Services (Journal of Laws 2020, item 344, as amended).
§ 1. General Provisions and Definitions
- These Terms of Service define the types, scope, and conditions of electronic services provided by the Service Provider through the Feedlo platform, available at , as well as the rules for entering into and terminating service agreements, complaint procedures, and personal data protection principles.
- These Terms constitute a standard contract within the meaning of Article 384 § 1 of the Polish Civil Code of 23 April 1964.
- Definitions:
- Service Provider (Controller) – Piotr Włodarczyk, conducting sole proprietorship under the name "Piotr Włodarczyk", Tax ID (NIP) 8381704913, Statistical ID (REGON) 015343518, ul. Ludwika Pasteura 6A lok. 33, 02-093 Warszawa.
- Platform – the Feedlo online platform available at and related applications and browser extensions.
- Service User (Client) – a natural person, legal entity, or organizational unit without legal personality using the Platform under these Terms.
- Consumer – a natural person performing a legal action not directly related to their business or professional activity (Article 22¹ of the Polish Civil Code).
- Account – a collection of resources and permissions assigned to a given Service User in the Platform, created through registration.
- Widget – a Feedlo software component installed on the Client's websites, enabling the collection of reports from end users.
- End User – a natural person using the Client's website where the Widget is installed.
- Project – an organizational space in the Platform to which reports, Widget configuration, and team members are assigned.
- Plan – a service package selected by the Client that determines functional limits (number of projects, team members, reports) and pricing, in accordance with the current price list described in § 4a.
- Force Majeure – an external event that is impossible to foresee and prevent, including but not limited to: natural disasters, wars, acts of terrorism, pandemics, cyberattacks, failures of cloud infrastructure providers, international sanctions, and decisions of public authorities preventing the provision of services.
- GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
§ 2. Types and Scope of Electronic Services
The Service Provider offers the following services through the Platform:
- Account Management – enabling registration, login, and Account settings management.
- Report Management – enabling the collection, review, categorization, prioritization, and lifecycle management of reports (bugs, feature requests, improvements) submitted by End Users via the Widget or manually.
- Feedback Widget – providing a configurable component for installation on the Client's websites, enabling End Users to submit reports with screenshots, session recordings, and console logs.
- AI Analysis – automatic categorization, prioritization, and analysis of reports using artificial intelligence models.
- Third-Party Integrations – the ability to synchronize reports with Jira, GitHub, Asana, Telegram, and other systems configured by the Client.
- Reporter Portal – a portal enabling End Users to track the status of their reports.
- Browser Extension – a browser extension for collecting reports.
- MCP Server – a machine interface (Machine Communication Protocol) enabling programmatic access to reports.
§ 3. Technical Requirements and Acceptable Use Policy
The following are required to use the Platform:
- a device with Internet access;
- a current version of a web browser supporting JavaScript, cookies, and localStorage (Google Chrome, Mozilla Firefox, Microsoft Edge, Safari);
- an active email address;
- for the Widget – a website on which the Widget will be installed.
The Service User is obligated not to provide unlawful content and, in particular, agrees to comply with the following Acceptable Use Policy:
- Prohibition on collecting special categories of data – The Service User shall not use the Widget or the Platform to intentionally collect special categories of personal data within the meaning of Article 9 GDPR (health data, sexual orientation, religious beliefs, biometric data used for identification, genetic data, etc.). The Platform is not intended for processing such data.
- Prohibition on reverse engineering – The Service User shall not decompile, disassemble, or reverse engineer the source code of the Platform, the Widget, or the browser extension.
- Prohibition on excessive use – The Service User shall not generate artificial traffic, mass API requests, or otherwise intentionally overload the Platform's infrastructure beyond reasonable usage limits.
- Prohibition on spam – The Service User shall not use integrations with third-party systems or notification features to distribute unsolicited commercial messages (spam).
- Masking sensitive data – The Service User is responsible for implementing appropriate data masking mechanisms on their websites (e.g., hiding fields with medical or financial data) before installing the Widget, to minimize the risk of accidentally capturing sensitive data in screenshots or session recordings.
§ 4. Terms of Entering into a Service Agreement
- A service agreement is concluded upon registration in the Platform by completing the registration form and accepting these Terms of Service.
- Registration is also possible via a Google account (OAuth 2.0). In such case, acceptance of the Terms occurs upon the first login.
- The service agreement is concluded for an indefinite period.
- The Service User declares that the information provided in the registration form is true and current.
- The Platform is intended for persons aged 16 and over. The Service Provider does not knowingly collect personal data of individuals under 16 years of age. If the Service Provider becomes aware that a person under 16 has registered, their Account will be promptly deleted (Article 8 GDPR in conjunction with Article 8 of the Polish Personal Data Protection Act of 10 May 2018).
§ 4a. Plans and Pricing
- The Platform offers plans in two categories:
- Vibe Coders (single-user plans):
- Starter – free ($0/month);
- Pro – $19/month;
- Pro Plus – $49/month (up to 40 projects and 5,000 reports).
- Professional Teams (team plans):
- Free – free ($0/month, 1 project, 1 user);
- Team – $49/month (up to 10 projects, up to 30 team members);
- Enterprise – $299/month (up to 100 projects, up to 100 users, up to 100,000 reports).
- A 20% discount applies when choosing annual billing.
- Prices are quoted in US dollars (USD) and are net amounts (applicable VAT will be added in accordance with the relevant regulations, where required).
- The Service Provider reserves the right to change pricing. Service Users will be notified electronically at least 30 days in advance. If the Service User does not accept the new prices, they have the right to terminate the agreement before the changes take effect, without incurring additional costs.
- For paid plans, access to the services corresponding to the selected plan is active from the moment of payment until the end of the paid billing period.
- The current and detailed price list is available on the Platform's website.
§ 5. Termination and Account Suspension
- The Service User may terminate the service agreement at any time by deleting their Account in the Platform or by sending a corresponding statement to the email address: contact@feedlo.pl.
- The Service Provider may terminate the agreement with a 14-day notice period in the event of:
- violation by the Service User of these Terms, including the Acceptable Use Policy (§ 3);
- use of the Platform in a manner contrary to law or infringing the rights of third parties;
- discontinuation of the Platform – subject to prior notification of Service Users.
- Consumers have the right to withdraw from a distance contract within 14 days of conclusion, without providing a reason (Article 27 of the Polish Consumer Rights Act). This right does not apply if the service has been fully performed with the Consumer's express consent, having been informed before the commencement of performance that they will lose the right of withdrawal upon full performance (Article 38(1) of the Polish Consumer Rights Act).
- Account Suspension. In the event of a reasonable suspicion of a violation of these Terms or the Acceptable Use Policy (§ 3), the Service Provider has the right to temporarily suspend the Service User's Account, while simultaneously notifying them electronically of the reasons for the suspension. The Service User has 7 days to remedy the violation or provide an explanation. If there is no response or the violation continues, the Service Provider may terminate the agreement in accordance with paragraph 2.
§ 6. Liability and Service Availability
- The Service Provider makes every effort to ensure uninterrupted and proper operation of the Platform. The declared availability target for the Platform is 98% per year (measured as the ratio of uptime to total time in a given calendar year). This declaration does not constitute a guarantee and does not give rise to compensation claims on the part of the Service User.
- The Service Provider will notify Service Users of planned maintenance (maintenance, updates) at least 48 hours in advance electronically or via a notice in the Platform. Planned maintenance periods are not counted as downtime.
- The Service Provider is not liable for:
- interruptions in Platform availability due to technical reasons (failures, maintenance, updates);
- content submitted by End Users through the Widget;
- actions or omissions of operators of integrated third-party systems (Jira, GitHub, Asana, Telegram);
- consequences arising from use of the Platform contrary to these Terms;
- accidental capture of sensitive data in screenshots or session recordings – the responsibility for masking such data rests with the Client (§ 3).
- For Service Users who are not Consumers, the Service Provider's liability is limited to damages caused by willful misconduct.
§ 6a. Force Majeure
- Neither Party shall be liable for failure to perform or improper performance of obligations under these Terms if such failure is caused by a Force Majeure event (as defined in § 1, paragraph 3).
- The Party affected by a Force Majeure event shall notify the other Party without delay, no later than within 72 hours of becoming aware of the event, indicating its nature and expected duration.
- If a Force Majeure event lasts longer than 30 days, either Party has the right to terminate the agreement with immediate effect.
§ 6b. Modification of Services
- The Service Provider reserves the right to modify, expand, or limit the scope of services described in § 2, including adding new functionalities, removing existing integrations, changing AI model providers, or changing the technical parameters of the Platform.
- Service Users will be notified electronically of significant changes to the scope of services (i.e., removal of functionalities or integrations that the Client actively uses) at least 30 days in advance.
- If a change significantly limits the Platform's functionality relative to the selected plan, the Service User has the right to terminate the agreement before the changes take effect, without incurring additional costs.
§ 7. Intellectual Property Rights
- The Platform, including its source code, graphic layout, trademarks, logos, and content, is the property of the Service Provider and is protected under the Polish Copyright and Related Rights Act of 4 February 1994.
- The Service User does not acquire any intellectual property rights to the Platform. They obtain only the right to use the Platform within the scope defined by these Terms (non-exclusive, non-transferable license).
- Data and content entered into the Platform by the Service User remain their property.
§ 7a. Data Export
- The Service User has the right to request an export of their data (reports, projects, configuration) in a machine-readable format (e.g., JSON, CSV) at any time.
- Export requests should be submitted to contact@feedlo.pl. The Service Provider will fulfill the export within 14 days of receiving the request.
- The right to data export is available to the Service User both during the term of the agreement and within 30 days after its termination.
§ 8. Complaint Procedure
- The Service User has the right to file a complaint regarding the provision of electronic services.
- Complaints should be submitted electronically to: contact@feedlo.pl or in writing to the Service Provider's registered address.
- A complaint should include: data identifying the Service User, a description of the issue, and the expected resolution.
- The Service Provider shall process the complaint within 14 days of receipt and inform the Service User of the outcome.
- If the complaint is not resolved to the Consumer's satisfaction, the Consumer may use out-of-court dispute resolution methods, including:
- mediation conducted by the appropriate Provincial Trade Inspection Authority;
- the ODR (Online Dispute Resolution) platform at: https://ec.europa.eu/consumers/odr.
§ 9. Final Provisions of Part A
- In matters not regulated by these Terms, the provisions of Polish law shall apply, in particular the Civil Code, the Electronic Services Act, the Consumer Rights Act, and the GDPR.
- The Service Provider reserves the right to amend these Terms. Service Users will be notified electronically of changes at least 14 days in advance.
- If any provision of these Terms is found to be invalid, the remaining provisions shall remain in force.
- The court having jurisdiction over disputes with Service Users who are not Consumers shall be the court appropriate for the Service Provider's registered office. This provision does not affect Consumer rights arising from mandatory provisions of law, including Article 18 of Regulation (EU) No 1215/2012 of the European Parliament and of the Council (Brussels I bis) and the relevant provisions of the Polish Code of Civil Procedure.
Prepared in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
§ 10. Data Controller
The controller of your personal data is Piotr Włodarczyk, conducting sole proprietorship under the name "Piotr Włodarczyk", Tax ID (NIP) 8381704913, Statistical ID (REGON) 015343518, ul. Ludwika Pasteura 6A lok. 33, 02-093 Warszawa.
Contact the Controller:
§ 11. Roles: Data Controller and Processor
Depending on the processing context, Feedlo acts in the following roles:
- Data Controller – with regard to personal data of Clients (Platform Service Users), i.e., data provided during registration, billing data, and data related to Account usage.
- Data Processor – with regard to personal data of End Users, collected through the Widget installed on Clients' websites. In this case, the Client is the Data Controller, and Feedlo processes data on their behalf and in accordance with their instructions, based on the Data Processing Agreement constituting Part C of this document (Article 28 GDPR).
The further provisions of this Part apply to situations where Feedlo acts as a data controller, unless expressly stated otherwise.
§ 12. Purposes and Legal Bases for Processing
12.1. Visiting the Platform
Each time you visit the Platform, we process your IP address, date and time of the visit, browser type, and operating system. The IP address constitutes personal data within the meaning of CJEU case law (Case C-582/14, Breyer).
This data is processed:
- under Article 6(1)(a) GDPR – for purposes specified in the consent given;
- under Article 6(1)(b) GDPR – for the purpose of providing electronic services;
- under Article 6(1)(f) GDPR – for purposes arising from the Controller's legitimate interests (security, analytics, fraud detection).
12.2. Registration and Account Usage
During registration, we require an email address and password. Providing this data is a contractual requirement necessary to create an Account (Article 13(2)(e) GDPR). Failure to provide this data prevents registration.
Registration is also possible via a Google account (OAuth). In such case, we receive the email address, display name, and profile picture.
12.3. Data Collected by the Widget
Through the Widget, Feedlo may process the following categories of End User data on behalf of the Client:
- screenshots – screen captures that may contain visible personal data;
- session recordings – recordings of interactions with the website;
- browser console logs – diagnostic data;
- browser data – type, version, operating system, resolution, language;
- page URL of the report;
- email address – if voluntarily provided;
- report content – text description or voice recording.
Voice recordings are processed solely as report content (speech-to-text transcription). Voice recordings are not used for biometric identification and do not constitute biometric data within the meaning of Article 9 GDPR. Recordings are stored solely for the purpose of documenting the report.
Note on special categories of data: The Feedlo Platform is not intended for processing special categories of personal data within the meaning of Article 9 GDPR (health data, sexual orientation, religious beliefs, biometric data, genetic data, etc.). Screenshots and session recordings may inadvertently contain such data – the responsibility for implementing sensitive data masking mechanisms rests with the Client as the data controller of End Users.
The responsibility for ensuring a legal basis for processing End User data rests with the Client as their data controller.
12.4. Third-Party Integrations
The Client may configure integrations with Jira, GitHub, Asana, or Telegram. Report data may be synchronized with these systems. The Feedlo Controller is not responsible for data processing by the operators of these systems.
12.5. Marketing
The Controller may process data for direct marketing purposes only with prior express consent. You have the right to object at any time to processing for marketing purposes, without having to provide a reason (Article 21(2) GDPR).
§ 13. Data Retention Periods
- Account data – for the duration of the Account's existence. After Account deletion, data is deleted promptly, except for data necessary to fulfill legal obligations.
- Report data – for the duration of the project, then for 3 years (statute of limitations for claims, Article 118 of the Polish Civil Code).
- Billing data – 5 years from the end of the year in which the tax payment deadline fell (Polish Tax Ordinance).
- Data based on consent – until consent is withdrawn.
- Data based on legitimate interest – until a successful objection is raised.
- Server logs – 90 days from the date of recording.
§ 14. Data Recipients (Article 13(1)(e) GDPR)
- Cloud infrastructure providers – Supabase Inc., Amazon Web Services.
- Authentication service providers – Google LLC (OAuth).
- Email service providers – Resend Inc.
- AI service providers – Google LLC, OpenAI Inc.
- Analytics service providers.
- Integrated system operators – Atlassian (Jira), GitHub Inc., Asana Inc., Telegram FZ-LLC.
- Cooperating entities – legal services, postal services.
- Entities authorized by law – state authorities.
§ 15. Data Transfers Outside the EEA (Article 13(1)(f) GDPR)
Data may be transferred outside the EEA (USA) based on:
- Standard Contractual Clauses (SCCs) – Decision 2021/914 (Article 46(2)(c) GDPR).
- EU-U.S. Data Privacy Framework – adequacy decision of 10 July 2023.
§ 16. User Rights
You have the following rights:
- right of access to data (Article 15 GDPR);
- right to rectification (Article 16 GDPR);
- right to erasure – "right to be forgotten" (Article 17 GDPR);
- right to restriction of processing (Article 18 GDPR);
- right to data portability (Article 20 GDPR);
- right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw (Article 77 GDPR);
- right to object (Article 21 GDPR);
- right to withdraw consent at any time (Article 7(3) GDPR). Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
Requests may be submitted to contact@feedlo.pl or in writing. The Controller will respond within 30 days (Article 12(3) GDPR), with the possibility of a 2-month extension.
§ 17. Automated Processing and Profiling
The Platform uses AI mechanisms for categorization, prioritization, and analysis of reports. These mechanisms operate as assistive tools and do not make decisions producing legal effects or significantly affecting individuals within the meaning of Article 22(1) GDPR. Final decisions are made by humans.
§ 18. Technical and Organizational Measures
The Controller implements measures appropriate to the risk (Article 32 GDPR), including:
- SSL/TLS connection encryption;
- password hashing;
- access control mechanisms (Row-Level Security);
- regular security reviews and updates.
§ 18a. Personal Data Breach Notification
- In the event of a personal data breach affecting Clients (natural persons) that is likely to result in a high risk to the rights and freedoms of natural persons, the Controller will notify the affected persons without undue delay, in accordance with Article 34 GDPR.
- The notification will include at least:
- a description of the nature of the breach;
- the Controller's contact details;
- a description of the likely consequences of the breach;
- a description of the measures taken or proposed to address the breach.
- Regardless of the above, the Controller will report the breach to the President of the Polish Personal Data Protection Office within 72 hours of becoming aware of it, where the breach is likely to result in a risk to the rights and freedoms of natural persons (Article 33 GDPR).
§ 19. External Links
The Platform may contain links to websites operated by other controllers. These websites operate independently and are not supervised by the Controller.
§ 20. Cookies and Local Data Storage
The Platform uses:
- Essential cookies and local data – for the proper functioning of the Platform (login session, authentication token).
- Functional local data – user preferences (theme, language), stored in localStorage.
- Analytical cookies – information about visits and traffic sources.
Essential cookies do not require consent (Article 173(3) of the Polish Telecommunications Law). Consent is required for analytical cookies.
Prepared in accordance with Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). This Part constitutes an integral part of the Terms of Service and is concluded upon acceptance of the Terms by the Client.
§ 21. Parties and Subject Matter
- Data Processor: Piotr Włodarczyk, conducting business under the name "Piotr Włodarczyk", Tax ID (NIP) 8381704913, Statistical ID (REGON) 015343518, ul. Ludwika Pasteura 6A lok. 33, 02-093 Warszawa.
- Data Controller: The Client (Service User) using the Feedlo Platform, who installs the Widget on their website and entrusts the Processor with the processing of End Users' personal data.
- The Processor shall process personal data solely on behalf of the Controller and in accordance with their documented instructions, to the extent necessary for the provision of services described in Part A of this document.
§ 22. Nature, Purpose, and Duration of Processing
- Nature of processing: collection, storage, organization, disclosure, and deletion of personal data in the course of providing Platform services.
- Purpose of processing: handling reports (bug reports, feature requests, improvements) submitted by End Users through the Widget, including their categorization, prioritization, AI-assisted analysis, and synchronization with third-party systems configured by the Controller.
- Duration: processing continues for the duration of the service agreement (i.e., for as long as the Controller's Account exists in the Platform).
§ 23. Types of Data and Categories of Data Subjects
- Types of personal data:
- email address (if provided by the End User);
- IP address;
- browser data (type, version, language, resolution, operating system);
- page URL;
- screenshots – which may contain visible personal data;
- session recordings – interactions with the website;
- browser console logs;
- report content (text, voice recording);
- name or pseudonym (if provided).
- Categories of data subjects: End Users – natural persons using the Controller's (Client's) websites on which the Widget is installed.
§ 24. Processor's Obligations
The Processor undertakes to:
- process personal data only on documented instructions from the Controller, unless processing is required by EU or Polish law (Article 28(3)(a) GDPR). In such case, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such disclosure;
- ensure that persons authorized to process personal data have committed themselves to confidentiality (Article 28(3)(b) GDPR);
- implement appropriate technical and organizational measures to ensure the security of processing (Article 32 GDPR), including:
- encryption of data in transit (SSL/TLS) and at rest;
- access control mechanisms (Row-Level Security);
- password hashing;
- regular security reviews;
- assist the Controller in fulfilling obligations under Articles 32–36 GDPR (security, breach notification, impact assessments) – to the extent possible, taking into account the nature of processing;
- assist the Controller in responding to data subject rights requests (Articles 15–22 GDPR), through appropriate technical and organizational measures;
- notify the Controller without delay (no later than within 48 hours) of any personal data breach (Article 33(2) GDPR);
- make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR obligations and allow for and contribute to audits (Article 28(3)(h) GDPR).
§ 25. Sub-processing
- The Controller grants the Processor general authorization to engage further processors (sub-processors) within the meaning of Article 28(2) GDPR.
- As of the effective date of this document, the Processor uses the following sub-processors:
- Supabase Inc. (USA) – cloud infrastructure, database, authentication;
- Amazon Web Services (USA) – hosting and data storage;
- Google LLC (USA) – AI models (Gemini), OAuth authentication;
- OpenAI Inc. (USA) – AI models (GPT);
- Resend Inc. (USA) – email delivery.
- The Processor shall inform the Controller of the intention to add or change a sub-processor with at least 14 days' notice, enabling the Controller to raise an objection.
- In the event of a justified objection by the Controller, the Processor shall not entrust data to the new sub-processor or shall enable the Controller to terminate the agreement.
- The Processor shall enter into an agreement with each sub-processor imposing data protection obligations no less stringent than those set out in this Part C.
§ 26. Data Transfers Outside the EEA
The sub-processors listed in § 25 are headquartered in the USA. Data transfers are carried out on the basis of Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework, in accordance with § 15 of this document.
§ 27. Audit
- The Controller has the right to conduct audits of the Processor's compliance with this Data Processing Agreement, subject to prior arrangement of the date with at least 30 days' notice.
- The audit may be conducted by the Controller or an authorized external auditor, provided that the confidentiality of information obtained during the audit is maintained.
- The Processor shall provide the necessary information and cooperate in the conduct of the audit.
§ 28. Post-Processing Procedures
- Upon termination of the service agreement (i.e., after deletion of the Controller's Account), the Processor shall, at the Controller's discretion:
- delete all personal data processed on behalf of the Controller; or
- return the data to the Controller in a readable format (e.g., JSON, CSV) – upon request made before Account deletion.
- Data deletion shall take place promptly, no later than within 30 days of the termination of the agreement, unless EU or Polish law requires further data retention.
- The Processor shall confirm data deletion upon the Controller's request.
§ 29. Liability
- The Processor shall be liable for damages caused by processing only where it has not complied with obligations under the GDPR specifically directed at processors, or where it has acted outside of or contrary to the lawful instructions of the Controller (Article 82(2) GDPR).
- Each party shall promptly inform the other party of any claims or complaints relating to data processing covered by this Data Processing Agreement.
§ 30. Final Provisions of the Data Processing Agreement
- This Data Processing Agreement constitutes an integral part of the Feedlo Terms of Service and takes effect upon acceptance of the Terms by the Client.
- Any amendments to this Data Processing Agreement require documentary form (including by electronic means).
- In matters not regulated by this Data Processing Agreement, the provisions of the GDPR and Polish law shall apply.
- In the event of a conflict between the Data Processing Agreement and the remaining provisions of the Terms, the provisions of the Data Processing Agreement shall prevail with respect to personal data protection.
Effective date: March 15, 2026
Last updated: March 2026
Data deletion: /data-deletion