Privacy & data

Feedback Assist is a free service run by Benjamin T. Cooke, an individual based in Abu Dhabi, United Arab Emirates. You can contact us about privacy at privacy@feedbackassist.ae.

While you write, your answers are saved as a draft linked to your invitation, so you can come back to it. When you submit, in a single step, the draft is deleted and your answers are stored with no link to you, no precise time and a random reference. Nothing in our database can connect them to you afterwards, because the link no longer exists. The one limit to this is explained under What we can't rule out.

This also means that once you've submitted, we can't find your response to show, export or delete it for you. It's deleted with the rest of the round's raw feedback.

They can see whether each person is outstanding or done, so they can send reminders. Taking part and declining look the same. They can't see whether you declined, when you finished, or which comments are yours.

If you ask us to stop reminding you, you still appear as outstanding.

The mentor reads every comment exactly as written, without names. Each comment shows which of the four groups it came from: the Seeker's leaders, their peers, their team, or people outside their organisation. This helps the mentor read feedback in context.

Where a group has only two or three people, the mentor may be able to guess who wrote a comment. We tell contributors this before they write. The mentor is asked not to try to work it out, and which group a comment came from is never passed on to the Seeker.

The Seeker's summary names a group only when at least three people in it responded, at least two-thirds of them raised the same point, and few others in the circle did.

Feedback is anonymous by default. On the last step, a contributor can choose to share their comments with the Seeker in full, with their name. The box is never ticked for them, and it isn't remembered from one round to the next.

If they tick it, everything they wrote appears word for word under their name, in a separate section at the end of the Seeker's summary, after the mentor has read it. Their comments still go into the anonymous themes as well. For that section only, we keep a copy of their name, encrypted, with their response.

If they don't tick it, nothing changes: their response has no link to them. The Seeker and mentor can't see who chose not to share.

We use Google's Gemini API, on a paid plan, to suggest follow-up questions when a contributor reviews their answers, to sort pasted notes into the questions, to flag harmful comments, to translate comments and quotes into the reader's language, and to group comments into themes and draft the summary.

We send only what each task needs: the comments themselves, which part of the circle a response came from, a little context about the Seeker (first name, job role and career level) and the mentor's name. We never send contributors' names or email addresses.

On the paid plan, Google doesn't use this content to train its models. We never use Google's free tier, where it might.

Google may process this content outside your country. Google may keep it for a limited time to detect abuse.

AI never decides on its own. The mentor sees every comment and decides what goes in the summary, and nothing reaches the Seeker until the mentor sends it.

Feedback Assist runs on Cloudflare. Our database and file storage are held in the European Union. Cloudflare also runs the service itself, sends our emails, keeps request logs for 7 days, and provides the bot check on the sign-in page (Turnstile), which looks at signals from your browser to tell people from bots.

Google provides the AI, as described above, and the mailbox that receives email sent to our privacy and support addresses.

We don't sell data or share it with anyone else, and we don't use it for advertising.

Data is encrypted in transit and in our database. Contributors' answers, drafts and self-reflections are also encrypted separately, with a key for each round that is held outside the database.

Each round's feedback is encrypted with its own key, kept apart from the database in storage that keeps no backups. When the raw feedback is deleted, that key is destroyed for good, so copies still in database backups can never be read again.

Our own logs and error reports never contain what anyone writes. Cloudflare's request logs do record the web addresses visited, which for a contributor include their private link, along with IP addresses and browser details. They're kept for 7 days.

We follow the principles of the GDPR and the UAE Personal Data Protection Law.

If you have an account, you can delete it, with your rounds and summaries, from your profile at any time. To get a copy of your data, email us at privacy@feedbackassist.ae.

Anyone can email privacy@feedbackassist.ae to ask what we hold about them, to correct it, or to have it deleted. As explained above, a submitted response can't be traced to you, so it can't be singled out.

You can also complain to the data protection authority where you live.

We use only the cookies the service needs: to keep you signed in, to hold your email address for the 15 minutes it takes to sign in, to remember your language and theme and, for people testing new screens, which ones they've switched on. The sign-in page loads Cloudflare's bot check, described above. We don't use analytics, advertising or tracking.

If we change how we handle data, we'll update this page and tell account holders about significant changes.