Privacy policy

Who is responsible

• For agency accounts (your name, email, billing and how you use the dashboard), Greatness Digital is the controller.
• For what reviewers put into the service (their name and email, comments, screenshots, files, voice notes, screen recordings), the agency is the controller and Greatness Digital is its processor. See the data processing terms. If you are a reviewer and have a question about your feedback, ask the agency that sent you the link.

What we collect

• Account: name, work email, agency name, a salted hash of your password (never the password), your teammates' names and emails.
• Billing: we keep your plan and billing period. If you pay by card (when we switch that on) the card is handled by Stripe and never reaches us; we keep only a Stripe customer reference.
• Feedback content: comments, the page address and the element clicked, a screenshot of the visible page, files, voice notes and screen recordings, the reviewer's name (and email if the agency entered it), browser and screen size, and time stamps.
• Technical: IP address and user agent, used for rate limiting and security, and for the sessions that keep reviewers and teammates signed in.

What we do not do

• We do not sell personal data, show advertising or use feedback content to train AI models.
• We do not email reviewers. The only emails we send are to agency users: sign-up confirmation, password reset, the “a client finished a review” summary, and notices about the account.
• The review widget sets nothing on a client's site for ordinary visitors. For a reviewer it keeps a session token in the browser's local storage so they stay signed in to their review link.
• The dashboard uses one essential cookie to keep you signed in. We use no analytics or advertising cookies.
• We count visits to our public pages (home, sign-up, these policies) with Vercel Web Analytics. It sets no cookies and stores no personal data, and it never runs in the dashboard or the review widget.

Why we use it

To run the service you asked for (contract), to keep it secure and prevent abuse (legitimate interests), to bill you and meet tax and legal duties (legal obligation), and to contact you about your account.

Recordings

Before a reviewer's first voice note or screen recording, the widget shows a notice saying who receives it and asking them not to say or show anything private, and we store when it was accepted. Reviewers can delete a recording before sending it. The microphone or screen is only used while they record, and they always see the browser's own indicator.

Health and other sensitive information

The service is not built for personal health information, and we do not sign business associate agreements. Agencies agree not to collect it through the service (see the acceptable use policy).

How long we keep it

• While your account is active, until you delete the content or the account.
• A site removed from the dashboard: 90 days, then deleted.
• An account whose trial ended without a plan: 60 days after the trial. An account whose subscription ended: 90 days after the paid period.
• A request for access that nobody approved: 30 days.
• Rate-limit counters: about a day. Billing records: as long as tax law requires.

Who it is shared with

Only the sub-processors that help us run the service (hosting, database, email, payments), and when the law requires it. Our hosts are in the United States. For transfers from the EU, UK or Switzerland we rely on Standard Contractual Clauses and, where available, the Data Privacy Framework.

Your rights

You can ask to see, correct, export or delete your personal data, to restrict or object to how we use it, and to complain to your data protection authority. Agency users can export and delete their data themselves in Settings. Email privacy@greatnessdigital.com for anything else. If a reviewer writes to us about their feedback, we will pass the request to the agency that controls it.

Changes

If we change this policy in a way that matters, we will tell account owners by email.