Privacy Policy

DevPin is run by Impact Consulting AI LLC, a Florida limited liability company ("we", "us"). This policy explains what DevPin collects, why, and what control you have. It covers two groups: customers (people with a DevPin account) and reviewers (people who submit feedback through the widget without an account).

Our role

For customer account data we are the data controller. For feedback submitted through a customer's project, the customer is the controller and we are their processor: we handle that data on their instructions. If you are a reviewer and want your feedback removed, contact the site owner who invited you, or us and we will route it.

What we collect

From customers: email address, display name, how you sign in (email link, Google or Apple), project settings, and billing details. If you sign in with Google or Apple, they send us your name and email address; with Apple you can choose to hide your email, and we then only see the private address Apple gives us. Payment card data goes directly to Stripe; we never see or store card numbers.

From reviewers, when they submit feedback:

• The email address they enter.
• The feedback text they write.
• A screenshot of the page at the moment they pinned it, including any drawing they added.
• A screen recording of the page, up to 30 seconds and without sound, only if they choose to record one.
• Page URL and title, and where on the page they clicked.
• Technical context: browser, operating system, device type, viewport and screen size, the CSS selector of the clicked element, recent console errors, and recent failed network requests.

The screenshot is of the page as the reviewer sees it. If your page displays personal or confidential data, that data will appear in the screenshot. Do not install the widget on pages showing information you are not willing to store in DevPin.

Automatically: standard server logs, and product analytics if the customer's deployment has it enabled.

Why we use it

• To operate the Service: store, display, and route feedback to the right project.
• To email reviewers when the issue they reported has been addressed, so they can confirm the fix, and when the team replies to their report.
• To email a reviewer a one-time sign-in code when they confirm their address on an invite-only project.
• To send account, billing, and security notices to customers.
• To detect and prevent abuse.

We do not sell personal data, and we do not use your content to train machine-learning models.

Email and opt-out

Reviewers receive a message only when they ask for a sign-in code, when the team replies to their report, or when the team marks it as addressed. Every reply and addressed email includes a one-click unsubscribe link, and unsubscribing stops all further DevPin email to that address. Customers can likewise unsubscribe from product announcements; we still send essential account, security, and billing notices.

Who we share it with

We use a small number of processors, each under contract and only for the purpose listed:

• Supabase, database, authentication, and file storage.
• Vercel, application hosting and delivery.
• Resend, transactional email delivery.
• Stripe, payment processing (paid plans only).
• Google and Apple, only if you choose to sign in with them, to confirm who you are.
• Anthropic, only when a customer uses the optional AI fix-prompt feature, and only for the pin being processed.
• Sentry, error reporting for the dashboard: what failed and on which screen. Addresses are stripped of codes and identifiers first, and no names, email addresses or screen recordings are sent.

We also disclose data if legally required, or to protect our rights or the safety of others.

Where data is stored

Data is stored in the United States. If you require data residency in another region, contact us about a self-hosted or region-specific deployment.

How long we keep it

• Feedback and screenshots: until the customer deletes the pin or the project, or deletes their account.
• Account data: for the life of the account. Deleting your account removes it straight away.
• Payment records: Stripe keeps past invoices as tax law requires, after a paid plan ends or an account is deleted.
• Backups: rolling, and overwritten within 30 days.
• Opt-out records: kept indefinitely, because we need them to keep honouring the opt-out.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to processing, and to complain to a supervisory authority. Email info@impactconsulting.ai and we will respond within 30 days. Customers can delete any pin or project from the dashboard, and their whole account from the Account page, at any time.

Deleting your account

Delete my account, on the Account page, removes your account straight away. Before it does, it shows you exactly what will happen:

• Any paid plan on a project you own, or billed to you, is cancelled at once. You are not charged again; time left in the current period is not refunded.
• A project you own with no other admin is deleted, with its feedback, screenshots, comments, invites and team list.
• A project you own that has another admin is handed to the admin who joined it first, so their work is not lost.
• You are removed from other people's projects. Feedback and comments you left there stay with those projects.
• Your profile, sign-in and activity history are deleted.

Security

• All traffic is encrypted in transit (TLS); data is encrypted at rest.
• Tenant separation is enforced in the database itself with row-level security, not only in application code.
• Screenshots live in a private bucket and are served only through short-lived signed links.
• API tokens are stored hashed and shown once.
• Sign-in is passwordless (an email link, or Google or Apple), so there are no customer passwords to leak.

No system is perfectly secure. If you believe you have found a vulnerability, email info@impactconsulting.ai and we will acknowledge within 3 business days.

Cookies

We use a small number of strictly necessary cookies and local storage entries: to keep you signed in, to remember a reviewer's email on their own device (and, on invite-only projects, that they confirmed it), and to remember dismissed notices. We do not use advertising cookies.

Data processing agreement

If you need a DPA to use DevPin with your clients' data, email info@impactconsulting.ai. We do not have a standard DPA yet. We will reply with the terms we can offer, which can commit to no more than the data processing terms of the subprocessors listed above.

Changes

We will post updates here and, for material changes, notify customers by email before they take effect.

Contact

Impact Consulting AI LLC, Florida, United States. Email info@impactconsulting.ai.