A. What We Collect

• Account Information: When you sign up via Google or GitHub OAuth, we collect your email address, name, and profile avatar.
• Billing Information: Payments are processed by our Merchant of Record, Polar. We do not store your credit card details or payment instruments. We only retain transaction status and subscription tier information.
• Usage Data: We use analytics to understand how you navigate our dashboard to improve the product.

B. How We Use This Data

• To provide access to the Reflekt dashboard and services.
• To communicate with you regarding your account, updates, or support.
• To bill you for paid subscriptions.

C. Legal Basis

• Contractual Necessity: To provide the services you signed up for, including account management, billing, and support.
• Legal Obligation: For tax, accounting, and regulatory compliance purposes.
• Legitimate Interest: For product analytics (via PostHog) to understand how you use our dashboard and improve the product. We balance our interest in improving our services against your privacy rights by minimizing data collection and using privacy-focused analytics.
• Consent: For marketing communications (e.g., product updates, newsletters). You can opt out at any time via the unsubscribe link in our emails or by contacting us.

D. Retention

We keep your data as long as your account is active. You may delete your account at any time via the settings, which will erase your personal data from our active systems.

A. How We Process Data

We provide the infrastructure (SDKs and APIs) for Customers to collect feedback. We process this data strictly according to the Customer's instructions.

B. Data Types

• Responses: The answers provided by end-users in surveys, feedback boards, or forms.
• Respondent ID: An identifier provided by the Customer (Developer) to associate responses with a user. We strongly recommend Customers provide pseudonymous identifiers (e.g., hashed user IDs) and avoid directly identifying data (such as email addresses) unless strictly necessary for their use case.
• Metadata: Technical details required to display the correct content, including:
  • Operating System (e.g., Android/iOS/Web)
  • App or Browser Version
  • Timestamps (e.g., shown, dismissed, or completed)

C. Local Storage (SDK Specifics)

The Reflekt SDK uses local storage on the end-user's device.

• Purpose: To prevent spamming users with the same content and to cache definitions for offline performance.
• Security: This data is unencrypted on the device but is generally sandboxed by the mobile OS or browser.
• Retention: Cache generally refreshes every 24 hours and is typically cleared when the app is uninstalled or browser data is cleared.

D. Data Control & Retention

The Customer (Developer) controls this data. They can delete individual responses or entire datasets via the Reflekt dashboard. If a Customer deletes their Reflekt account, all associated End-User data is purged.

Retention: We retain End-User data until the Customer account is deleted. We do not impose automatic deletion periods on survey responses — Customers are responsible for managing data retention in accordance with their own privacy policies and applicable laws.

Note to End-Users: If you wish to access, correct, or delete your data collected via Reflekt, please contact the App Developer directly. As a processor, we cannot fulfill these requests without the Controller's authorization.

E. SDK Permissions

The Reflekt SDK does not require access to sensitive device capabilities such as contacts, location, camera, microphone, or photo library. The SDK only collects the data explicitly passed by the Customer's application code and basic technical metadata as described above.

F. Data Processing Agreement

For Customers who require a Data Processing Agreement (DPA) to comply with GDPR or other data protection regulations, we offer a standard DPA upon request. Please contact us at noah@schenk.technology to request a copy.