Data Processing Agreement
If you need a signed DPA before you can buy, email info@usefeedbackflow.com and we will send one. Here is the honest current position, so you can decide whether it works for your review before you spend time on it.
Where we are today
FeedbackFlow (usefeedbackflow.com) does not yet operate through a registered legal entity. That affects who counter-signs, and it is the first thing your counsel will ask, so we would rather you heard it here than three emails in. We can execute a DPA and the EU standard contractual clauses; we cannot pretend to be a GmbH.
What we will sign
- A data processing agreement covering us as processor and you as controller.
- EU standard contractual clauses for transfers outside the EEA. One of our subprocessors processes in the US, which is disclosed on the subprocessor page.
- Your own paper, if you would rather send it. We will read it and tell you what we cannot agree to.
What is already true without a signature
- Your feedback data is never used to train AI models, ours or anyone else’s.
- Personal data detected in feedback text is redacted before it reaches an AI provider.
- You can erase an individual requester’s data yourself, from your project settings, in under a minute.
- You can export everything, as JSON or CSV, without asking us.
- You can set a retention period, after which the text of old feedback is removed automatically.
Those are product features rather than promises, which means you can verify them instead of trusting them. That is the intended difference.
What we do not have
No SOC 2, no ISO 27001, no penetration-test report. The security page lists what is built and what is not. If your review requires an attestation, we are not the right vendor yet, and we would rather say so now than waste a quarter of your time.