Privacy Policy

1. Information we collect

Information you give us (account holders)

• Identity and contact details: your name and email address.
• Authentication data: we use secure passwordless sign-in (magic links) via Supabase. We never store or have access to a password for your account, nor to your email provider's password.
• Workspace details: workspace name, slug, branding, settings and any content you publish (roadmap items, changelog entries, surveys).
• Billing information: handled by our payment processor, Stripe. We store a customer and subscription reference and your plan, not full card numbers.
• Support and other communications you send us.

Information from end users and visitors

• Feedback content: feature requests, comments, reactions and survey answers submitted on a board.
• Votes and reactions.
• An email address, only where a workspace requires it to vote or where a visitor subscribes to updates on a request.
• An anonymous session identifier used to attribute votes and prevent duplicate voting.

Information collected automatically

• Log and usage data: pages viewed, actions taken and timestamps.
• Device and browser information.
• IP address, used for security, anti-spam and rate-limiting.
• Cookies and similar local identifiers (see section 4).

2. How we use personal data, and our legal bases

We use personal data for the following purposes. Where the GDPR applies, the legal basis for each purpose is shown in brackets.

• Provide, operate and maintain the Service and your workspaces (performance of a contract).
• Authenticate accounts, keep the Service secure and prevent spam, fraud and abuse, including rate-limiting by IP address (legitimate interests and legal obligation).
• Process payments and manage subscriptions (performance of a contract).
• Send transactional and closed-loop messages: magic links, status-change and release notifications, survey and account emails (performance of a contract and legitimate interests).
• Respond to your support requests (legitimate interests).
• Understand usage and improve and develop the Service (legitimate interests).
• Send product news or marketing where permitted; you can opt out at any time (consent or legitimate interests).
• Comply with legal obligations and enforce our Terms (legal obligation and legitimate interests).

3. Our role as a data processor

When your visitors submit feedback, votes, comments or survey answers to a workspace you own, that content ("Customer Data") is collected on your behalf. For Customer Data, you are the data controller and FeatBudy acts only as your data processor.

We process Customer Data solely to provide the Service and only on the documented instructions of the workspace owner, as set out in our Terms and our Data Processing Agreement (DPA), except where applicable law requires us to process it. We do not use Customer Data for our own purposes, and we do not sell it or share it for advertising.

Workspace owners are responsible for having a lawful basis for the data they collect and for informing their own visitors. In particular, workspace owners must not use surveys or feedback boards to collect special categories of personal data (such as data revealing health, ethnicity, religious or political beliefs, as defined in Article 9 GDPR) unless they have an appropriate legal basis and the necessary notices and safeguards in place.

A Data Processing Agreement and a current list of subprocessors are available on request at hello@featbudy.com.

4. Cookies and similar technologies

We use a small number of cookies and local identifiers, described below:

• Supabase authentication (sb-… cookies) — strictly necessary. Keeps you signed in and secures your session. Session cookies that expire when you sign out or the session ends.
• fb_active_ws — strictly necessary. Remembers which workspace is active in your dashboard. Persistent; expires after 12 months.
• fb_lang — functional / preference. Remembers your chosen language. Persistent; expires after 12 months.
• fb_sid_<workspace> — functional / anti-fraud. An anonymous session identifier set on public boards to attribute votes and prevent duplicate voting. Persistent; expires after 12 months.

We only use strictly necessary and functional cookies; we do not use advertising, cross-site tracking or third-party analytics cookies. Because of this, no cookie-consent banner is required in most jurisdictions. You can still control or delete cookies through your browser settings, but disabling essential cookies may break parts of the Service.

5. Analytics

We use Vercel Speed Insights to measure real-world page performance (such as Core Web Vitals). It is privacy-friendly: it does not set cookies, does not collect data that identifies you, and does not track you across other websites.

We do not use Google Analytics, advertising networks, session recording, or other third-party behavioural analytics.

6. How we share personal data

We do not sell your personal data. We share it only with the service providers (subprocessors) that help us run the Service, and only as needed:

• Supabase — database, authentication and file storage — supabase.com/privacy
• Vercel — application hosting, content delivery and performance monitoring (Speed Insights) — vercel.com/legal/privacy-policy
• Stripe — payment processing — stripe.com/privacy
• Resend — delivery of transactional and notification emails — resend.com/legal/privacy-policy
• Slack — only if a workspace owner connects a Slack workspace, to deliver notifications — slack.com/trust/privacy/privacy-policy

We may also disclose personal data to comply with applicable law, regulation or legal process, or to protect our rights, our users or the public.

7. International data transfers

The Service runs on infrastructure that may be located in the United States and other countries. Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

8. Data retention

We keep personal data only for as long as we need it. When we no longer need it, we delete it or irreversibly anonymise it. Specific periods are:

• Account and workspace data — kept while your account is active. When you close your account, we delete or anonymise the associated personal data within 30 days.
• Feedback, votes, comments and survey answers — kept until you or the workspace owner delete them, or until the workspace is deleted.
• Billing and invoice records — retained for up to 10 years to comply with French and EU tax and accounting obligations.
• Security, anti-spam and rate-limiting logs (including IP addresses) — retained for up to 12 months.
• Backups — deleted or anonymised data may persist in encrypted backups for up to 35 days before it is permanently overwritten.

Deleting your account permanently deletes your workspaces and their associated personal data, subject to the backup and legal-retention periods above. This action is irreversible.

9. Security

We protect personal data with appropriate technical and organisational measures, including encryption in transit and at rest, access controls and tenant isolation (row-level security). We keep security and access logs to detect and investigate incidents (see the retention periods above). No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. To exercise these rights, contact hello@featbudy.com. You also have the right to lodge a complaint with your local data protection authority (in France, the CNIL).

We do not sell or share personal data for cross-context behavioural advertising. If you are a California resident, you may exercise the rights available to you under the CCPA/CPRA by contacting us.

If your data was submitted to a workspace operated by one of our customers, please send access or deletion requests to that workspace owner; we will assist them as their processor.

11. Children's privacy

The Service is not directed to children and is not intended for anyone under 16 (or the minimum age required in your country). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Third-party links

Boards and pages may link to third-party sites and services we do not control. Their privacy practices are governed by their own policies, not this one.

13. Business transfers

If FeatBudy is involved in a merger, acquisition, reorganisation, financing or sale of all or part of its assets, personal data may be transferred as part of that transaction. Your personal data will remain protected under this Privacy Policy until a replacement policy is published, and we will notify affected account holders of any change of control that materially affects how their personal data is handled.

14. Changes to this Policy

We may update this Policy from time to time. We will post the new version here with an updated date and, for material changes, notify account holders by email or in-app. Continued use of the Service after changes take effect means you accept the updated Policy.

15. Contact us

FeatBudy is operated by Hicham Elbaamrani, a sole proprietor based in France. For any question or request about this Policy or your personal data, contact us at hello@featbudy.com. A postal contact address is available on request.

We are not required to appoint a Data Protection Officer and have not done so; privacy questions and requests can be sent to the same address.