Privacy Policy

Complaintr ("Complaintr", "we", "us") operates a feedback and complaint platform. This Policy applies to complaintr.com, the product app at app.complaintr.com, the documentation at docs.complaintr.com, the embeddable widget, the API and MCP server, and the bots and integrations we run (together, the "Service").

For the processing described in this Policy, Complaintr is the data controller unless section 2 states otherwise. Our contact details are in the last section.

People use Complaintr in two ways, and our role differs between them.

Workspace owners

create an account and register applications. For account, preference, usage, newsletter, and website visitor data, Complaintr is the data controller.

Reporters

send a complaint, feedback, or a survey answer about an application, usually without an account. The owner of that application decides why and how this feedback is collected and is its data controller. Complaintr processes it on the owner's behalf as a data processor.

Where we process reporter data to keep the platform secure, prevent abuse, and meet our own legal obligations, we act as a data controller.

We collect personal data by electronic means: through the forms and conversations you complete, through the sign-in providers and channels you connect, and automatically through our servers.

• Account

  Data

  Name, email address, and profile picture; a hashed password if you sign up by email; the public key of each passkey you add; and an encrypted authenticator secret with backup codes if you turn on two-step verification. The fingerprint, face, or screen lock that unlocks a passkey stays on your device and never reaches us.

  Source

  You; Google or GitHub when you sign in with them.

• Onboarding and preferences

  Data

  Your role, project name and type, an optional website and description; your language, theme, and landing-page choices.

  Source

  You.

• Applications

  Data

  Names and descriptions of the applications you register, their widget settings, and the news and help articles you publish.

  Source

  You.

• Complaints and feedback

  Data

  Title and description of each report, the channel or AI agent it came from, its category, severity, and status, and any optional metadata. Widget forms can include an optional contact email, the page address, and browser details.

  Source

  Reporters; AI agents; the workspace owner.

• Assistant conversations

  Data

  Messages exchanged with Complaintr Core in the workspace chat, the widget, Telegram, Slack, Instagram, GitHub comments, and the chat on our website. When a complaint or a request for a person is filed in a conversation, the owner of that application and their team can read the part of the conversation about their application, and Complaintr administrators can read all of it.

  Source

  You; reporters.

• Surveys

  Data

  The questions a workspace owner writes, the recipient names and optional email addresses they enter, and the answers recipients give.

  Source

  The workspace owner; survey recipients.

• Channel identifiers

  Data

  Identifiers needed to reply on a connected channel: a Telegram chat ID, a Slack workspace and user ID, an Instagram sender ID, or the GitHub repository, issue, and comment a report came from.

  Source

  The connected platform.

• Newsletter

  Data

  Your email address.

  Source

  You.

• Technical and usage data

  Data

  IP address, browser type, and timestamps; records of AI usage for each account (request counts, token counts, and estimated cost).

  Source

  Generated automatically.

We never receive your Google or GitHub password, and we do not collect payment card details. We do not ask for special categories of personal data, such as health, religion, or biometric data; please do not include them in a complaint or a conversation.

• Creating and securing your account and keeping you signed in

  Data used

  Account; technical data

  Legal basis

  Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c)

• Receiving complaints and survey answers and showing them to the owner of the application they concern

  Data used

  Complaints; conversations; surveys; channel identifiers

  Legal basis

  Performance of our contract with the workspace owner; for reporter data, processing on the owner's instructions as a processor

• Running the assistant: understanding a message, asking follow-up questions, filing a report, answering questions about your own workspace, and assigning a category and severity when triage is enabled

  Data used

  Conversations; complaints

  Legal basis

  Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c)

• Sending the notifications you turn on and service emails such as verification and password reset

  Data used

  Account; channel identifiers

  Legal basis

  Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c)

• Enforcing plan limits and usage budgets

  Data used

  Usage data

  Legal basis

  Performance of a contract; legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5/2-f)

• Preventing spam, abuse, and prompt injection, applying rate limits, and keeping the Service secure

  Data used

  Technical data; conversations

  Legal basis

  Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5/2-f)

• Fixing problems and improving the Service

  Data used

  Technical and usage data

  Legal basis

  Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5/2-f)

• Sending product updates to newsletter subscribers

  Data used

  Newsletter email address

  Legal basis

  Consent (GDPR Art. 6(1)(a); KVKK Art. 5/1), which you can withdraw at any time

• Meeting legal obligations, answering lawful requests from authorities, and establishing, exercising, or defending legal claims

  Data used

  The data the obligation or claim requires

  Legal basis

  Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç) and establishment of a right (KVKK Art. 5/2-e)

We do not sell personal data, we do not use it for advertising, and we do not make decisions that produce legal effects for you solely by automated means.

Complaintr Core is an AI assistant. To produce a reply, classify a message, or triage a complaint, the relevant text is sent to the AI model providers listed in section 7. We send only what the task needs, and an assistant conversation on a public channel never has access to another person's workspace.

We do not use your content to train our own models. AI output can be wrong, so do not put information into a complaint or a conversation that you would not want processed this way, such as passwords, payment card numbers, or sensitive personal data.

A complaint is private by default. It becomes visible to others only when someone asks for a share link. The public card shows the application name and color, the title, the description, the source, the date, and the status. It never shows a contact email, page address, browser details, conversation history, or sender details.

Anyone with the link can view the card, and anything written in the title or description is visible. Sharing can be turned off from the share page at any time, after which the link stops working.

We rely on a small number of providers to run the Service. Each receives only the data its task requires and may use it only for that task.

• Google and GitHub

  Purpose

  Sign-in.

  Data

  They share your name, email address, and profile picture with us.

• Cloudflare

  Purpose

  Network protection in front of our sites, the Turnstile check that keeps bots out of public forms, and storage for images on our public pages.

  Data

  IP address and browser details; uploaded images.

• Resend

  Purpose

  Delivery of verification, password reset, and account emails.

  Data

  Email address and the content of the email.

• Better Stack

  Purpose

  Uptime monitoring of our sites and the public status page at status.complaintr.com.

  Data

  IP address and browser details of status page visitors.

• OpenRouter and Amazon Bedrock

  Purpose

  The AI models behind Complaintr Core, including message classification and complaint triage.

  Data

  The text of the relevant message, complaint, or conversation.

• Telegram, Slack, Instagram (Meta), and GitHub

  Purpose

  The channels you or your users choose to talk to Complaintr on.

  Data

  Messages sent there and the channel identifiers. These platforms also process them under their own policies.

• Hosting and database provider

  Purpose

  The servers and the PostgreSQL database where the Service runs.

  Data

  All data stored in the Service.

We also disclose personal data to competent authorities when the law requires it, and to the workspace owner a complaint or survey answer is addressed to. If Complaintr is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction under the protections of this Policy.

Some of these providers process data on servers outside Türkiye and outside the European Economic Area, including in the United States. Where the law requires it, we rely on the transfer mechanisms set out in Article 9 of the KVKK and Chapter V of the GDPR, such as standard contractual clauses, for those transfers.

• Account data

  Kept for

  As long as your account exists.

• Applications, complaints, surveys, and workspace chat

  Kept for

  Until the owner deletes them or the account is removed. Deleting an application deletes every complaint linked to it.

• Conversations on the widget, Telegram, Slack, Instagram, GitHub, and our website

  Kept for

  One year after the last message, even when the complaint filed in them is deleted earlier. They are kept as a record of what was said and to investigate abuse.

• One-time link codes and rate-limit records

  Kept for

  Briefly, until they expire.

• Newsletter subscriptions

  Kept for

  Until you unsubscribe or ask us to remove you.

• Cookies

  Kept for

  For the periods listed in section 10.

When a retention period ends, the data is deleted or anonymized. We may keep limited records for longer where the law requires it or where they are needed to resolve a dispute. To delete your account and its data, write to us at the address in the last section.

Complaintr sets only cookies that are strictly necessary or that remember a choice you made yourself, so no consent banner is shown. We do not use advertising or analytics cookies, and none of our sites set tracking cookies.

• Session cookie

  Where

  Product app

  Purpose

  Keeps you signed in.

  Duration

  Until you sign out or it expires.

• two_factor, better-auth-passkey

  Where

  Product app

  Purpose

  Hold a sign-in that is in progress while you enter a two-step verification code or use a passkey.

  Duration

  A few minutes; removed when the sign-in completes.

• NEXT_LOCALE

  Where

  All Complaintr sites

  Purpose

  Remembers the language you chose, so the website, the documentation, and the product app open in the same language.

  Duration

  Up to one year.

• theme

  Where

  All Complaintr sites

  Purpose

  Remembers the light, dark, or system theme you chose.

  Duration

  Up to one year.

• sidebar_state

  Where

  Product app

  Purpose

  Remembers whether the sidebar is expanded or collapsed.

  Duration

  Seven days.

• github_install_pending

  Where

  Product app

  Purpose

  Secures the GitHub installation flow.

  Duration

  Short-lived; removed when the flow completes.

The language and theme cookies are shared across complaintr.com and its subdomains and hold only the chosen value, never an identifier. Your browser's local storage also keeps the selected theme and, in the widget, a visitor's own conversations and a random device identifier on that visitor's device, so a conversation can continue without an account.

You can delete cookies and local storage from your browser settings at any time. The sites keep working and fall back to your device's language and the system theme.

Data is encrypted in transit, passwords are stored hashed, and access tokens for connected workspaces are stored encrypted. Each workspace's data is isolated by ownership, incoming webhooks are signature-checked, and public endpoints are rate limited.

No system is perfectly secure, and Complaintr is still in beta. Please do not store confidential information or your only copy of important records in it.

Under Article 11 of the KVKK, and under the GDPR where it applies to you, you have the right to:

• Learn whether your personal data is processed and request information about it
• Learn the purpose of the processing and whether the data is used for that purpose
• Know the third parties, in Türkiye or abroad, to whom your data is transferred
• Have incomplete or inaccurate data corrected
• Have your data deleted or destroyed, and have these actions notified to the third parties the data was transferred to
• Receive a copy of your data in a structured, machine-readable format
• Object to certain processing, ask us to restrict it, and object to a result against you that arises solely from automated analysis
• Withdraw your consent at any time where processing is based on consent
• Claim compensation if you suffer damage because your data was processed unlawfully

To use any of these rights, write to us at the address in the last section, by email from the address linked to your account or in writing. Tell us who you are and what you are asking for. We answer free of charge as soon as possible and within thirty days at the latest. If answering requires an additional cost, we may charge the fee set by the Personal Data Protection Board.

If you are not satisfied with our answer, or we do not answer in time, you can lodge a complaint with the Turkish Personal Data Protection Board (within thirty days of our answer and in any case within sixty days of your request) or with the data protection authority where you live.

If you submitted a complaint about someone else's application, you can also contact the owner of that application, who is the data controller for it. We will help them respond.

The Service is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this Policy as the Service or the law changes. When we do, we revise the date at the top of this page, and we may notify account holders about significant changes.

For questions about this Policy or to exercise your rights, reach us here:

Service

Complaintr

Email

[email protected]

Website

complaintr.com