Privacy Policy

Clueinbox is a QR-code feedback tool for small businesses. This page explains what data we collect from the two very different people who use it (the business owner, and their customers) and what we do with it.

Customers who leave feedback

Scanning a QR code and leaving feedback never requires an account, a name, an email address, or a phone number. We collect only:

• The star rating and optional comment you submit
• Your answers to any poll questions the business has enabled, if any
• A voice note, if the business has enabled it and you choose to record one

Your device's IP address is used only in memory, for a few minutes, to enforce a rate limit that stops spam submissions. It is never written to our database or linked to your feedback.

Voice notes are transcribed to text on your own device while you record (when your browser supports it) so a business can search and analyze it like typed feedback. The audio recording itself is deleted automatically 30 days after you submit it; the text transcript is kept so the business retains what you said, just not the recording.

Feedback is tied only to the business's campaign, never to you personally, and never sold or shared with anyone outside that business.

Business owners

To create and run an account, we collect:

• Your email address and display name
• A password, stored as a salted Argon2 hash (we never store or see it in plain text)
• If you sign in with Google, your Google account identifier and the email/name it provides
• Billing information handled entirely by Paystack (we never see or store your card details)

If you enable Pro features, the comments in your own campaigns are sent to OpenAI for sentiment analysis and theme detection. This only ever includes your own customers' feedback, never another business's.

If you enable push notifications, your device registers a token with Apple/Google's push service (via Expo) so we can alert you about new feedback and recommended actions.

Deleting your data

Deleting your account from Settings permanently removes your account, every campaign you created, and every feedback row tied to those campaigns. This cannot be undone.

Who else sees data

We use a small number of processors to run the service, each only for what they're named for:

• Paystack: payment processing
• OpenAI: sentiment/theme analysis of your own feedback (Pro accounts only)
• Sendhiiv: transactional email (verification codes, password resets, receipts)
• Cloudflare: storage for voice-note audio, where enabled
• Expo: push notification delivery

None of these providers use your data for anything beyond providing that specific service to us.

Questions

Email support@clueinbox.com with any privacy question, including a request to see or delete your data.