Last updated: 27 September 2026
Effective date: 21 September 2026
This Privacy Policy explains how feedba.cc, operated by Nano Adventures LLC ("we", "us" or "our"), handles personal information when you visit our website, use a hosted feedback portal, create an account, subscribe to a workspace, or use our connected-AI features. It covers visitors, workspace owners and teammates, and people submitting or following requests.
1. Who is responsible for your information?
Operator: Nano Adventures LLC
Privacy contact: privacy@feedba.cc
For account administration, our website, our own feedback portal, billing, security, and our service improvement activities, we decide why and how personal information is processed. Where applicable law uses these terms, we act as the controller or business.
When another business or individual operates a product workspace on feedba.cc, that workspace operator generally decides why requests are collected, which staff can use them, and whether to publish or share them with a connected AI tool. For that processing, we act on the workspace operator's instructions as a processor or service provider, as applicable. Their own privacy notice may also apply. They may themselves act for another organization.
For a request about content in a customer's workspace, contact its operator first. You can also contact us to help identify the responsible operator or route the request. We remain responsible for responding to requests about processing we control. A public feedback board is not the right place to post a privacy complaint or identity documents.
2. Information we collect and its sources
We collect information you provide, information provided by an authorized workspace operator or teammate, information returned by a service you choose to use, and technical information generated when the service operates.
Account and profile information. This includes your email address, name or display name, account identifier, authentication and account-status information, and profile image if supplied. Our authentication provider processes login credentials. We do not receive your Google password.
Workspace and contribution information. This includes product and workspace names, portal addresses, branding you upload or link, team roles and invitations, requests and their descriptions, categories, status and priority, votes, comments, follows, moderation decisions, attachments, release notes, and activity history. Content can contain personal information about you or others. An invitation may give us your email address before you create an account.
Subscription and payment information. Stripe collects payment information in its checkout and billing services. We receive and store customer and subscription identifiers, selected plan and price, payment and invoice status, billing dates, trial and cancellation information, and relevant transaction records. feedba.cc's application database does not store full card numbers or card security codes. Information entered directly into Stripe is also handled under Stripe's privacy notice.
AI connection information. This includes the authorizing account, workspace, connection name, registered client and return address, permissions, selected card identifiers, authorization and expiry records, token hashes, last-use timestamps, and records of actions performed. Permitted card content and discussion may be returned to the connected tool, and its proposed requests, notes, status changes, or draft updates may be stored in the workspace.
Preferences and communications. This includes language or display settings where available, time zone, notification frequency, product subscriptions, choices about updates to your own or followed requests, saved requests for future AI integrations, and correspondence with us. Selecting an integration you would like us to add does not subscribe you to marketing emails.
Technical and usage information. Our application and infrastructure providers process information such as IP addresses, browser and device information, request times, security and error logs, and information needed to deliver pages and authenticate requests. When you permit optional product analytics, our first-party events record page names, setup steps, selected feature actions, referral-campaign labels, session identifiers, and error codes. Signed-in events can be linked to account and workspace identifiers; they are not described as anonymous. Our optional analytics do not record session replay, keystrokes, form text, passwords, full card details, or complete URL query strings.
3. How and why we use information
We use personal information to operate accounts and workspaces; collect, display, moderate and organize contributions; deliver notifications you select; manage trials, subscriptions and payments; provide authorized AI connections; investigate faults and abuse; secure the service; answer privacy and service requests; understand and improve the product; and meet legal obligations or establish, exercise or defend legal claims.
Where the EU or UK GDPR applies to processing we control, the relevant legal bases are:
- Contract: information necessary to provide the account, subscription and features you request, or take steps you ask for before a contract.
- Legitimate interests: running and securing the service, preventing abuse, providing support, maintaining appropriate operational records, and administering business relationships, where those interests are not overridden by your rights. For example, this can apply to business contacts or invited teammates who are not personally party to our customer contract.
- Consent: optional browser analytics and other activities for which applicable law requires your consent. You can withdraw consent without affecting earlier lawful processing.
- Legal obligation: records and disclosures required by applicable tax, accounting, privacy or other laws.
For customer-controlled workspace content, the workspace operator determines the appropriate legal basis and provides any required notices. Permission granted by an administrator to an AI tool does not replace the operator's responsibility to have a lawful basis for sharing other people's information. In jurisdictions that require consent for additional activities, we obtain it or rely on a permitted legal exception.
You can browse public content without creating an account. An account is required to submit, vote, comment or follow. A workspace owner must supply the information necessary for a subscription. Optional attachments, AI connections and optional analytics are not required for the basic feedback workflow. Without necessary account, payment or authorization information, the corresponding feature may not work.
4. Public requests, private reports and workspace access
Public content is public. Approved public requests, comments, attachments, roadmap information and published updates can be viewed and copied by others. Public views normally show a shortened contributor name, but text, images and other content you provide may identify you. Do not assume shortened names make a contribution anonymous. Public pages may appear in search engines where indexing is enabled, and third parties may retain copies.
Private does not mean inaccessible to the service operator. A request explicitly marked private is restricted to its submitter and authorized workspace staff, with limited access by feedba.cc and its providers as needed to operate, secure and support the service. Approving that request does not automatically publish it. Staff may separately hide content. Access to attachments follows the parent request through permission checks and temporary file links.
Workspace administrators and moderators can access the information needed for their roles, which can include contributor contact details, submissions, activity and decisions not shown publicly. Private material can be shared with an AI tool only within an explicitly authorized private-content grant. Workspace operators must consider that sharing before enabling it.
Please do not submit passwords, API secrets, payment-card details, government identity documents, or unrelated sensitive personal information. Mark a security report private and remove unnecessary personal information. A private feedback form is not intended for regulated medical records or similarly sensitive record keeping.
5. Google sign-in
When you choose Google sign-in, Google provides the identity information authorized for login, such as your Google account identifier, email address, name and profile image. We use it to authenticate you, associate you with your feedba.cc account, display account information and help protect access.
Google sign-in does not give feedba.cc permission to read your Gmail, Drive files, calendar or contacts. We do not use Google login information to target advertisements or train general-purpose AI models. Our handling of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements where applicable.
Google also processes the sign-in under its own privacy policy. You may manage connected services in your Google Account. Disconnecting Google is not, by itself, a request to delete your feedba.cc account or its retained records.
6. Build prompts and connected AI tools
Manual build prompts. The build-prompt feature assembles the cards and discussion you select into text on the feedba.cc server. It does not make an additional language-model request to produce that text. When you copy or download a prompt and give it to an AI tool, that tool receives the material you provide. Review it for private information first.
AI Connect. An authorized workspace administrator can connect Base44's editor chat to permitted requests. The connection may read card content and discussion, create proposed requests, add progress notes, move approved cards, or prepare private release drafts, depending on the permissions granted. Private content is excluded unless specifically authorized. The AI cannot use this connection to manage billing or teammates, delete requests, make private content public, or publish release announcements.
The workspace operator chooses the tool and controls access. Its AI provider may process permitted content through its own model and infrastructure providers, including processing in other countries. Provider retention, model-improvement use, account settings and terms are separate from ours. We do not promise that a customer's AI provider offers zero retention or never uses submitted material for model improvement. Review that provider's terms before granting access or copying a prompt.
We do not operate a general-purpose model-training program using private workspace contributions. This does not override the terms of a service a customer independently uses. Authorized personnel and service providers may access information where necessary to maintain the service, investigate a fault or security issue, or handle a request; this is different from making content public.
Revoking a connection stops future authorized calls and token refreshes. It does not recall data already received by the AI provider, delete copies in its chat history, or reverse changes already committed. AI notes are attributed reports, not independent verification by feedba.cc that software changes were tested or deployed.
7. Who receives information
We disclose information only for the purposes described in this notice, including to the following categories of recipients:
Service providers. Base44 supplies application hosting, storage, authentication, backend functions and operational services, including the email-delivery integration. Stripe supplies payment and subscription processing. Their own service providers may support those functions. Providers handling information on our behalf are subject to applicable contractual data-protection requirements. Some providers also act independently for purposes such as payment fraud prevention or managing their own accounts.
Workspace operators and authorized participants. We make workspace information available according to the audience and permissions described above. Public content is available to the public; private content is not made public merely because an account exists.
Services a customer authorizes. These include Google for sign-in and Base44's AI tool when a workspace administrator connects it. Customer-selected AI services are distinct from the infrastructure we use to host feedba.cc.
Other necessary recipients. We may disclose relevant information to professional advisers, insurers, authorities or others where reasonably necessary to comply with law, respond to valid legal process, address security or fraud, or protect rights and safety. In a proposed or completed financing, merger, acquisition or transfer of our business, relevant information may be disclosed with appropriate confidentiality protections and any notices or choices required by law.
We do not sell personal information, rent contact lists, or share personal information for cross-context behavioral advertising. We do not place advertising pixels or operate targeted-advertising campaigns through the application. Disclosures to operate the service or at a user's direction are described above; they are not permission for unrelated advertising use.
Relevant provider information: Base44 privacy policy, Base44 data processing addendum and subprocessor information, Stripe privacy policy, and Google privacy policy.
8. Cookies, browser storage and privacy choices
We and our infrastructure providers use cookies or similar browser storage for sign-in, security, remembering the portal you opened, interface preferences and the choices described here. Necessary storage supports the service you request; blocking it can prevent sign-in or other functions. Preference storage may remain until you clear it or the relevant feature removes it.
Our optional first-party product analytics are off unless you allow them in Privacy choices. Analytics session and attribution identifiers are stored for the browser session when enabled. We retain your allow-or-decline preference locally for up to six months, after which you can choose again. You can change the choice at any time without paying or losing core features. Declining clears our optional analytics identifiers from that browser's storage; it does not delete necessary operational records or information already lawfully recorded.
Our optional analytics also remain off when we detect Global Privacy Control or Do Not Track. These controls do not disable authentication, payment, security, or the records needed to carry out a requested action. Browser choices apply to that browser and origin; another device or portal hostname may need its own setting. We do not load our optional analytics on authorization or privacy-policy screens.
This control covers the optional analytics implemented by feedba.cc, not storage independently used on Google's, Stripe's or a customer's AI provider's own websites. Our current application does not use third-party advertising trackers to follow you across unrelated sites. Providers can process technical information as described in their notices; we do not represent a browser preference as a guarantee that no infrastructure logging occurs.
9. Notifications and messages
You can choose immediate, daily, weekly or no product-update emails and adjust the relevant time zone. You can manage subscriptions to a product's published updates, updates to your own requests, and requests you follow. Account-wide opt-outs take precedence over product-specific settings. Use the account and product update-preference controls to change these choices.
Operational messages about account security, payments, legal matters or a request you send us are separate from optional product updates. Following a product, requesting another AI integration, or reading this policy does not enroll you in an unrelated marketing list. If we introduce marketing communications, we will provide the choices and unsubscribe mechanisms required by law.
10. Retention and deletion
Retention depends on the purpose and type of record rather than one period for everything. We consider whether an account or workspace is in use, customer instructions, an applicable deletion request, security and dispute needs, and legal record-keeping requirements.
Account and workspace content are normally retained while needed to provide the account and workspace, subject to applicable requests and obligations. Cancelling payment does not automatically delete an account, public contributions, attachments or activity history. Use Account → Your data, your control to export your personal records, export a workspace you own, leave a shared workspace, or request account/workspace deletion. Exports include JSON, CSV and available attachments and do not require an active paid subscription. Deletion uses an email confirmation code and an explicit confirmation, closes access, and proceeds through a recorded cleanup process. Workspace deletion also cancels its subscription. The status distinguishes active app records removed from outstanding provider storage or backup work; it does not claim instantaneous erasure. You can also email us to exercise your rights or request records not included in the self-service archive.
Billing and transaction records may be retained after cancellation for legally required accounting, tax, fraud-prevention or dispute purposes. Authorization permissions expire or can be revoked, but retained token hashes and audit records do not necessarily disappear at expiry. We may retain limited evidence of consent, revocation, a privacy request or a security event as necessary to demonstrate compliance and prevent repeated misuse.
We retain identifiable usage and support records only while needed for their stated purposes, then delete or de-identify them when no longer needed, subject to applicable legal holds. Where we keep genuinely de-identified information, we take reasonable steps to prevent it being linked back to an individual, maintain it in de-identified form and do not attempt to re-identify it except where permitted by law to test our safeguards. Backups and provider logs may expire on separate schedules rather than being erased immediately. Information restored from backup remains subject to applicable deletion requests. We do not promise a fixed backup-erasure period that the provider has not confirmed.
Deletion does not recall copies already published, downloaded, emailed, or transferred to a customer-selected AI service. You may need to contact that service or the responsible workspace operator about their copies. We may retain information where law permits or requires it and will explain relevant limitations when handling a request.
11. International processing
Our service and providers can process information outside the country where you live, including in the United States and other countries where they operate. Those countries may have different privacy laws. We do not promise EU-only, UK-only or other exclusive regional storage for the standard service.
Where an international transfer is regulated, applicable safeguards may include an adequacy decision, approved standard contractual clauses and relevant UK or Swiss adaptations, or another lawful mechanism appropriate to the recipient and transfer. Base44's data processing addendum describes its transfer arrangements. A provider's certification does not make feedba.cc itself certified. Contact us for information about the safeguards applicable to your information or an available copy, subject to appropriate redactions.
12. Your rights and how to use them
Depending on your location and the applicable law, you may have rights to obtain information about processing; access your information; correct inaccuracies; request deletion; receive a portable copy; restrict processing; object to processing, including processing based on legitimate interests or direct marketing; or withdraw consent. Rights can be subject to lawful exceptions and identity or authority checks.
Your right to object. Where applicable law gives you this right, you may object to processing based on our legitimate interests for reasons related to your particular situation. We will stop that processing unless the law permits us to continue, for example because of compelling overriding grounds or legal claims. You can object to direct marketing at any time; we will stop using your information for that purpose.
Send a request to privacy@feedba.cc. Include the account email or other information that helps identify the relevant records, the product workspace if applicable, and what you are asking us to do. Do not send passwords, payment-card details or unnecessary identity documents. We may seek proportionate additional information to verify a request or an authorized representative, and we will not require you to buy a plan or create a new account to exercise a privacy right.
For content controlled by a customer, we may refer the request to or assist that workspace operator. For information we control, we respond within the period required by the applicable law. EU and UK rights requests are generally due within one month, subject to permitted extensions and timing rules. Some US state requests have a 45-day period. We will explain an applicable extension or refusal and any available review or appeal route. We do not charge for requests unless the law permits it and we explain the basis.
Where US state privacy laws apply, relevant rights may include knowing the categories and specific information collected, correcting or deleting information, portability, limiting certain uses and disclosures of sensitive personal information, and opting out of sale, targeted advertising or qualifying profiling. We do not use personal information for sale or targeted advertising, or solely automated decisions with legal or similarly significant effects. We do not discriminate against you for exercising an applicable privacy right. An authorized agent may submit a request with appropriate proof of authority. To appeal a decision where the law provides an appeal right, reply to our response or email the privacy contact with the subject Privacy appeal.
Residents of Canada and other jurisdictions may have applicable access, correction, consent-withdrawal and complaint rights under their local law. Nothing in this notice limits a mandatory privacy right.
13. Privacy complaints
You may raise a privacy concern or complain about how a request was handled by contacting privacy@feedba.cc, using Privacy complaint as the subject if convenient. Explain the issue and the outcome you seek. We will acknowledge, investigate and communicate the outcome without undue delay. Where UK data-protection complaints requirements apply, we will acknowledge receipt within 30 days and keep you informed of progress. That acknowledgment period is separate from the deadline for responding to an access or deletion request.
You can also contact the competent privacy regulator, including a data-protection authority in the EEA, the UK Information Commissioner's Office, the Office of the Privacy Commissioner of Canada, or an applicable US state authority. You do not waive that right by contacting us first.
14. Security
We use safeguards designed to protect information, including authenticated access, workspace-specific permissions, controlled attachment links, and restricted and revocable AI permissions. Access is limited to authorized people and providers for legitimate purposes. No internet service, email or storage system is completely secure, and this notice is not a guarantee against every incident.
Keep your account secure, grant AI tools only the access they need, and avoid putting credentials into requests or prompts. Contact our privacy contact privately about a suspected data exposure rather than posting sensitive details on a public board. We will give incident notices when required by applicable law.
15. Children
feedba.cc is a product-development service and is not directed to children under 16. We do not knowingly collect their personal information for an account. Workspace operators should not use the service to solicit information from children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate steps. This statement does not claim that the application performs automated age verification.
16. Changes to this notice
We will update the date above when this notice changes. For material changes, we will provide notice appropriate to the change, such as a prominent website notice or account message, and obtain consent where required before a new use begins. Continuing to use the service is not treated as consent to a new purpose that legally requires a separate choice.
17. Contact
For privacy questions, rights requests, complaints or information about our data handling, contact Nano Adventures LLC by email at privacy@feedba.cc. The same privacy contact handles escalation requests; we do not imply that a separate data protection officer has been appointed.