Data Processing Agreement (DPA) for BetterFeedback.ai
Last Update: December 9, 2025
This Data Processing Agreement ("DPA") is pre-signed by BetterFeedback.ai and available for download by customers who require documentation of our data protection practices for their compliance needs. No customer signature is required—simply download and retain for your records. This DPA supplements and forms part of the BetterFeedback.ai Master Subscription Agreement ("Agreement") between:
Awake Apps Rafał Muszyński ("Data Processor")
Address: ul. Mieczysława Piotrowskiego 15/230, 08-110 Siedlce, Poland
Contact: support@betterfeedback.ai
Address: ul. Mieczysława Piotrowskiego 15/230, 08-110 Siedlce, Poland
Contact: support@betterfeedback.ai
and
The Customer identified in the Agreement ("Data Controller")
Effective Date: Upon Customer's first use of the Service after the publication date of this DPA.
Definitions
All capitalized terms not defined herein shall have the meaning set forth in the Agreement. In this DPA:
- "Applicable Data Protection Law" means GDPR, CCPA, and any other applicable data protection laws.
- "GDPR" means Regulation (EU) 2016/679 (General Data Protection Regulation).
- "CCPA" means California Consumer Privacy Act of 2018.
- "Personal Data" means any information relating to an identified or identifiable natural person.
- "Processing" has the meaning given in the GDPR.
- "Security Incident" means any breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Personal Data.
- "Sub-processor" means any third party engaged by BetterFeedback.ai to Process Personal Data on behalf of the Customer.
Processing of Personal Data
2.1. Scope and Roles
- BetterFeedback.ai acts as Data Processor for Personal Data contained in the DATA collected, transcribed, or analyzed via the Service.
- Customer acts as Data Controller, determining the purposes and means of Processing.
- This DPA applies to all Processing of Personal Data by BetterFeedback.ai on behalf of Customer.
2.2. Processing Details (Appendix 1)
2.2.1. Categories of Data Subjects
- Customer's employees and contractors using BetterFeedback.ai.
- End-users, customers, or survey respondents providing feedback via the Service (e.g., text, voice, or survey data).
2.2.2. Types of Personal Data Processed
BetterFeedback.ai directly processes:
- Account registration data (names, email addresses, company information).
- IP addresses.
- Support communications and tickets.
- License validation and subscription status.
- Usage analytics (feature usage, consumption of Monthly Throughput/Annual Cap).
Client Input Data (DATA), which may include:
- Text Data: Survey responses, chat logs, and transcribed text.
- Audio Data: Voice recordings and audio files (High-Cost Input).
- Metadata: Timestamps, response duration, and geographical location (if collected by Client).
Nature and Purpose of Processing:
- Providing the feedback collection, transcription, and AI analysis Services.
- Hosting and delivering the collected DATA and resulting AI insights.
- Account management and authentication.
- Technical support and service improvement.
- Billing and subscription management.
Duration of Processing:
- For the term of the Agreement plus any retention period required by law or as instructed by the Customer.
- Client Input Data: Until Customer deletes the data via the application or requests deletion upon termination.
2.3. Current Sub-processors List
| Sub-processor | Location | Purpose | Data Processed |
|---|---|---|---|
| Hetzner GmbH | Germany | Hosting, Storage, and Infrastructure | All Client Input Data, Account Data |
| OVH | Poland | Hosting, Storage, and Infrastructure | All Client Input Data, Account Data |
| Deepgram (Audio transcription) | USA | Audio Transcription (High-Cost Input) | Audio Data, Metadata |
| Paddle (Payment processor) | UK/USA | Payment processing, billing, licensing | Order numbers, payment details, customer names, billing information |
| Postmark (Email service) | USA | Transactional email delivery | Email addresses, transactional notifications |
| Crisp Chat (Support chat) | EU | Support ticket management and communications | Support emails, customer communications |
| Cloudflare (CDN) | Global | Content delivery | Website traffic and content delivery |
| Linear (Project Management) | USA | Bug reports and feature requests | Bug reports and feature requests |
| Google Analytics (Analytics) | USA | Analytics | Website traffic and analytics |
| Sentry (Error Tracking) | USA | Error monitoring and crash reporting | Crash logs, error reports, IP addresses, user email (if user is logged in) |
| Vercel (Application Hosting/API) | USA | Frontend hosting and deployment, backend server | IP addresses, access logs, technical logs and metrics (app, website, server) |
| LiveKit (Real-time communication) | Global | Real-time communication | Chat logs, user metadata, IP addresses |
| MailerLite | USA | Email marketing | Email addresses, marketing campaigns |
New Sub-processors: BetterFeedback.ai will notify Customers of significant changes to Sub-processors via email, allowing the Customer ten (10) days to object on reasonable grounds related to data protection.
2.4. Customer Instructions
BetterFeedback.ai will Process Personal Data only in accordance with Customer's documented instructions, unless required by law to do otherwise. The Agreement, this DPA, and the current configuration settings within the Service constitute Customer's complete instructions.
Security Measures
3.1. Technical and Organizational Measures
BetterFeedback.ai implements and maintains appropriate measures including:
- Encryption: Encryption in transit (TLS 1.2+) and at rest (using industry-standard encryption algorithms).
- Access Control: Strict access controls and authentication mechanisms to internal systems, limited on a need-to-know basis.
- Audio Data Handling: Where audio/voice recordings are involved (High-Cost Input), secure transmission and temporary storage protocols are used to minimize retention duration during transcription.
- Personnel: Confidentiality agreements with personnel and regular data protection awareness training.
- Incident Response: Defined security incident response procedures and regular data protection reviews.
Specific Feature Note: Audio/Voice Input
Nature of Feature: The High-Cost Input feature allows for the collection and processing of voice/audio data for transcription and AI analysis.
Customer Responsibilities: The Customer acknowledges that the collection of voice/audio data may constitute a higher risk and requires specific consent or other legal bases from the Data Subjects (end-users) under Applicable Data Protection Law before collection. The Customer is solely responsible for ensuring the lawful basis for collecting, storing, and processing such data.
International Data Transfers
5.1. Transfer Mechanisms
For transfers outside the EEA/UK, BetterFeedback.ai ensures appropriate safeguards:
- Standard Contractual Clauses (SCCs) as required by the GDPR.
- Adequacy decisions where applicable.
5.2. Transfer Impact Assessment
A Transfer Impact Assessment (TIA) summary is available upon request for Enterprise customers.
Data Subject Rights
6.1. Assistance with Requests
BetterFeedback.ai will:
- Promptly notify Customer of any Data Subject request received.
- Assist Customer in responding to requests (access, deletion, portability, etc.), taking into account the nature of the Processing.
- Not respond directly to Data Subjects unless authorized by Customer.
6.2. Tools Available
Account holders can access, export, and delete their Data via the Service interface. Requests that cannot be handled via the Service tools will be managed through a formal support process.
Security Incidents
7.1. Notification
BetterFeedback.ai will notify Customer without undue delay and where feasible within 72 hours of becoming aware of a Security Incident. Notification will include available information about the incident required under GDPR Art. 33(3).
7.2. Cooperation
BetterFeedback.ai will:
- Investigate the Security Incident and take reasonable steps to mitigate its effects.
- Provide reasonable assistance to Customer in fulfilling Customer's Art. 33 and 34 notification obligations.
- Document all Security Incidents.
Compliance
8.1. Demonstrations of Compliance (Audit)
BetterFeedback.ai will provide the information necessary to demonstrate compliance with this DPA, in line with the terms outlined in Schedule No. 2 of the Master Subscription Agreement.
Data Retention and Deletion
9.1. Data Deletion
BetterFeedback.ai will delete Personal Data upon Customer's instruction via the Service or a support request.
9.2. Deletion Upon Termination
Upon termination, BetterFeedback.ai will:
- Delete or return all Personal Data at Customer's choice.
- Provide confirmation of deletion upon request.
- Exception: Retention required by applicable law.
Liability and Indemnification
10.1. Liability Cap
As set forth in the Master Subscription Agreement between the parties (Section 8).
10.2. Indemnification
Each party will defend and indemnify the other against claims arising from its breach of this DPA.
California Privacy Rights (CCPA)
11.1. Additional Terms for California Personal Information
BetterFeedback.ai is a "Service Provider" as defined by CCPA and agrees to the following restrictions regarding California Personal Information:
- Will not sell California Personal Information.
- Will not retain, use, or disclose for any purpose other than providing the Services specified in the Agreement.
- Will provide reasonable assistance with Consumer requests.
General Provisions
12.1. Conflict
In case of conflict between this DPA and the Agreement, this DPA prevails for data protection matters.
12.2. Governing Law
As specified in the Agreement (Laws of Poland).
Agreement
This DPA is pre-executed by BetterFeedback.ai and becomes effective when Customer downloads it and commences use of the Service.
Awake Apps Rafał Muszyński
Rafał Muszyński, Owner
Customer Acknowledgment:
Customer's use of this DPA for their compliance needs constitutes acceptance of these terms. No additional signatures are required.
This DPA is available for download at: https://betterfeedback.ai/dpa
Appendix 1: Data Processing Description
For Customer Records:
| Subject Matter | Processing of Personal Data in connection with BetterFeedback.ai Services |
| Duration | As specified in Section 2.2 |
| Nature and Purpose | As specified in Section 2.2 |
| Categories of Data | As specified in Section 2.2 |
| Categories of Data Subjects | As specified in Section 2.2 |
| Customer Obligations | Ensure lawful basis for Processing, provide necessary notices to Data Subjects |
| Customer Rights | Instructions, data subject request assistance |