Privacy Policy

Who we are

Controller: Suggestly, [Your company name and registered address].

Contact for privacy matters: privacy@suggestly.app.

Roles under GDPR

For your Suggestly account and billing, we act as the data controller.

When you publish a public board at /p/[slug], you are the controller for feedback submitted by your visitors. We process that content on your behalf as a processor to provide the hosting service. You must inform your users (e.g. in your own privacy notice) about how you handle their submissions.

Data we collect

We process the following categories of data:

• Account: email address, Clerk user ID, plan, Stripe customer and subscription IDs (via Clerk and Stripe).
• Projects: board name, slug, description, logo, brand color, feedback titles and descriptions, vote counts, status.
• Public visitors: hashed IP for vote deduplication (SHA-256 with a server secret; raw IP is not stored), aggregated daily pageview counts per board.
• Technical: rate-limit keys, cookies for language and UI preferences, cookie consent flag.
• Abuse reports: optional reporter email, reported slug, reason, and details you provide.

Purposes and legal bases

We rely on the following legal bases (GDPR Art. 6):

• Contract — providing the service, authentication, billing, support.
• Legitimate interests — security, abuse prevention, aggregated analytics, improving the product.
• Legal obligation — tax and accounting records where applicable.
• Consent — where required for non-essential cookies (see Cookie Policy).

Sub-processors

We use trusted providers to run the service. They process data only on our instructions:

• Clerk — authentication and account management.
• Stripe — subscription payments and invoicing.
• Neon (PostgreSQL) — application database.
• Vercel — application hosting.
• UploadThing — project logo storage (when configured).

Retention

Account and project data are kept while your account is active. After account deletion, we remove associated data from our database within 30 days, except where law requires longer retention (e.g. billing records via Stripe).

Hashed vote identifiers and rate-limit events are retained for abuse prevention; rate-limit logs are automatically deleted after 90 days.

Aggregated pageview statistics contain no personal identifiers.

Your rights

Depending on your location, you may have the right to access, rectify, erase, restrict, port, or object to processing, and to lodge a complaint with a supervisory authority.

Account holders can export their data and request account deletion in Dashboard → Settings. You can also contact us at privacy@suggestly.app.

International transfers

Sub-processors may process data in the United States or other countries. We rely on appropriate safeguards (e.g. Standard Contractual Clauses) offered by our providers.

Children

The service is not directed at children under 16. We do not knowingly collect their data.

Changes

We may update this policy. The “Last updated” date at the top reflects the latest version. Material changes will be communicated where required by law.