Privacy Policy

Last updated: July 2026

Who We Are

Feedbacker ("we", "us", or "our") is a review, discovery, and payments platform for farmers markets, vendors, nonprofits, and their customers, operated at feedbacker.market. We are based in the United States. Questions about this policy? feedbackerhelp@gmail.com.

Account Types

Feedbacker supports four account types, each of which collects slightly different data:

  • Customer — leaves reviews and follows vendors or nonprofits.
  • Vendor — runs a market booth; may subscribe to Premium.
  • Market Manager — runs a farmers market; may enable PRO features to collect booth-fee payments through Feedbacker.
  • Nonprofit — lists at markets for outreach and events.

What We Collect

  • Email address — required to create an account and log in. Also used to send transactional email (verification codes, receipts, notifications).
  • Password — stored as a secure, one-way bcrypt hash. We never see or store your plain-text password.
  • Display name, business name, or nonprofit name — shown publicly on your profile or reviews.
  • Profile description, mission statement, EIN (vendors and nonprofits) — shown publicly on the profile.
  • Reviews, ratings, and photos — content you submit is stored and displayed publicly on the reviewed vendor's page.
  • Profile photos and logos — vendor logos, nonprofit logos, and Premium product photos are stored securely and displayed publicly.
  • Phone number (optional, market managers) — collected during market claim submission for admin verification. Not shown publicly.
  • Direct messages — private messages between users are stored so both parties can read the conversation.
  • Newsletter subscriptions — see the "Newsletter Subscriptions" section below.
  • Booth-fee payment records (vendors and market managers) — for markets that enable PRO card payments, we store a record of each booth-fee request, amount, event date, and payment status. Card details themselves live only with Stripe.
  • Payment information — never seen or stored by us. All card processing runs through Stripe; see "Payment Processing" below.
  • Location data — market managers set the location of their market (address, latitude, longitude) to appear on the discovery map. Users are not asked for their location.
  • IP address — collected briefly for rate limiting, security, and anonymous vendor profile view analytics. IPs are not linked to individual user identities and profile-view rows are de-duplicated per 24-hour window per IP.
  • Session cookie — a single HTTP-only cookie keeps you logged in. Contains a signed JSON web token; no advertising identifiers.

Newsletter Subscriptions

Two kinds of newsletter subscriptions exist on Feedbacker:

  • Vendor newsletters (Premium vendors only) — after a customer leaves a 4- or 5-star review for a Premium vendor, they are asked if they want to hear from that vendor. If they say yes, we share the customer's account email with the vendor so the vendor can email them directly about updates, events, and offers. Only Premium vendors receive subscriber emails.
  • Nonprofit newsletters — nonprofits can collect subscribers directly from their public profile. Any logged-in user may subscribe. When someone subscribes, we share their account email with the nonprofit so the nonprofit can email them about events, volunteer needs, and organization updates.

In both cases: the recipient business or nonprofit is responsible for the newsletter emails they send after receiving your address. Feedbacker does not send marketing emails on their behalf and does not sell subscriber lists.

To unsubscribe from a vendor's or nonprofit's list, contact them directly. To remove your subscriptions from Feedbacker's records entirely, close your account or contact us at feedbackerhelp@gmail.com.

Payment Processing

All payment processing on Feedbacker is handled by Stripe, Inc. Feedbacker never sees your full card number, CVC, or bank account credentials.

  • Vendor Premium subscription payments — processed via Stripe Checkout. Stripe stores your card on file for recurring billing.
  • Booth-fee payments to PRO markets — processed via Stripe Checkout with a marketplace split. Your card is charged the booth fee; Stripe routes the market's share to the market's Stripe Connected Account and Feedbacker's application fee to us.
  • Market Manager payouts — market managers onboarding to accept card payments do so through Stripe Connect Express. Bank details, KYC identity documents, and payout schedule live with Stripe, not with Feedbacker. We store only the resulting Stripe Connected Account ID plus onboarding-status flags (whether charges are enabled, whether payouts are enabled). Managers must explicitly accept Stripe's Connected Account Agreement before onboarding.

Stripe's own Privacy Policy applies to all payment data: stripe.com/privacy.

How We Use Your Data

  • To operate your account and provide the Feedbacker service.
  • To send transactional emails — verification codes, password resets, subscription receipts, review notifications, booth-fee requests and receipts, message notifications, nonprofit application updates.
  • To display your reviews, profile, and (for nonprofits) market appearances publicly.
  • To provide vendors and market managers with anonymous analytics about profile views and booth-fee payment status.
  • To process subscription and booth-fee payments through Stripe.
  • To route booth-fee funds to the correct market via Stripe Connect.
  • To prevent abuse — rate limiting, brute-force protection, and admin moderation (see "Abuse Prevention" below).

We do not sell your data. We do not use your data for advertising. We do not share your personal information with third parties except (a) with the vendor or nonprofit you explicitly subscribe to, (b) with the infrastructure providers listed below to operate the service, or (c) if required by law.

Abuse Prevention

To keep Feedbacker useful and safe we run a range of automated checks against the data described above. These include:

  • Spam and fake-review detection (including duplicate-review prevention).
  • Bot and automation detection.
  • Per-IP and per-user rate limiting on sensitive actions.
  • Brute-force lockouts on password resets and verification codes.
  • Suspicious login monitoring.
  • Account verification via email codes.

Some of these checks use automated systems, including machine learning tools. Automated decisions may be reviewed by Feedbacker staff. If an automated action affects you and you believe it was mistaken, contact us and we will review it.

Third-Party Services

We use the following services to operate Feedbacker. Each has its own privacy policy:

If we begin using additional third-party services — for example website analytics, error monitoring, or CDN/security providers — we will update this section and the "Cookies" section below to reflect that.

Cookies

We use a single HTTP-only session cookie to keep you logged in. This cookie is essential to the service — without it you cannot use your account. It does not track you across other websites and contains no advertising identifiers.

Third-party services embedded on our pages (Stripe Checkout, Mapbox tiles) may set their own cookies while you interact with them. Those cookies are governed by their respective privacy policies. If Feedbacker ever adds analytics or error- monitoring providers (for example Google Analytics, Plausible, PostHog, Sentry, or Cloudflare Analytics), we will list them here.

Your Rights

  • Access — you can view all data associated with your account by logging in and visiting your dashboard.
  • Deletion — you can delete your account at any time from your dashboard. When you delete your account: your email and password are permanently removed; reviews you wrote are anonymised and remain visible without your name attached; vendor, market, and nonprofit profiles are orphaned (unclaimed) rather than deleted so historic records remain accurate. Newsletter subscriptions tied to your email are removed.
  • Correction — contact us to correct any inaccurate information you can't fix yourself from your dashboard.
  • Newsletter unsubscribe — contact the vendor or nonprofit directly to unsubscribe, or contact us to remove your address from our records.
  • Data export — email us and we will send you a copy of the data we hold about you within a reasonable time (typically within 30 days).

To make a data request, email us at feedbackerhelp@gmail.com.

California residents: you may have additional privacy rights under the California Consumer Privacy Act (CCPA) and related state laws — including the right to know what personal information we collect, the right to request deletion, and the right not to be discriminated against for exercising these rights. Contact us using the email above to exercise any of these rights.

Data Retention

We retain your account data for as long as your account is active. If you delete your account, your personal information is removed immediately.

Anonymised review content is retained indefinitely as it forms part of the public record of the platform. Payment records are retained for at least seven years to comply with financial recordkeeping obligations. Message history is retained for the lifetime of both accounts in the conversation and deleted when either account is deleted.

Security

We implement industry-standard technical and organizational safeguards to protect your data: HTTPS in transit, bcrypt-hashed passwords, per-user and per-IP rate limiting on sensitive endpoints, brute-force lockouts on password resets and verification codes, HTTP-only session cookies with the Secure flag in production, and JWT invalidation on password change. No system is perfectly secure — if we ever experience a data breach that affects you we will notify you promptly as required by law.

Children

Feedbacker is not directed at children under the minimum age required by applicable law (13 in the United States). We do not knowingly collect personal information from children below that age. If you believe a child has provided us with their information, contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. We will update the "Last updated" date at the top of this page. Continued use of Feedbacker after changes constitutes acceptance of the updated policy. For material changes affecting how we collect or share your data, we will notify active users by email.