Privacy Policy

1. About FeedbackDesk

FeedbackDesk is the customer feedback and review management service at getfeedbackdesk.com. In this policy, “FeedbackDesk,” “we,” and “our” refer to the provider of that service. This policy explains how information is handled when you visit our website, use an owner or administrator account, submit customer feedback, or connect a Google Business Profile.

Businesses use FeedbackDesk to manage feedback about their own locations. The business receiving your feedback is responsible for its own use of that information. FeedbackDesk provides the technology and processes business feedback to deliver the service. Google independently handles activity on its own services under Google’s Privacy Policy.

2. Information we handle

• Account information: owner and administrator names, email addresses, Firebase user identifiers, account status, roles, assigned businesses and stores, and authentication/session information. Firebase Authentication securely handles passwords. FeedbackDesk does not store plaintext passwords in its application database.
• Business and store information: business and branch names, identifiers, addresses or phone numbers when supplied, Google review destination links, account status, owner assignments, subscription plan/status and dates, and administrative activity records.
• Private customer feedback: ratings, written comments, store identifiers, submission times, feedback identifiers, and review-handling status. The QR feedback form does not require a customer account or a name/email address. Information you choose to include in a comment is part of the submission.
• Google Business Profile information: authorized business account and location identifiers and details, location names and addresses, public reviews, reviewer information supplied by Google, ratings, comments, timestamps, and related review or location metadata. We also process OAuth credentials and the connection information described below.
• Technical and support information: information you send in support requests and operational information needed to deliver and secure the service, such as request times, error/status information, account or record identifiers in diagnostic logs, and network/browser information processed by our hosting and authentication providers.

3. How information is used

We use information to authenticate users, enforce business and store permissions, collect and display customer feedback, retrieve authorized Google reviews, calculate dashboard ratings and trends, manage business accounts and subscriptions, troubleshoot problems, respond to requests, and protect the service from misuse.

Private feedback and Google reviews are identified separately. A QR rating followed by a link to Google is a recorded handoff, not confirmation that a public Google review was posted. We do not automatically publish a private comment as a Google review.

4. Google access and Limited Use

FeedbackDesk accesses Google Business Profile data only after a user explicitly authorizes that access through Google OAuth. The connecting user must have access to the relevant business profile and selects the Google location to associate with a FeedbackDesk store.

We request Google’s Business Profile permission, https://www.googleapis.com/auth/business.manage, to retrieve the authorized business’s accounts, locations, and reviews. The current integration reads this information; it does not edit business listings, submit reviews, or post review replies. Connecting Google does not replace the existing FeedbackDesk email/password sign-in.

Retrieved reviews are used to provide the connected store’s review lists, date and source filters, ratings, and dashboard charts. Owners assigned to that business/store can see the connected store’s reviews. Google data is not made available to unrelated businesses through the owner dashboard.

OAuth credentials that are persisted are encrypted server-side. Refresh credentials are kept in the server database so FeedbackDesk can obtain access tokens to retrieve reviews without asking for authorization on every visit. Credentials are not exposed in the owner interface or stored as plaintext in browser storage.

FeedbackDesk does not sell Google user data. We do not use Google user data for advertising, data brokerage, or training generalized artificial intelligence models. FeedbackDesk’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Any permitted sharing is limited to providing and protecting the service as described in this policy.

5. Who can access information

Authorized owners can access feedback and review information for their assigned stores. FeedbackDesk administrators manage accounts, businesses, permissions, and subscriptions. Service operators may access information when necessary to operate, secure, or support the service.

We use service providers to deliver the application, including Google/Firebase for authentication and permission records, and Sites/Cloudflare infrastructure for hosting and application storage. They process information as needed to provide their services. Google receives OAuth and API requests when a Google connection is used. Information may also be disclosed when required by law or when necessary to address fraud, security incidents, or threats to rights and safety.

Private feedback is shared with the business to which it was submitted and is not displayed as a public Google review by FeedbackDesk. Your chosen business may handle it under its own privacy practices. We do not sell personal information.

6. Storage, retention and security

Account identities are held in Firebase Authentication. Business, store, owner permission, subscription, and administrative records are held in Firestore. Store configuration, private feedback, and encrypted Google connection credentials are held in the application’s server-side database.

Business, account, and private-feedback records remain stored while needed to provide the service and until deletion is arranged, subject to legitimate security, dispute-resolution, and legal needs. There is no automatic deletion merely because an owner or store is disabled, a subscription status changes, or Google is disconnected.

The current Google integration does not permanently import review content into Firestore or the application database. It retrieves reviews on demand and uses disposable server-memory results that are eligible for reuse for up to five minutes. Account/location identifiers and the connection’s encrypted credentials are retained to maintain the authorized connection. Pending authorization records have a limited validity period and are cleaned up during later connection activity.

We use HTTPS, server-side authorization, business/store access checks, and encryption for persisted OAuth credentials. No service can guarantee absolute security. Information may be processed in countries where our service providers operate; we do not promise that data stays in a particular country.

7. Disconnecting Google

In the owner dashboard, open Settings → Google review integration → Manage connection, select the store, and choose Disconnect. This removes that store’s saved connection credential and stops further retrieval through that connection. A new authorization is required to reconnect.

You may also remove FeedbackDesk’s access from your Google Account connections. Revoking the Google authorization may affect other stores connected through the same Google account. Disconnecting does not delete public reviews from Google or delete private feedback already submitted to FeedbackDesk.

8. Your requests and choices

Contact FeedbackDesk using the details below to request access, correction, or deletion of your information, to raise a privacy concern, or to ask about your Google connection. Available rights and any exceptions depend on applicable law. We may need to verify your identity and authority before acting on a request.

If your request concerns private feedback about a specific business, include the store and approximate submission time. You can also contact that business directly. FeedbackDesk may need to coordinate with the business to locate and handle its records. We cannot delete or edit a review held by Google through this service; use Google’s own controls for that request.

Please avoid putting sensitive personal information, passwords, or information about other people into feedback comments.

9. Cookies and browser storage

FeedbackDesk uses authentication cookies and Firebase browser persistence to keep authorized owners and administrators signed in. A short-lived cookie is used to protect the Google authorization flow. Browser storage may also hold interface preferences. Blocking or clearing these technologies may sign you out or prevent account and connection features from working.

The current FeedbackDesk application does not include advertising trackers. Public legal pages do not require an account or a Google authorization.

10. Children and policy changes

FeedbackDesk is intended for business users and customers sharing business feedback; it is not directed at children. If you believe a child has provided personal information that should be removed, contact us.

We may update this policy as the service or its data practices change. The date at the top identifies the latest revision. Where required, we will provide additional notice or obtain consent before materially changing how information is used.

11. Contact FeedbackDesk

For privacy questions, information requests, Google access concerns, or product support, contact FeedbackDesk: