Redback FeedbackPrivacy policy
Redback Feedback is operated by Kieran Block Pty Ltd (ACN 101 376 587) in Australia. This policy explains what personal information we collect, why, where it is kept and what you can do about it. It is written against the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). We have tried to keep it in plain English.
Two kinds of people
The platform involves two groups, and we treat them differently.
- Account holders are the organisations that build feedback forms, and the people who sign in to manage them.
- Respondents are the people who click a feedback link or button and answer. They never need an account with us.
For respondent data we act as a processor on behalf of the organisation that owns the form. That organisation decides what to ask, who to ask, and how long to keep the answers. We store the answers and show them back to that organisation. We do not use respondent data for any purpose of our own.
What we collect from account holders
- Your name and email address, so you can sign in and so we can contact you about the service.
- The name of your organisation.
- The forms you create, their settings, and the API keys you issue. API keys are stored as a hash; we cannot read a key back once it is created.
- Technical logs of requests to the API and the MCP server (the route, the outcome and the timing, never the content of a request or a credential), kept for 30 days for security and troubleshooting.
If you ask for an invite through the form on our home page, we keep your organisation name, email address, your name if you give it, and your message, so we can reply.
What we collect from respondents
- The answers given to the form, including any comment typed into a free-text box.
- Any reference, agent or tag values the organisation attached to the link. These are chosen by the organisation and may identify the interaction, the staff member, or the respondent.
- The user agent and the language setting of the browser used to respond, and the time of the response.
We do not ask respondents for a name or an email address. An organisation may choose to ask for those in a question, in which case that organisation is responsible for telling respondents why.
Where it is stored
All data is stored and processed in Sydney, Australia, in the Amazon Web Services ap-southeast-2 region. Data is encrypted in transit and at rest. We do not disclose personal information to overseas recipients.
Who can see it
- Respondent answers and attribution values are visible to the organisation that owns the form: its signed-in users and anyone holding one of its API keys.
- Our own staff can access data only as needed to operate the service, investigate a fault or respond to a support request.
- We do not sell personal information. We do not share it with advertisers or data brokers. We do not use it to build profiles or to train anything.
- We may disclose information where the law requires it, and we will tell the organisation concerned unless we are legally prevented from doing so.
How we use it
Only to provide the service: to show organisations their results, to secure accounts and API keys, to keep the platform running, and to reply when you contact us. We send no marketing email. We never send email to respondents on an organisation's behalf; organisations share links through their own tools.
Cookies and tracking
This website sets no cookies and loads nothing from third parties. There is no analytics script. The dashboard stores only what it needs to keep you signed in. Feedback pages do not track respondents across sites.
How long we keep it
Responses are kept until the organisation that owns the form deletes them, deletes the form, or closes its account. Account holder details are kept while the account is open and removed when it is closed. Copies in operational backups are removed as those backups expire. Technical logs are kept only as long as they are useful for security and troubleshooting.
Access, correction and deletion
If you are a respondent and want to see, correct or delete something you submitted, contact the organisation that sent you the link. They can find and delete your response in the dashboard or over the API, and we will carry out their instruction. If you cannot work out which organisation that is, use the invite form on our home page to reach us, tell us what you can about the link, and we will help.
If you are an account holder, you can update your details and delete forms and responses yourself. To close your account or ask for everything we hold about you, use the invite form on our home page and we will respond within 30 days.
Security
We use encryption in transit and at rest, hash all API keys, limit who in our team can reach production, and keep access logs. No system is perfect. If we become aware of a data breach that is likely to cause serious harm, we will notify affected organisations and, where required, the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.
Complaints
If you think we have handled your personal information badly, tell us first through the invite form on our home page and we will look into it. If you are not satisfied with our answer, you can complain to the OAIC at oaic.gov.au.
Changes to this policy
We will update this page when our practices change and update the date at the top. Material changes will be flagged to account holders in the dashboard.