1. Who we are
Inpiko ("we", "us") provides a feedback widget, AI-assisted grouping of feedback and a public roadmap. This policy covers two groups of people:
- Owners — people who create an Inpiko account and manage a project.
- Customers — people who submit feedback through an Inpiko widget embedded on an owner's website or product. Customers don't need an Inpiko account.
For feedback submitted through a widget, the owner of that project decides why the feedback is collected and how it is used; Inpiko processes it on their behalf. For owner accounts, Inpiko is the controller.
2. What we collect
From owners
- Name, email address and profile picture, directly or through Google sign-in. Passwords are stored hashed, never in plain text.
- Project details: name, widget settings, allowed domains, workflow stages and roadmap content
- Subscription status, plan and billing period (payment details are handled by Polar, not us)
From customers, through the widget
- The feedback text they submit
- Their email address, which they enter in the widget
- The URL of the page they submitted from
- Their browser's user agent string
- A salted, one-way hash of their IP address, used only to limit abuse. We don't store the raw IP address with the submission.
- The time of submission
The widget saves the customer's email in their browser's local storage so they don't have to retype it. It is not sent anywhere until they submit feedback, and clearing site data removes it.
Automatically, on our website and app
- Session data needed to keep owners signed in, including IP address and user agent
- A bot-check result from Cloudflare Turnstile when you sign up, which involves sharing your IP address and browser signals with Cloudflare
- Product analytics events and page views
- Error reports, to help us fix bugs
3. How we use it
- To store feedback and show it to the owner of the project it was submitted to
- To group similar feedback into requests and count how many customers asked for the same thing
- To display a public roadmap, limited to what the owner chooses to publish
- To run billing, send account emails (verification, password reset) and give support
- To detect spam and abuse, and to keep the service secure. This includes bot checks at sign-up and blocking disposable email addresses.
- To understand how the product is used and improve it
4. AI processing
To find similar or duplicate feedback, the text of a submission is sent to Google's Gemini API, which turns it into an embedding used to compare submissions. To write a request's title and summary, the text of a few submissions in that request is sent to Gemini as well. This runs in the background; submitting feedback never depends on it.
- AI only suggests groupings. The owner reviews, merges or separates them.
- We send the feedback text needed for grouping, not the customer's email address. We ask the AI not to include names, emails or other identifying details in titles and summaries, but it can make mistakes, so owners should review them before publishing.
- We store the resulting embeddings, titles, summaries and suggestions with your project.
- Some submissions may be saved without AI processing, for example when a trial or daily usage cap is reached.
- We don't use your feedback to train our own models. Google processes the text under its Gemini API terms.
5. What is public
The public roadmap shows, for each request the owner has left public, its title, summary (which may be AI-written or edited by the owner), the number of customers who asked for it, and its current stage. It never shows customer emails, individual submissions or internal notes. Owners can hide individual requests or turn the roadmap off. Don't put personal information in a public roadmap item.
6. Service providers
We share data only with providers that help us run Inpiko:
- Polar — subscription billing and payments
- PostHog — product analytics and error tracking. We don't send feedback content or customer emails to it.
- Brevo — transactional email such as verification and password reset
- Google — sign-in, if you choose "Continue with Google", and the Gemini API for feedback grouping, as described above
- Cloudflare — Turnstile bot protection at sign-up
- Hosting and database providers — to run the application and store data
Each provider handles data under its own terms and privacy policy. We may also disclose data when required by law.
8. Retention and deletion
- Owners can delete individual requests and submissions, or a whole project, at any time.
- Deleting a project permanently removes its submissions, requests and AI suggestions.
- Deleting your account (Account → Delete Account) permanently removes your profile, sessions and all of your projects and their data.
- If a trial or subscription ends, your data is kept so it's there if you subscribe again, until you delete it. While there is no active plan, the widget stops accepting feedback and the public roadmap is not shown.
- Billing records may be kept as long as law requires.
- Backups are overwritten on their normal cycle.
Customers: to access or delete feedback you submitted, email the owner of the site where you submitted it. You can also email us at [email protected] and we will pass your request on or act on it directly.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, and to object to or restrict some processing. Email us to exercise these rights. We'll reply within a reasonable time and may need to verify who you are first.
10. Security
Data is encrypted in transit. Access is restricted by project ownership, and public widget endpoints are rate limited and validated. No system is perfectly secure, so we can't guarantee absolute security, but we work to protect your data and will tell affected users if a breach puts their data at risk.
11. International transfers
Inpiko is operated from Malaysia and our providers may process data in other countries, including the United States. Where required, we rely on appropriate safeguards for those transfers.
12. Children
Inpiko is not directed at children under 13 and owners must be at least 13. If you believe a child has given us personal data, contact us and we'll remove it.
13. Changes
We may update this policy. The date at the top shows the latest revision, and we'll notify account holders by email about material changes.
Questions? Email [email protected].