Privacy Policy

Clueinbox is a QR-code feedback tool for small businesses. This page explains what data we collect from the two very different people who use it (the business owner, and their customers) and what we do with it.

Customers who leave feedback

Scanning a QR code and leaving feedback never requires an account, a name, an email address, or a phone number. We collect only:

• The star rating you submit, and a written comment if you choose to add one
• A phone number or email address, only if you choose to type one into the optional “Want the owner to get back to you?” box (shown after a lower rating). It is visible only to that business, so they can reply to you
• Your answers to any poll questions the business has enabled, if any
• A voice note, if the business has enabled it and you choose to record one

Your device's IP address is used only in memory, for a few minutes, to enforce a rate limit that stops spam submissions. It is never written to our database or linked to your feedback.

Voice notes are transcribed to text so a business can read, search and analyze them like typed feedback. Your browser does this on your own device while you record when it can; when it can't, we send the recording to OpenAI's speech-to-text service to transcribe it. The audio recording itself is deleted automatically 30 days after you submit it; the text transcript is kept so the business retains what you said, just not the recording.

We also count how many times a feedback page is opened, as a single running total per campaign. Nothing about who opened it is recorded.

Feedback is tied only to the business's campaign, never to you personally (unless you choose to leave contact details, which only that business sees), and is never sold or shared with anyone outside that business. A business owner can remove a comment from their own list at any time.

Business owners

To create and run an account, we collect:

• Your email address and display name
• A password, stored as a salted Argon2 hash (we never store or see it in plain text)
• If you sign in with Google, your Google account identifier and the email/name it provides
• Billing information handled entirely by Paystack (we never see or store your card details)

If you enable Pro features, the comments in your own campaigns are sent to OpenAI for sentiment analysis and theme detection. This only ever includes your own customers' feedback, never another business's.

If you enable push notifications, your device registers a token with Apple/Google's push service (via Expo) so we can alert you about new feedback and recommended actions.

Deleting your data

Deleting your account from Settings permanently removes your account, every campaign you created, and every feedback row tied to those campaigns. This cannot be undone.

Who else sees data

We use a small number of processors to run the service, each only for what they're named for:

• Paystack: payment processing
• OpenAI: sentiment/theme analysis of your own feedback (Pro accounts only)
• Sendhiiv: transactional email (verification codes, password resets, receipts)
• Cloudflare: storage for voice-note audio, where enabled
• Expo: push notification delivery

None of these providers use your data for anything beyond providing that specific service to us.

Questions

Email support@clueinbox.com with any privacy question, including a request to see or delete your data.