Privacy policy

• We are the controller of the data of people who create an account and manage products (the team) and of visitors to featureloop.co.
• We are a processor of the data of our customers' end users, that is, people who suggest and vote on ideas at {slug}.featureloop.co. The controller is the customer who owns that page: see their privacy policy. That processing is governed by the Data processing agreement (DPA).

Contact for any privacy matter: [email protected].

• Account and team: your email, your products' details (name, URL, slug, language, color and settings) and the date and version of the terms and DPA you accepted.
• Panel session: a random token in the fl_session cookie, needed to keep you signed in, lasting at most 90 days.
• Security and usage: IP address and browser details in technical logs, and an audit log of the actions taken in the panel.
• Emails: a log of the emails sent (recipient, type and delivery status).
• Our customers' end users (as a processor): their email and, if they provide it, their name; the ideas they suggest and their votes; a random visitor identifier (fl_vid) and their session, kept in their browser's local storage; and, for anonymous votes, a hash of the IP computed with a rotating salt.

To prevent abuse we use Cloudflare Turnstile, which analyzes technical browser data to tell people from bots.

• Providing the service: creating and keeping your account, showing your public page and your panel, and sending the emails you need (sign-in links, confirmations, welcome, daily digest of new ideas and notices about your account). Basis: performance of the contract.
• Protecting the service: preventing abuse, fraud and unauthorized access. Basis: our legitimate interest.
• Meeting legal obligations that apply to us. Basis: legal obligation.

We do not sell personal data, we do not use it for advertising and we do not send you marketing without your consent.

We only use technical cookies and local storage: the panel session cookie (fl_session), the chosen language (NEXT_LOCALE, one year), the light or dark theme preference and, on public idea pages, the visitor identifier and session in local storage. We do not use analytics, advertising or third-party cookies.

• Account: while it is active. If you delete it, your user is deleted immediately along with your sessions and links.
• Deleted products: permanently deleted after 30 days.
• IP hash of anonymous votes: 90 days.
• Log of emails sent: 13 months.
• Audit log: 1 year.
• Sign-in links: expire after 15 minutes and are deleted 30 days after expiring.

We only share data with the providers we need to run the service:

• Cloudflare, Inc.: network, proxy and DNS in front of our servers, anti-abuse protection (Turnstile) and file storage (R2).
• Hetzner Online GmbH: servers (site, panel and API) and database, in the United States.
• Amazon Web Services, Inc. (Amazon SES): sending emails.

We may also disclose data to authorities when the law requires it.

FeatureLoop's servers and database are in the United States, and some providers may process data in other countries. If you use it from outside the United States, for example from the European Union, your data is transferred there. In those cases we use providers that offer appropriate safeguards, such as standard contractual clauses or other mechanisms recognized by the applicable data protection law.

You can ask to access, correct, delete or port your data, to restrict its processing or object to it by writing to [email protected]. From the panel you can also export a product's data as JSON and delete products or your account. If you believe we have mishandled your data, you can complain to the data protection authority in your country.

If you are an end user of one of our customers, contact that customer first, as they are the controller; if you write to us, we will pass your request on and help them handle it.

All traffic is encrypted (HTTPS). Session tokens and sign-in links are stored only as hashes, links are single-use, and each customer's data is isolated from the others. Access to production systems is restricted.

FeatureLoop is not directed at children under 16 and we do not knowingly collect their data.

We will publish any change here with its date. For material changes we will also tell you by email or in the panel.

Logical Design · [email protected].