CustomerSaid

Privacy Policy

Last updated: October 7, 2026

1. Who we are

CustomerSaid is operated by Bartosz Łaniewski, a sole trader entered in the Polish Central Register and Information on Economic Activity (CEIDG), ul. Lipowa 34 lok. 47, 15-424 Białystok, Poland, NIP (tax ID) 5423364025, REGON 383607320 (“we”, “us”). We are the controller of the personal data described in this policy, except for workspace content described in section 2.

For any privacy question or to use your rights, write to [email protected] or to the postal address above. We have not appointed a data protection officer because the law does not require one for our processing.

2. Our role for workspace content

Organizations use CustomerSaid to store and analyze feedback from their own customers. For content an organization adds to its workspace (feedback, contact and company records, messages captured from connected tools, forwarded emails, imported files and public reviews), that organization is the controller. We process this content only on its behalf and instructions, as its processor under the data processing terms in our Terms of Service. If your feedback or contact details are in a customer’s workspace, please contact that organization first. We will help it respond to your request.

3. Data we collect

  • Account data: name, email address, profile photo, job title, language and your role in a workspace. If you sign in with Google, we receive your name, email address and profile photo from Google.
  • Workspace content: the content listed in section 2, including any personal data in it, such as a customer’s name, email address, job title or company.
  • Billing data: billing email, plan, subscription status, invoices and payment history. You enter card details directly with our payment processor. We never see or store full card numbers.
  • Integration data: access tokens for the tools you connect, stored encrypted, and only the messages your team chooses to send to CustomerSaid. For each public review profile you add, we collect its public reviews, including reviewers’ display names, ratings and review text.
  • macOS app: the app stores a device token on your Mac and sends only the text you choose to capture.
  • Technical data: IP address, browser and device information, request logs, security events and error reports.
  • Usage data: which features signed-in users use, for example creating a workspace or capturing feedback. Our servers record these events without cookies and without the text of customer feedback. If you accept optional cookies, we also record pages viewed, sessions and a session recording in which typed text and product content are masked.
  • Communications: messages you send us and our replies.

4. Why we use data and on what legal basis

  • To create and secure your account, sign you in, run your workspace and provide its features, including AI analysis, translation and Analyst answers. Legal basis: performance of a contract with you or the organization you belong to (Art. 6(1)(b) GDPR).
  • To send service emails, such as sign-in links, invitations and the notifications you choose in settings. Legal basis: Art. 6(1)(b) GDPR.
  • To bill subscriptions, issue invoices and keep accounting records. Legal basis: Art. 6(1)(b) GDPR and our obligations under Polish tax and accounting law (Art. 6(1)(c) GDPR).
  • To keep the service secure and reliable through rate limiting, abuse prevention, logging and error monitoring. Legal basis: our legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR).
  • To understand how signed-in users use the product and improve it, using the server-side usage events described above. Legal basis: our legitimate interest in improving the product (Art. 6(1)(f) GDPR). You can object at any time.
  • Optional browser analytics and session recordings. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law). You can withdraw it at any time in Cookie settings. Withdrawal does not affect processing that happened before it.
  • To answer your messages and to establish, exercise or defend legal claims. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

We do not sell personal data, use it for advertising, or send marketing email without your separate consent.

5. AI processing

CustomerSaid uses AI models from an external provider to find needs in feedback, build search indexes, translate text, suggest product areas and solutions, and answer Analyst questions. The content needed for each task, which may include personal data in the feedback, is sent to the provider for that task only. The provider acts as our processor, may not use this data to train its models, and may keep it for up to 30 days for abuse monitoring. We keep detailed AI processing records for quality review and delete their content after 30 days.

AI output is a suggestion for your team. We do not make decisions based solely on automated processing that have legal or similarly significant effects on anyone.

6. Who receives data

We share personal data only with service providers that help us run CustomerSaid. Our contracts require them to protect the data and use it only on our instructions. They fall into these categories:

  • Hosting and infrastructure (servers, database and file storage) in the European Economic Area.
  • AI model provider.
  • Email delivery, for sending service email and receiving forwarded email.
  • Payment processing and invoicing.
  • Error monitoring, in the European Union.
  • Product analytics, in the European Union, only within the limits in section 4.
  • Public review data provider, which collects reviews from the review sites you choose to monitor.
  • Google, only if you choose to sign in with Google.

Tools your organization connects, such as Slack or Intercom, exchange data with CustomerSaid under that organization’s own agreements with them. We may also disclose data to professional advisers, or to public authorities when the law requires it. Workspace customers can request our current list of subprocessors at [email protected].

7. Transfers outside the EEA

Some providers, such as our AI, email delivery and payment providers, are based in or access data from countries outside the European Economic Area, including the United States. We transfer data to them only where the European Commission has found that the country ensures adequate protection, including the EU–US Data Privacy Framework for certified companies, or under the Commission’s Standard Contractual Clauses. You can request a copy of these safeguards at [email protected].

8. How long we keep data

  • Account data: while you belong to at least one workspace. When the last workspace you belong to is deleted, we delete your account, sessions and profile photo. You can also ask us to delete your account at any time.
  • Workspace content: until the workspace owner deletes it or the whole workspace, or until our contract with the organization ends. Deleting a workspace removes its content from our live systems immediately.
  • AI processing records: their content is deleted after 30 days.
  • Billing and accounting records: 5 years from the end of the calendar year in which the related tax obligation arose, as Polish tax law requires.
  • Sign-in links expire after 24 hours and invitations after 7 days.
  • Logs and error reports: up to 90 days, for security and troubleshooting.
  • Analytics data: until you withdraw consent or object, and no longer than 24 months.
  • Backups: when we make them, they are overwritten within 14 days.
  • Data we need for a legal claim: until the claim is resolved or time-barred.

9. Your rights

Under the GDPR you have the right to:

  • access your data and get a copy of it;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict how we process it;
  • receive data you gave us in a machine-readable format, or have it sent to another controller;
  • object at any time to processing based on our legitimate interests;
  • withdraw consent at any time, without affecting earlier processing.

To use a right, write to [email protected]. We reply within one month. For complex requests we may extend this by two more months and will tell you why. We may ask you to confirm your identity. Workspace owners can also delete a workspace in its settings, and you can edit your profile in the product.

You can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with the supervisory authority in the EU country where you live or work.

10. Cookies

We use cookies and similar technologies. Necessary cookies are always on, because the service cannot work without them:

  • authjs.session-token: keeps you signed in. Expires after 30 days.
  • authjs.csrf-token and authjs.callback-url: protect sign-in and return you to the right page. Deleted when you close the browser.
  • customersaid-workspace: remembers your last workspace. Expires after 12 months.
  • customersaid-locale: remembers your language. Expires after 12 months.
  • customersaid-pending-sign-in-email: shows the address we sent a sign-in link to. Expires after 15 minutes.
  • customersaid-analytics: stores your cookie choice. Expires after 12 months.

Optional analytics cookies and local storage are set by our analytics provider only after you click Accept. They measure visits and sessions and make session recordings with typed text and product content masked. They expire after up to 12 months. You can change your choice at any time with Cookie settings at the bottom of this page or of our website.

11. Is providing data required?

You need to give your email address to create an account. Without it we cannot provide CustomerSaid. Everything else is optional.

12. Security

We encrypt data in transit, encrypt integration access tokens at rest, keep each workspace’s data separate at the database level, and limit internal access to what we need to run and support the service.

13. Children

CustomerSaid is a business service and is not meant for children under 16.

14. Changes to this policy

We may update this policy. We will change the date at the top and, for significant changes, tell workspace owners by email or in the product before the changes take effect.