Privacy Policy
FlashFeedback helps businesses collect quick, private feedback from customers. This Privacy Policy explains what information we collect, how it’s used, and your rights under the UK GDPR and South Africa’s POPIA laws.
Information we collect: feedback ratings, optional comments or contact details, business account details, and limited technical data.
Use of information: to provide the service, improve performance, and contact users only if requested. We do not sell personal data. The optional sharing with Google for campaign measurement is described below.
Optional campaign measurement: if you select the separate checkbox during signup, we record the source, campaign and advertising click identifiers available on that page, then link them to your business's signup and later account activity. We do not recognise you across return visits. An unchecked box does not affect account creation. Browser delivery retries expire after 24 hours. Server journey and click identifiers are removed after 90 days by daily cleanup; business campaign dimensions remain for cohort reporting. Change your choice in Account Settings → Campaign measurement.
Google Ads signup measurement
Optional signup reporting. We use server-side Google Ads signup reporting for eligible new businesses. Only new signups with consent recorded under this disclosure covering Google sharing qualify; we do not upload historic signups under an older consent choice.
What is shared: if you arrive through a Google ad, choose optional campaign measurement and successfully create a genuine business account, we may send Google the advertising click identifier (GCLID), the signup completion time and an opaque conversion identifier, together with the Google Ads account and conversion-action identifiers needed to route the report. This lets Google associate the signup with the ad click and helps us measure which campaigns lead to completed signups. Internal and test businesses are excluded.
Limits: this signup report does not include customer or account-holder email addresses, names, phone numbers, feedback, postal addresses or IP addresses. We will not use Enhanced Conversions or use this integration to build remarketing audiences or request advertising personalisation. A click identifier can still relate to a person; omitting contact details does not make the report anonymous.
Google's use of information: Google receives the report and processes it under its applicable terms and privacy policies, including its own retention rules. See how Google uses information from sites and apps that use its services and Google's Privacy Policy. Our 90-day identifier cleanup does not control information already held by Google.
Your choice: signup remains available without campaign measurement. We respect Global Privacy Control and Do Not Track when collecting signup attribution. You can withdraw in Account Settings → Campaign measurement to remove your linked campaign information. Withdrawal also stops future and unsent signup reports. Withdrawal will not automatically remove a report already received by Google; contact contact@flashfeedback.co.uk for help with a data request.
Google account access for the reporting integration
Only the operator or an authorised administrator connects a Google account to manage FlashFeedback's own advertising measurement. Customers do not need to sign in with Google. When connected, the integration uses Google authorisation tokens to submit eligible signup reports and check their delivery diagnostics. Tokens and required account identifiers are held in protected server-side configuration; they are not placed in public code or customer-accessible pages. We do not use this integration to access Gmail, Google Drive or customers' Google account profiles.
The integration's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. To disconnect Google account access, the operator can revoke the integration in their Google Account connections and remove the stored server credentials. This administrator connection is separate from a business owner's campaign-measurement choice.
Reply requests: if you ask a business to reply, your email address is shared securely with that business’s authorised owners and Admins solely so they can respond to your feedback. Alert emails show only a masked address.
Legal basis: optional campaign measurement relies on your consent. Other service processing relies on the applicable contractual, legitimate-interest or consent basis under UK GDPR and POPIA.
Data storage: hosted securely on Supabase. Reply-request email addresses are erased 30 days after the request is resolved or 180 days after submission if it remains unresolved. Feedback may remain after the address is erased, and plan downgrades may hide older feedback without deleting it. Earlier deletion is available upon request.
Access: only the business owning the location can view feedback.
Your rights: access, correction, and deletion via contact@flashfeedback.co.uk.