Privacy policy

feedbackskill.dev is operated by VMGM Software LLC. You can reach us at hello@vmgmsoftware.com, which is also the address for any request in this policy.

Two kinds of people meet this product. A customer signs in, puts the card on their site and reads what people said. A visitor is somebody on that site who presses the button and talks. This policy covers both, in that order.

Your account. Your name, email address and profile image, received from Google when you sign in. We never receive or store your Google password. For each signed-in session we keep the IP address and browser it came from, so you can tell your own sessions apart.

Your organization and projects. The organization name, its members, each project’s name and client id, the hostnames allowed to use it, and each placement’s name and the brief the agent is given there.

Sessions. For every conversation the card runs: when it was offered, started and ended, how it ended, how many seconds it ran, and the transcript. See the visitor section for what a transcript contains.

Billing. Your subscription status, plan and billing period, and a ledger of minutes granted, bought and used. Card details go directly to Stripe and never reach our servers.

Product usage and errors. Which pages and features of this site and the dashboard are used, and diagnostic information when something breaks, including the error, the page, and a general location derived from an IP address.

When a visitor presses the button on a customer’s site, the card says it will record and transcribe, and nothing starts until they have pressed it. Then:

• Their voice streams from their browser directly to xAI, whose model runs the conversation. It does not pass through our servers and we do not store audio, anywhere, at all.
• The transcript, what the visitor said and what the agent said back, is sent to us by the card as the conversation goes and stored against the customer’s session.
• Where and when. Which project and placement the card was on, and the timing of the session.

That is all. We do not set a cookie on the customer’s site, we do not record the visitor’s IP address, and nothing identifies the same visitor across two sessions or two visits. If a visitor says their name or their email address, it is in the transcript because they said it, and the customer can see it there.

The customer chose to put the card on their site and is the one who reads the transcript. For a visitor’s data we act on the customer’s behalf, and a visitor who wants a transcript removed should ask the site they were on. If they cannot, they can email hello@vmgmsoftware.com and we will find it.

To do the thing you asked for: run a conversation with a visitor, keep the transcript, and show it to you in the dashboard or through an AI assistant you connect.

To operate the service: authenticate you, take payment, meter minutes, keep the product working, and investigate faults.

We do not sell your data, and we do not use transcripts to train machine learning models. The model that runs a conversation is given the brief for that placement and hears that conversation. It is not given any other customer’s data.

If you are in the UK or the European Economic Area, we rely on two lawful bases: performing our contract with you, which covers your account, your projects, sessions and billing; and our legitimate interest in a product that works, which covers analytics, error reporting and security. A visitor’s recording rests on the consent they give by pressing the button, which is why the card will not start without it.

We share data only with the providers that run the service, and only what each one needs:

• xAI receives a visitor’s voice and the brief for the placement, and produces the agent’s side of the conversation and the transcript. Audio goes to xAI from the visitor’s browser, under xAI’s own privacy policy.
• Amazon Web Services hosts the service and the database, in the United States.
• Google is how you sign in.
• Stripe handles payments and subscription billing.
• Sentry receives error reports.
• PostHog receives product analytics from this site and the dashboard. Nothing from the card on a customer’s site goes to PostHog.

These providers are in the United States, so using the service from the UK or the European Economic Area means data is transferred there. Where a provider is not covered by an adequacy decision, that transfer is made under the UK and EU Standard Contractual Clauses.

We may also disclose data where the law requires it, or to protect our rights or someone’s safety. If the business is ever sold or merged, your data may transfer with it, and this policy travels with the data.

A customer can connect Claude, ChatGPT, Cursor or another MCP client. When you do that, you approve a specific set of tools, and the client receives a token limited to those tools and to your organization.

What the assistant reads through those tools, your projects, placements and transcripts, goes to whoever operates that assistant, under their privacy policy rather than ours. We do not control what they retain. To revoke a connection, disconnect feedbackskill.dev in the assistant itself, or email hello@vmgmsoftware.com and we will revoke the token for you.

All traffic is served over HTTPS. The token that lets a visitor’s browser talk to xAI is short-lived and single-use, and a session is capped at five minutes. A client id only works from the hostnames you allow. Access to production data is limited to people who need it to operate the service.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your data we will tell you.

Your account data, projects and transcripts are kept while your organization exists. Deleting a project or a placement does not delete the sessions it produced, because those are your billing history; the sessions stay, no longer attached to it.

When you close your account we remove your personal data, your organization and every transcript in it within 30 days, except records we are required to keep for tax and accounting, typically billing history for seven years.

Audio is never kept, so there is nothing to delete. What xAI retains of a conversation is governed by their policy, not ours.

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Email hello@vmgmsoftware.com and we will respond within 30 days.

Depending on where you live you may also have the right to object to or restrict certain processing, or to complain to your data protection authority. Exercising any of these costs you nothing and we will not treat you differently for it.

The service is not for anyone under 13, or under 16 where you live if that is the higher age your country sets, and we do not knowingly collect their data. A customer must not place the card where it would record children. If you believe a child has given us data, email hello@vmgmsoftware.com and we will delete it.

If this policy changes we will update the date at the top. For changes that meaningfully affect how we handle your data, we will tell you before they take effect.

hello@vmgmsoftware.com, for anything in this policy, including access and deletion requests.