Privacy Policy

Suggestra (“we”, “us”, or “our”) provides a hosted service that lets teams collect feedback directly on live websites. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By creating an account, using the Suggestra dashboard, embedding our widget on a website, or otherwise using the service, you agree to this policy.

Who this policy applies to

• Account holders — people who register for and manage a Suggestra account.
• Reviewers — people invited by an account holder to leave feedback on a website.
• Website visitors — people who browse a site where the Suggestra widget is installed. The widget is only interactive for signed-in reviewers; other visitors are not asked to submit personal data through the widget.

Information we collect

Account and profile information

When you register, we collect information such as your name, email address, and password (stored in hashed form). You may optionally upload a profile image.

Website and subscription information

If you use Suggestra as a customer, we store details about websites you add (such as site name and domain), embed configuration, invited reviewers, subscription plan, and billing-related identifiers provided by our payment processor.

Feedback content

When reviewers leave feedback, we store the comment text and related context needed to anchor feedback to a page, which may include:

• Page URL and path
• DOM selector, XPath, or text snippet for the pinned element
• Scroll position, viewport size, and pin coordinates
• Thread status and timestamps
• Optional viewport screenshots on eligible plans

Comments are linked to the reviewer’s account when they are signed in. API-created comments may include an author name and email supplied by the account holder.

Payment information

Paid subscriptions are processed by Stripe. We do not store full payment card numbers. Stripe provides us with information such as customer IDs, subscription status, and billing events needed to operate your account.

Technical and usage information

We collect information needed to operate and secure the service, such as session cookies, authentication logs, API requests, and standard server data (for example IP address and browser type) when you access the dashboard or our APIs.

Embed widget

The widget on your website communicates with Suggestra using a public embed key and checks that requests come from your configured domain. Reviewers must sign in to Suggestra in the same browser before they can view or leave feedback.

How we use information

We use the information we collect to:

• Provide, maintain, and improve the Suggestra service
• Authenticate users and enforce reviewer permissions
• Display feedback threads, comments, and screenshots to authorized users
• Process subscriptions and send service-related communications
• Send email verification and account notifications
• Monitor usage limits according to your plan
• Protect against abuse, fraud, and security incidents
• Comply with legal obligations

Legal bases (EEA, UK, and Switzerland)

Where applicable data protection law requires a legal basis, we rely on:

• Contract — to provide the service you signed up for
• Legitimate interests — to secure and improve the service, prevent abuse, and support customers
• Consent — where required, such as for optional marketing communications
• Legal obligation — where we must retain or disclose information by law

How we share information

We do not sell your personal information. We may share information with:

• Service providers — such as hosting, email delivery, payment processing (including Stripe), and bot protection on registration (Cloudflare Turnstile), only as needed to operate Suggestra
• Account collaborators — feedback and website data are visible to the account owner and reviewers they invite
• Business API users — account holders on eligible plans may access their data programmatically using their secret API key
• Legal and safety — when required by law or to protect rights, safety, and security
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to appropriate safeguards

International transfers

We may process information in countries other than where you live. Where required, we use appropriate safeguards for cross-border transfers.

Data retention

We retain account and feedback data for as long as your account is active or as needed to provide the service. You may delete websites and feedback from the dashboard. If you close your account, we will delete or anonymize personal data within a reasonable period, except where we must retain it for legal, security, or billing purposes.

Security

We use technical and organizational measures designed to protect personal information, including encrypted connections, access controls, and hashed passwords. No method of transmission or storage is completely secure.

Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal information, or to object to certain processing. You may also withdraw consent where processing is based on consent.

To exercise these rights, contact us at privacy@suggestra.dev. You may also have the right to lodge a complaint with your local data protection authority.

You can update profile information from your dashboard. Marketing emails, if we send them, will include an unsubscribe option.

Cookies

We use essential cookies and similar technologies to keep you signed in and to secure the service. The embed widget uses session-based authentication for reviewers. We do not use the widget to track general website visitors for advertising purposes.

Optional analytics cookies on our marketing site are provided by Google Analytics and are only set if you accept them in the cookie banner or via Cookie settings in the footer.

Children

Suggestra is not directed at children under 16, and we do not knowingly collect personal information from children.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the effective date. Material changes may also be communicated by email or through the dashboard.

Contact

Questions about this Privacy Policy or our data practices: privacy@suggestra.dev

See also our Terms of Service and Data Processing Agreement for business customers.