Feedblick

Privacy policy

Last updated: July 2026

This privacy policy applies to the website at https://feedblick.biodatum.io.

This privacy policy describes what data Feedblick processes and how, drafted in good faith based on the features currently in use. It is not a substitute for legal review — please have it checked by a lawyer or data protection officer before relying on it, especially once freelance business registration is complete.

Controller

The controller within the meaning of the GDPR is:

Name:
Dr. Sergio Vargas - biodatum.io
Address:
Nadistr. 06, Muenchen
Email:
info@biodatum.io

Full details (incl. tax number / VAT ID once available) are on the Legal notice.

Hosting and server logs

Feedblick uses Supabase for its database, authentication, file storage, and realtime updates, and Vercel Inc. to host and serve the web application itself. Visiting the site automatically causes technical information (e.g. IP address, time of access, browser used, and request metadata in server logs) to be processed by these providers' infrastructure. This is technically necessary to deliver the website and ensure server stability (Art. 6(1)(f) GDPR). Vercel's Frankfurt region (eu-central-1) is selected for hosting, so this data stays within the EU — see the Sub-processors section below for details.

Your rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you (Art. 15)
  • Have inaccurate data corrected (Art. 16)
  • Have your data deleted (Art. 17)
  • Request restriction of processing (Art. 18)
  • Receive your data in a portable format (Art. 20)
  • Object to processing (Art. 21)
  • Lodge a complaint with a supervisory authority (Art. 77)

Registration and teacher accounts

Using Feedblick as a teacher requires an account. This stores your email address and an encrypted password (Art. 6(1)(b) GDPR, to perform the contract of use). You can alternatively sign in via "Continue with Google"; doing so transfers data to Google LLC, and Google's own privacy policy additionally applies.

Student responses on /live

Students don't need an account and never sign in. Responses are stored without names or other direct identifiers. Which questions have already been answered, and their shuffled order, are remembered locally in the browser (see below) and never leave the student's device. For free-text answers, it's the responding person's own responsibility not to type personal data into the answer text itself.

Local storage (no tracking)

The following is stored only in your browser, not on our servers (except the session token, needed for authentication):

  • feedblick.lang — Language preference
  • feedblick-theme — Light/dark theme preference
  • feedblick-palette — Student's chosen color palette
  • feedblick-answered — Which questions have already been answered in this session
  • sb-*-auth-token — Login session token (signed-in teachers only)

None of this is used for tracking or behavioral analysis. In our assessment, this storage is technically necessary to provide a feature the user explicitly requested and is therefore exempt from consent under §25(2) TTDSG — please have this assessment checked if in doubt.

Embedded content (YouTube, Vimeo)

Teachers can attach YouTube or Vimeo videos to questions. These do not load automatically — only a thumbnail is shown at first. The embedded player only loads once someone actively clicks "Load video"; only from that point can the respective provider process data or set cookies. For YouTube we additionally use its privacy-enhanced mode (youtube-nocookie.com). Once loaded, the respective provider's own privacy policy (YouTube/Google or Vimeo) applies.

"Buy Me a Coffee"

The "Buy me a coffee" button links to the external site buymeacoffee.com. It is a plain link with no embedded widget or tracking script on our side; once you follow the link, Buy Me a Coffee's own privacy policy applies.

Sub-processors

We use the following service providers as processors or independently responsible parties: Supabase, Inc. (hosting, database, authentication, file storage, realtime) and — only if you use "Continue with Google" — Google LLC (sign-in). A data processing agreement under Art. 28 GDPR is in place (or being put in place) with Supabase. Vercel Inc. is used to host and serve the web application itself. See the details for Supabase and Vercel below.

Service:
Vercel Inc., 340 Pine Street, Suite 701, San Francisco, CA 94104, USA
Purpose:
Hosting and serving the web application
Data processed:
IP addresses, request metadata (server logs)
Safeguard:
Vercel's Frankfurt region (eu-central-1) is selected — data stays in the EU. Vercel is DPA-certified. See Vercel's privacy policy

No Vercel Analytics is enabled.

Service:
Supabase Inc., 970 Toa Payoh North, #07-04, Singapore 318992 (EU data stored on AWS eu-central-1, Frankfurt)
Purpose:
Database, authentication, file storage, and realtime infrastructure
Data processed:
Teacher account data, question content, anonymous student responses, session metadata
Safeguard:
Data is stored in AWS eu-central-1 (Frankfurt, EU). Supabase is SOC 2 Type II certified and offers a DPA. See Supabase's privacy policy

Student responses contain no names or other identifiers — only answers and timestamps.

Retention

Personal data is deleted once the purpose of processing no longer applies, or on request, unless a legal retention obligation applies. Teachers can delete their account and associated data via the account/admin functions at any time, or request deletion by email.

Contact for privacy questions

For any privacy questions, please contact: info@biodatum.io

Changes to this policy

This privacy policy is updated as needed, e.g. for new features or changes in the law. The version currently published on this page always applies.