Version: 27 September 2026. This addendum forms part of the feedba.cc Terms for customer personal data processed on your behalf. In this addendum, “we” means Nano Adventures LLC and “you” means the customer controlling that processing. Applicable data protection law prevails over a conflicting term.
Roles and scope
For content you collect through your workspace, you normally determine the purposes and means of processing and act as controller. We act as processor on your documented instructions; where you are yourself a processor, we act as your subprocessor. Separate account administration, billing, fraud prevention and legal obligations for which we determine the purpose are described in the Privacy Policy.
The subject matter is hosting and operating product feedback, roadmap, update and optional customer-directed AI workflows. Processing lasts for the service period and the limited return, deletion or lawful retention period. Operations include collection, storage, organisation, retrieval, transmission, access control, export and deletion.
Data subjects include your customers, contributors, personnel and invitees. Data may include account identifiers, names, email addresses, feedback text, comments, votes, attachments, subscription preferences and activity records. Do not submit special-category, criminal-offence or similarly restricted data without prior written agreement on appropriate safeguards.
Instructions and confidentiality
We process customer personal data only on your documented instructions, including the service configuration and authorised export, sharing, integration and deletion actions. If law requires other processing, we inform you beforehand unless prohibited. We tell you if we believe an instruction infringes applicable data protection law and pause the affected processing while it is resolved.
We limit access to people who need it for authorised work and who are bound by confidentiality. We do not sell customer personal data, use it for unrelated advertising or train a general-purpose model on it.
Security and assistance
We implement and maintain technical and organisational measures appropriate to the risk. Measures include authenticated access, server-side workspace authorisation, restricted private-file access, scoped and revocable AI grants, proportionate verification of destructive requests, and monitoring and recovery of failed deletion steps. These descriptions are not a certification or a guarantee that no incident can occur.
Taking account of the processing and information available to us, we assist with individual rights, security obligations, impact assessments and required consultation with regulators. We inform you without undue delay after becoming aware of a personal data breach affecting customer personal data, share available information in stages, cooperate with investigation and remediation, and do not delay notice merely because an investigation is incomplete.
If an individual contacts us about data you control, we help route the request and assist you rather than independently determining your lawful response. We may act directly where you have already instructed us through the service or where the law requires it. This does not obstruct an individual's rights in data we control ourselves.
Providers and international transfers
You give general written authorisation to use Base44 for application hosting, authentication, database, files and service email delivery. Its downstream providers are identified in its published Data Processing Addendum and subprocessor list. We remain responsible for our processor obligations and impose the required data protection obligations on subprocessors.
Stripe handles payments and related financial obligations under its own applicable terms and privacy arrangements. Your chosen AI provider receives only data you instruct us to send; its role and terms are separate from Base44's role as our hosting provider. We do not describe every third party as a subprocessor where it determines its own purposes.
Before adding or replacing a subprocessor for customer personal data, we provide notice, normally at least 30 days in advance, and an opportunity to object on reasonable data protection grounds. We work with you on an appropriate alternative or allow termination of the affected service with a refund for unused prepaid service if no reasonable solution is available. We do not expand the purposes of processing through a provider change.
Where a transfer requires a legal safeguard, we must establish the applicable mechanism, such as an adequacy decision or properly completed standard contractual clauses and any required supplementary measures, before relying on that transfer. This document is not a representation that data stays in any particular country, nor does it itself execute missing transfer clauses. Ask privacy@feedba.cc for the applicable arrangements.
Return, deletion and retained records
At the end of the service, you can choose return through export and request deletion. We delete existing copies unless applicable law requires retention. Return is not conditional on buying another subscription. Deletion status distinguishes active-system removal from outstanding provider work.
For backups that cannot immediately be selectively erased, we must keep the data beyond ordinary use, apply the relevant deletion schedule and prevent restoration into active use. We explain the actual arrangements instead of promising an unverified universal purge date.
A legal retention exception must have a specific purpose and limited scope. We protect retained information, restrict access and delete it when the applicable requirement ends. Account or billing records that we control independently are governed by the Privacy Policy and applicable law.
Accountability
We make available information reasonably necessary to demonstrate compliance with this addendum and allow and contribute to audits, including inspections, by you or your mandated auditor. We may agree reasonable arrangements to protect other customers' confidentiality, security and service continuity. These arrangements do not prevent a regulator's powers or a required audit.
No general limitation in another agreement reduces data-subject rights or obligations that cannot lawfully be limited. Contact privacy@feedba.cc for instructions, provider information, audits or concerns.