Innflyt Processor Information

Last updated: 11 October 2026 · Version: 2026-10-11

This page explains how Innflyt processes personal data for its customers. It is written for customers, data-protection contacts, procurement teams and security reviewers. It summarises the Data Processing Agreement (the "DPA"); if the two differ, the DPA applies.

Innflyt is provided by Backroad AS, a Norwegian limited company, organisation number 934 341 929, Måseskjæret 18, 5035 Bergen, Norway.

Roles and the contract

When a customer installs the Innflyt widget, the customer is the controller of the feedback its end users send, and Backroad AS is its processor under Article 28 of the General Data Protection Regulation (GDPR).

The DPA is part of the Innflyt Terms of Use. A customer accepts it by clicking through the Terms when it creates its account or completes an Order; no separate signature is needed. A countersigned copy is available from legal@innflyt.com.

Backroad AS acts only on the customer's documented instructions. It does not:

• use feedback to train artificial-intelligence or machine-learning models;
• use feedback for its own advertising, profiling or analytics;
• sell feedback or share it with third parties for marketing;
• build data products from customer data.

Processing summary

Data the widget sends

The widget sets no cookies. It stores one item in the browser's local storage, innflyt_beta_notice, only when the end user dismisses the beta notice. See Cookies.

Where processing happens

• Database and file storage: Supabase, in the European Union region in Stockholm, Sweden (eu-north-1).
• Server-side functions that receive and deliver feedback: Supabase, in the European Union region in Frankfurt, Germany (eu-central-1), for every call.
• Dashboard and websites: servers at UpCloud in Stavanger, Norway. The dashboard shows feedback to you.
• Backups: Supabase keeps daily backups for 7 days. A weekly backup is also copied to Cloudflare R2 in the European Union jurisdiction and kept for 90 days. The weekly backup job runs on GitHub-hosted runners.
• Network and email: Cloudflare's global network delivers the widget, the dashboard and the websites, and sends notification and account emails.
• Error monitoring: Sentry, in its European Union region in Frankfurt, Germany, for server-side code only.

Some processing can take place outside the European Economic Area (EEA): Supabase is contracted through Supabase Pte. Ltd (Singapore) and its staff support and monitor the platform worldwide, around the clock; other sub-processors' support staff may access systems from other countries; Cloudflare's network operates worldwide; the location of GitHub-hosted runners is not chosen by us; and Sentry, a United States company, may access and process the error data from the United States and other countries. Each case is covered by the European Commission's Standard Contractual Clauses (SCCs) or by the EU–US Data Privacy Framework, as shown below.

Sub-processors

We notify customers at least 30 days before adding or replacing a sub-processor, by email to the organisation's owners and administrators and by updating this page. A customer can object; see clause 4.2 of the DPA.

Supabase's own sub-processors are listed at supabase.com/legal/customer-resources/subprocessor-list.

Your own destinations are not our sub-processors. Email addresses, Slack, Microsoft Teams and webhooks that you configure receive feedback as your recipients. Backroad uses Linear for its own product work; the service does not send customer feedback to it, and the Terms of Use forbid configuring a destination that would.

Security measures

The full list is in Annex 2 of the DPA. In short:

• HTTPS (TLS) everywhere; plain HTTP is redirected.
• Data encrypted at rest at Supabase, UpCloud and Cloudflare R2.
• Row-Level Security on every application table; the widget's anonymous role has no access to feedback tables; signed-in members reach only their own organisation's projects, checked on every request; deleting feedback requires a recent sign-in with a second factor.
• Passwordless dashboard sign-in (passkey or emailed one-time code), bot protection and rate limits on sign-in, new-device email notices, and a recent sign-in required for sensitive actions.
• Screenshots in a private bucket, uploaded and delivered only through signed, expiring links.
• Every webhook signed with HMAC-SHA-256 (X-Innflyt-Signature); duplicate-proof submissions; delivery through a durable queue.
• Daily automatic deletion when retention runs out, with a deletion log that holds no end-user data.
• Daily backups kept for 7 days and weekly off-provider backups kept for 90 days under a retention lock.
• Error monitoring in the European Union, for server-side code only, with personal-data sending off and IP addresses scrubbed.

Retention and deletion

• You choose the retention. By default feedback is deleted 365 days and screenshots 90 days after they arrive. In the dashboard's Data & Privacy settings you can choose any period from 30 to 3,650 days, let screenshots follow the feedback ("Same as feedback"), or choose "Keep until I delete it" ("keep"). "Keep" means no automatic deletion: the data stays until you delete it or your account ends.
• Deletion is permanent and removes the records and stored files. Deleting a project or your organisation deletes its feedback and screenshots at once.
• Export is available on every plan, at any time.
• At the end. When the service ends, or earlier on your written request, we delete all your data within 30 days and confirm in writing on request. Deleted data remains in backups until they expire (7 days for daily backups, 90 days for weekly backups).

Requests from your end users

If one of your end users contacts us to exercise a GDPR right, we forward the request to you without undue delay and do not answer it ourselves unless you authorise that in writing. In the dashboard you can export feedback and delete it.

Personal data breaches

We notify you of a personal data breach affecting your data without undue delay, and within 48 hours where possible, by email to your organisation's owners and administrators. You are responsible for notifying Datatilsynet or your own supervisory authority and the people affected where the GDPR requires it; we give you the information we have.

Audits

You can audit our compliance with the DPA, with 30 days' written notice, once a year unless there is cause. Write to legal@innflyt.com. We can first provide written documentation of our measures.

Text for your own privacy notice

As controller, you must tell your end users that a processor is involved. Copy the text below into your privacy notice and adjust the retention line to the setting you chose: replace the bracketed figures, or, if you chose "keep", use the alternative sentence.

Feedback (Innflyt)

We use Innflyt, provided by Backroad AS (organisation number 934 341 929,
Bergen, Norway), to receive the feedback you send us through the feedback
button on this site. We are the controller for that feedback. Backroad AS is
our processor under Article 28 of the General Data Protection Regulation
(GDPR) and processes it only on our instructions, under a data processing
agreement.

What is collected when you send feedback: what you write and choose in the
form; the address of the page you were on; your browser, operating system,
device type, screen size and language; the time; and, if you choose to give
them, your email address so that we can reply and up to five screenshots. If
you are signed in, our site may add your email address and user ID. Your IP
address is not stored with the feedback; a scrambled (hashed) form of it is
used for up to 24 hours to limit how often feedback can be sent.

Where it is processed: the data is stored in the European Union (Stockholm,
Sweden), received by server functions in the European Union (Frankfurt,
Germany), and shown to us in a dashboard that runs on servers in Norway,
with backups in the European Union. Some of Backroad AS's service providers
can access it from outside the European Economic Area; those transfers are
covered by the European Commission's Standard Contractual Clauses or the
EU-US Data Privacy Framework.

How long it is kept: feedback is deleted after [365] days and screenshots
after [90] days.
(If you chose "keep", use instead: Feedback is kept until we delete it.)

Your feedback is not used to train artificial-intelligence models, is not
used for advertising or profiling, and is not sold.

Details, including the current list of Backroad AS's sub-processors, are
published at https://innflyt.com/processor-info.

One thing this text cannot do. Feedback text and screenshots are free-form, so an end user may include sensitive data you never asked for. Add a short line near your feedback button asking people not to include sensitive personal information that the feedback does not need.

Contact

Backroad AS · Måseskjæret 18, 5035 Bergen, Norway. Supervisory authority: the Norwegian Data Protection Authority (Datatilsynet).