Privacy Policy

Feedforward ("Feedforward", "we", "us") is an anonymous institutional feedback platform operated from Spain. Our contact email is hello@feedforward.guru.

Feedforward operates as a data processor on behalf of the institutions (schools, universities, or organisations) that subscribe to the platform. The subscribing institution is the data controller for the personal data of its members: students, parents, and staff. This policy explains how Feedforward handles that data in the course of providing the service.

We collect only what is necessary to deliver the service:

• Account identifiers: Email addresses used to authenticate users via one-time login codes or Google OAuth. These are held for the duration of the account and used solely for authentication and service communications.
• Feedback submissions: Text content, category, and scope entered by members when raising a concern. Submissions are stored without any name or identifying label. They are anonymous by design.
• Interaction signals: Upvotes are recorded as a one-way HMAC hash of the user's identity and the submission ID. The hash cannot be reversed to recover the user's identity; it exists only to prevent duplicate votes.
• Server logs: Standard web server logs (IP address, browser, timestamp) retained for up to 30 days for security and debugging purposes.
• AI-generated digests: Submission text is passed to an AI model (Anthropic Claude) to generate anonymised summary reports for administrators. No personal identifiers are included in these prompts.

We do not sell data, serve advertising, or use data for any purpose outside the service.

For users in the European Economic Area, our lawful bases are:

• Contract (Art. 6(1)(b)): Processing email addresses and submissions is necessary to deliver the service the contracting institution has engaged us to provide.
• Legitimate interests (Art. 6(1)(f)): Server logs and HMAC vote hashing are retained to maintain platform security and integrity. These interests do not override your fundamental rights.
• Compliance with legal obligations (Art. 6(1)(c)): Where applicable law requires us to retain or disclose data.

Where Feedforward processes personal data of individuals located in Thailand on behalf of a Thai institution, we comply with the Thailand PDPA (B.E. 2562). As a data processor, we process such data only on the documented instructions of the controller (the institution), implement appropriate technical and organisational security measures, assist the controller in responding to data subject rights requests, and notify the controller without undue delay in the event of a personal data breach.

Data subjects in Thailand have the right to access, correct, delete, restrict processing of, and port their personal data, and to object to processing, subject to the conditions set out in the PDPA. These requests should be directed to the institution (controller) in the first instance.

Feedforward is operated from Spain and uses the following sub-processors, which may process data outside your country:

• Supabase: database hosting (EU region)
• Vercel: application hosting (global CDN)
• Resend: transactional email delivery
• Anthropic: AI processing for digest generation (United States)

For EEA users, transfers to third countries are governed by Standard Contractual Clauses or equivalent safeguards. For Thai users, cross-border transfers are subject to the safeguards required under PDPA Chapter 7.

Feedforward is an institutional platform deployed by schools and educational organisations. The contracting institution is responsible for obtaining any required parental or guardian consent before granting minors access to the platform, in accordance with applicable law (including Art. 8 GDPR and Spain's LOPDGDD, which sets the digital consent age at 14). Feedforward does not knowingly collect personal data from children under 14 without verified parental consent obtained by the institution.

We retain personal data for as long as the institution's account is active or as otherwise instructed by the institution. On contract termination, data is deleted within 90 days unless a longer retention period is required by law or agreed in writing. Server logs are deleted after 30 days.

Depending on your location, you may have the right to: access your personal data; correct inaccurate data; request erasure; restrict or object to processing; and receive a portable copy of your data. Because submissions are anonymous by design, we may be unable to link a submission to a specific individual without additional information you provide.

To exercise your rights, contact your institution (the data controller) or email us at hello@feedforward.guru. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (in Spain: Agencia Española de Protección de Datos, aepd.es; in Thailand: Office of the Personal Data Protection Committee, pdpc.or.th).

Feedforward uses a single HttpOnly signed session cookie strictly necessary to maintain your login session. This cookie is exempt from consent requirements under GDPR as it is essential to the service. We do not use analytics, advertising, or tracking cookies.

We apply technical and organisational measures including TLS encryption in transit, encrypted storage, deny-all row-level security on all database tables, HMAC-based anonymisation of voter identities, and access controls limited to authorised personnel.

We may update this policy. Material changes will be communicated via the platform or by email to the contracting institution at least 14 days before taking effect. Continued use of the service after that date constitutes acceptance of the updated policy.