Innflyt — Processor Information

Summary

This page explains how Innflyt processes personal data on behalf of customers when they use the Innflyt widget. It is intended for customers, data-protection contacts, procurement teams, and security reviewers. It summarises Innflyt's processor role under the General Data Protection Regulation (Regulation (EU) 2016/679, the "General Data Protection Regulation" or "GDPR") and does not replace the per-customer Data Processing Agreement (the "DPA") that each customer enters into with Backroad AS before going live.

Innflyt is a product of Backroad AS, a limited company incorporated in Norway (organisation number 934 341 929), registered office in Bergen, Norway. When a customer embeds the Innflyt widget on their site, personal data submitted through that widget is processed by Innflyt on the customer's behalf. The customer is the data controller; Innflyt is a data processor under Article 28 of the General Data Protection Regulation.

Our role: processor for customer feedback data

Innflyt is a processor, not a joint controller. Innflyt acts only on the documented instructions of each customer. Backroad AS does not:

• determine the customer's feedback purposes;
• use submitted data to train artificial-intelligence or machine-learning models;
• use submitted data for advertising, profiling, or analytics products of its own;
• sell, rent, or share submitted data with third parties for marketing purposes;
• build aggregate data products from customer data.

If a customer wants Innflyt to use data for any purpose beyond operating the service on the customer's behalf, that is a separate arrangement requiring an explicit written amendment to the Data Processing Agreement and a different legal basis.

Processing summary

Data we process

The personal data processed through the widget depends on what each customer configures. In the standard configuration, the fields are:

The widget does not solicit special categories of personal data within the meaning of Article 9 of the General Data Protection Regulation, nor criminal-conviction data within the meaning of Article 10. Because the feedback-message field is free text and screenshot attachments are user-initiated, end users may include such data voluntarily; Innflyt does not process any such data for any purpose beyond storing the submission and forwarding it to the customer. Host customers are encouraged to surface guidance in their own user interface inviting end users not to include sensitive personal data that the feedback itself does not require.

Screenshot attachments

End users may optionally attach one to five image files per submission (Portable Network Graphics, Joint Photographic Experts Group, or WebP; at most 5 megabytes each). Uploads use short-lived signed upload Uniform Resource Locators issued server-side; the widget never holds long-lived storage credentials.

Storage and delivery. Attachments are stored in a private (non-public) storage bucket with Universally Unique Identifier-based, non-enumerable object paths; bucket listing is disabled and the bucket is not publicly readable. Screenshots are delivered to the customer's configured destinations — webhook payloads, notification emails, and Slack — exclusively through signed, time-limited download Uniform Resource Locators that expire after a set period. A destination system follows the signed link to render or retrieve the image; the underlying object is not reachable through a public Uniform Resource Locator.

Orphan attachments (uploaded but never associated with a submission, for example because the end user closed the widget before submitting) are swept by a scheduled job twenty-four hours after upload.

Processing location

Primary processing happens in the European Economic Area, in the Stockholm, Sweden region. The managed database, the server-side ingestion endpoint, and the widget bundle distribution are all hosted in this region.

No primary processing happens outside the European Economic Area. Some sub-processors are headquartered outside the European Economic Area and may handle limited administrative metadata, such as source-code hosting and continuous-integration / continuous-deployment logs. Where this happens, it is covered by an appropriate transfer mechanism under Chapter V of the General Data Protection Regulation.

Security measures

Innflyt maintains the following technical and organisational measures. They are reviewed at least annually and updated in response to changes in risk, technology, or applicable law. A fuller list is recorded in Annex 2 of each customer's Data Processing Agreement.

• Encryption in transit. All traffic between the widget, the server-side ingestion endpoint, and Innflyt infrastructure is encrypted with Transport Layer Security version 1.2 or higher.
• Encryption at rest. Personal data is stored in a managed PostgreSQL database that encrypts data at rest with the Advanced Encryption Standard using 256-bit keys.
• Row-Level Security. Every database table containing customer data has Row-Level Security enabled with explicit policies. End-user anonymous access is denied on all such tables.
• Pseudonymisation. End-user Internet Protocol addresses are not stored. Rate limiting operates on a hashed, peppered identifier only.
• Signed webhooks. Every webhook dispatch carries a Hash-based Message Authentication Code using the Secure Hash Algorithm 256-bit, so that customers can verify integrity and authenticity before acting on the payload.
• Idempotency. The ingestion endpoint enforces a unique idempotency key per submission, so that a client retry cannot create a duplicate record.
• Asynchronous dispatch. Downstream destinations are decoupled from the end-user submission path through a durable queue, so that a slow or unavailable destination does not degrade the end-user experience and does not hold personal data in memory unnecessarily.
• Access control. Administrative access to Innflyt infrastructure is protected by multi-factor authentication. Service-role credentials and environment-variable secrets are stored only in encrypted continuous-integration secrets and server-side environment variables, never in source control or client-side code.
• Automated security scanning. Dependency vulnerability scanning, source-control security alerts, and managed-platform advisor scans run continuously. Findings are tracked and remediated on a risk-based schedule.

Sub-processors

Innflyt engages the following sub-processors. The list is updated when it changes; customers are notified as required by the Data Processing Agreement before a new sub-processor is engaged.

Cloudflare Email Service is currently in beta and its application programming interface may change before general availability. Customers whose procurement policies require general-availability sub-processors for outbound transactional email should request a transitional configuration that uses a general-availability provider for the email channel.

This list applies to the Innflyt processor relationship. The customer's own controller-side hosting and other systems are outside the scope of this page.

International transfers

Innflyt's primary processing infrastructure is hosted within the European Economic Area. Where a sub-processor is headquartered outside the European Economic Area, the transfer is covered by one of:

• an adequacy decision under Article 45 of the General Data Protection Regulation (for example, the European Union – United States Data Privacy Framework for certified United States entities);
• the Standard Contractual Clauses approved by the European Commission under Article 46(2)(c) of the General Data Protection Regulation, supplemented by any additional measures needed following a transfer-impact assessment; or
• another legally recognised transfer mechanism agreed in writing.

The mechanism applicable to each current sub-processor is shown in the Sub-processors table above.

Retention and deletion

By default, feedback submissions are retained for 365 days and optional screenshot attachments for 90 days, after which they are permanently deleted by an automated daily process. Screenshots can be given a shorter retention period than the feedback they accompany. Each customer can agree a different retention period within supported limits (a minimum of 30 days and a maximum of 3650 days), or choose to retain data until the customer deletes it. Deletion is permanent; Innflyt keeps a deletion log that records the project, the scope, and the counts and timestamp of each deletion and contains no end-user personal data.

On termination of the processor relationship, or at the customer's earlier written request, Innflyt returns or deletes all personal data processed on the customer's behalf within thirty (30) calendar days of receiving the request, and confirms the deletion in writing. Backup copies are overwritten on the ordinary backup-retention cycle.

Data subject requests

If an end user contacts Backroad AS directly to exercise any right under Chapter III of the General Data Protection Regulation (information, access, rectification, erasure, restriction, portability, objection, or rights relating to automated decision-making), Innflyt promptly forwards the request to the relevant customer (the controller) and does not respond substantively to the end user unless the customer has authorised a direct response in writing.

The customer remains the primary contact for end-user rights requests. End users should, in the first instance, contact the customer whose service they are using.

Breach notification

Innflyt notifies the affected customer of any personal-data breach without undue delay after becoming aware of the breach, and in any event within forty-eight (48) hours where reasonably possible. The notification contains the information required under Article 33(3) of the General Data Protection Regulation, to the extent available at the time, and is supplemented in phases if further information becomes available.

Customers are responsible for notifying supervisory authorities and data subjects as required under Articles 33 and 34 of the General Data Protection Regulation; Innflyt supports the customer with the information available.

Audit and documentation

Each Data Processing Agreement grants the customer the right to audit Innflyt's compliance with the Data Processing Agreement, subject to reasonable notice and confidentiality protections. Audit requests are made in writing to the contact below. Innflyt makes available, on request:

• documentation of compliance with the Data Processing Agreement, including a summary of the technical and organisational measures in force;
• recent security assessments, penetration-test results, or third-party attestations, where available;
• reasonable access to records and systems necessary to demonstrate compliance.

Reference implementations of the webhook signature verification routine (Node.js, Python, and Go) are available on request from the operational contact, and will be published in the Innflyt developer documentation when that documentation is available.

Disclosure text for your privacy policy

Under Article 28 of the General Data Protection Regulation you are the controller for the feedback your end users submit, and you must tell them in your own privacy notice that a processor is involved. Innflyt cannot do this for you — it has to appear on your site, in your voice.

Copy the text below into your privacy policy, under a "Third-party services" or "Sub-processors" heading. Adopting it is part of onboarding.

Before you publish it, change the two bracketed retention figures if you have agreed a retention period other than the default, and delete the brackets. Everything else is accurate as written and should not be softened — the figures and locations are the ones Backroad AS is contractually bound to.

Feedback and in-product support (Innflyt)

We use Innflyt, a product of Backroad AS (organisation number 934 341 929,
Bergen, Norway), to collect and handle the feedback you send us through the
feedback button on this site. We are the data controller for that feedback.
Backroad AS is our data processor under Article 28 of the General Data
Protection Regulation (GDPR) and processes it only on our documented
instructions, under a written Data Processing Agreement.

What is collected when you submit feedback: the message you write; the
category you select; whether you mark it urgent; the address of the page you
were on; your browser's user-agent string; the time of submission; and, if you
choose to provide them, an email address so we can reply and up to five
screenshot images. Your IP address is not stored — it is used only as a
pseudonymised hash, to limit how often feedback can be submitted.

Where it is processed: within the European Economic Area (Stockholm, Sweden).
Some of Backroad AS's sub-processors are established outside the European
Economic Area and may handle limited administrative metadata; those transfers
are covered by an adequacy decision or by the European Commission's Standard
Contractual Clauses.

How long it is kept: feedback is retained for [365] days and screenshot
attachments for [90] days, after which both are permanently deleted.

Your feedback is not used to train artificial-intelligence models, is not used
for advertising or profiling, and is not sold or shared with third parties for
marketing.

Backroad AS publishes the details of this processing, including the current
list of sub-processors, at https://innflyt.com/processor-info.

One thing this text cannot do for you. The feedback message and any screenshot are free-form, so an end user may volunteer special-category data (Article 9) that you never asked for. Innflyt does not solicit it and processes it only to store and forward the submission, but the most effective control is at your end: add a short line near your feedback entry point asking users not to include sensitive personal information that the feedback itself does not require.

Contact

Postal address: Backroad AS, Bergen, Norway.

Supervisory authority. The competent supervisory authority for Backroad AS is the Norwegian Data Protection Authority (Datatilsynet), Oslo, Norway.