FeedLetter

Privacy Notice

Last updated: November 12, 2026

This privacy notice explains which personal data FeedLetter processes, why, and what rights you have. It applies to the website feedletter.co, the app at app.feedletter.co, the survey and feedback pages, the widgets and the API.

1. Controller

Jens Boje
Pfungststr. 3
60314 Frankfurt am Main
Germany
Email: hello@feedletter.co

More details are in the imprint.

2. Two Roles: Controller and Processor

  • Controller: For visitors of feedletter.co, FeedLetter customers (account holders), newsletter subscribers and anyone who contacts me, I decide how data is processed. This notice describes that processing.
  • Processor: When readers or website visitors answer a survey, poll, feedback widget or rating that a FeedLetter customer created, I process those answers on behalf of that customer. The customer is the controller and is responsible for informing respondents. Section 9 describes what FeedLetter technically processes in this case.

3. Hosting and Server Logs

FeedLetter uses these hosting providers, who process data on my behalf (Art. 28 GDPR):

  • Netlify, Inc., USA, hosts the website feedletter.co, the app UI at app.feedletter.co and the contact form. Privacy policy
  • netcup GmbH, Karlsruhe, Germany, hosts the backend, the API, the database and the analytics software Matomo. Privacy policy

When you open a page, the servers automatically log technical data: the requested page or file, date and time, transferred data volume, status code, browser type and version, operating system, referrer URL and IP address. This is needed to deliver the pages and to keep the service secure.

Legal basis: Art. 6 (1) (f) GDPR. My legitimate interest is a secure and working service. Server logs are deleted after at most 7 days, unless a log entry is needed as evidence of an attack; then it is kept until the incident is resolved.

4. Website Analytics with Matomo

feedletter.co uses Matomo, an open-source analytics tool, to count visits and see which pages are useful. Matomo runs on my own server at netcup in Germany. The data is not shared with third parties.

  • IP addresses are anonymised before they are stored.
  • Matomo runs without cookies.
  • Matomo records browser type and version, operating system, country, date and time of the visit, pages viewed, time spent on a page and links clicked.

Legal basis: Art. 6 (1) (f) GDPR. My legitimate interest is understanding how the website is used to improve it. You can object at any time by emailing me, or block the tracking with your browser’s tracking protection or a content blocker. Analytics data is deleted after at most 6 months.

The FeedLetter app, the survey pages and the widgets do not use Matomo.

5. Contact by Email or Contact Form

When you email me or use the contact form, I process your email address, your name if you give it, and your message to answer you. Contact form submissions are stored by Netlify (see section 3) and forwarded to me by email.

Legal basis: Art. 6 (1) (b) GDPR if your message relates to a contract or a planned contract, otherwise Art. 6 (1) (f) GDPR, my legitimate interest in answering requests. I delete the messages when they are no longer needed, unless statutory retention periods apply.

6. FeedLetter Account

When you sign up and use FeedLetter, I process:

  • your email address and password (stored only as a hash),
  • account details such as your newsletter name and URL, how you found FeedLetter, team members and their roles,
  • the surveys, polls, Walls of Love and settings you create,
  • API keys you create (stored only as a hash) and the access tokens of email service providers you connect,
  • feedback you send about FeedLetter from inside the app.

The app keeps your login in your browser’s local storage. This is strictly necessary to keep you logged in (§ 25 (2) No. 2 TDDDG).

Legal basis: Art. 6 (1) (b) GDPR, to provide the service you signed up for. The data is kept until you delete your account, unless statutory retention periods apply (see section 12).

Emails from FeedLetter

FeedLetter sends emails about your account, such as sign-up confirmations, password resets and reminders. These emails are sent through the transactional email service of Scaleway SAS, Paris, France, which processes your email address and the email content on my behalf (Art. 28 GDPR). Privacy policy

Legal basis: Art. 6 (1) (b) GDPR.

Connected Email Service Providers

When you connect an email service provider, such as EmailOctopus, FeedLetter uses your access token to fetch statistics for your campaigns, for example the campaign ID, name, send date and open and click counts. Legal basis: Art. 6 (1) (b) GDPR. The data is deleted when you remove the connection or delete your account.

API Requests

For each request to the FeedLetter API, I log the date and time, the API key used, the requested endpoint, the status, the duration, the user agent and the IP address. This is needed for rate limiting, support and abuse prevention. Legal basis: Art. 6 (1) (f) GDPR. The log entries are deleted after 30 days.

7. Payments with Paddle

Paid plans are sold through Paddle.com Market Limited, United Kingdom. Paddle is the reseller and merchant of record: your purchase contract is with Paddle, and Paddle handles checkout, payment, invoices, taxes and refunds as its own controller. Privacy policy

When you open the checkout in the app, Paddle’s checkout script is loaded from Paddle’s servers. Paddle then receives your IP address and browser data, and the details you enter during checkout. I receive from Paddle the information needed to manage your subscription, such as your email address, plan, subscription status and payment dates, but not your full payment details.

Legal basis: Art. 6 (1) (b) GDPR.

8. Newsletter

When you create a FeedLetter account, I add your email address to the FeedLetter newsletter. It contains information, tips and offers about FeedLetter and similar services of mine, such as new features and plans.

  • Legal basis: Art. 6 (1) (f) GDPR together with § 7 (3) UWG. My legitimate interest is informing customers about FeedLetter and similar services.
  • Right to object: You can object to the newsletter at any time, without any costs other than the basic transmission costs. Use the unsubscribe link in every email or email me at hello@feedletter.co.
  • Service provider: The newsletter is sent with EmailOctopus (Three Hearts Digital Ltd), United Kingdom, which processes your email address on my behalf (Art. 28 GDPR). Privacy policy
  • Open and click tracking: The newsletter contains a tracking pixel and tracked links. This shows whether an email was opened and which links were clicked, together with the time, IP address and email client. I use this to improve the newsletter. Legal basis: Art. 6 (1) (f) GDPR. Unsubscribing also ends the tracking.

After you unsubscribe, I keep your email address on a block list so you don’t get the newsletter again. Legal basis: Art. 6 (1) (f) GDPR, my legitimate interest in respecting your objection.

9. Survey Respondents

This section is for people who answer a survey, poll, feedback widget or rating created by a FeedLetter customer. FeedLetter processes this data on behalf of that customer (see section 2).

  • Votes: your answer, the time, the survey, and the IP address and user agent of the request. The IP address and user agent are used to detect bots and duplicate votes and are deleted after 30 days. They are never stored with comments or shown to the customer.
  • Comments: if you leave a comment, its text and, only if you enter them, your name and email address.
  • Local storage: the feedback page and the rating widget remember in your browser’s local storage which surveys you already answered, so you don’t vote twice. This is strictly necessary for the service (§ 25 (2) No. 2 TDDDG). Nothing is sent to FeedLetter from it.

FeedLetter does not use analytics or advertising trackers on the feedback pages and widgets.

For questions about how a survey’s answers are used, or to use your rights, please contact the newsletter or website that sent you the survey. I will support them and forward requests I receive.

10. Transfers Outside the EU

  • USA (Netlify): Netlify, Inc. is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision (Art. 45 GDPR). In addition, standard contractual clauses (Art. 46 (2) (c) GDPR) apply.
  • United Kingdom (Paddle, EmailOctopus): The European Commission has adopted an adequacy decision for the United Kingdom (Art. 45 GDPR).

All other data is processed in Germany and France.

11. Required Data and Automated Decisions

You don’t have to give me personal data. Without an email address, however, you can’t create a FeedLetter account. I don’t use automated decision-making or profiling under Art. 22 GDPR.

12. Retention

I delete personal data when it is no longer needed for the purposes above. Retention periods are listed in each section. Where the law requires it, data is kept longer: business letters and accounting records for 6 or 8 years (§ 257 HGB) and tax-relevant records for up to 10 years (§ 147 AO). During that time, the data is only used to meet these obligations.

13. Your Rights

You have the right to:

  • access your personal data (Art. 15 GDPR),
  • have incorrect data corrected (Art. 16 GDPR),
  • have your data deleted (Art. 17 GDPR),
  • restrict the processing (Art. 18 GDPR),
  • receive your data in a portable format (Art. 20 GDPR),
  • withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR).

Right to object (Art. 21 GDPR): Where processing is based on legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time for reasons relating to your particular situation. You can object to direct marketing at any time without giving reasons.

To use your rights, email hello@feedletter.co.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
datenschutz.hessen.de

14. Changes

I update this notice when FeedLetter or the law changes. The current version is always on this page.