Privacy policy

This policy explains what personal data Praxis collects, why, and what rights you have over it. It applies to everyone who uses Praxis — whether you've created an account, or you're submitting feedback anonymously via a session code or QR code.

Who we are

Praxis (“we”, “us”) is the data controller for the personal data described below. For any question about this policy or your data, contact privacy@praxisfeedback.com.

What we collect

If you create an account (teachers/facilitators)

• Email address and password (your password is hashed and never visible to us)
• Anything you add to your profile: name, job role, workplace, bio
• The sessions you create (title, type, date, duration, location) and the feedback responses collected for them

If you submit feedback (respondents)

• Your ratings and any free-text comments you write
• Your name and role, but only if you actively choose to share them — feedback can always be submitted anonymously
• Your name and email address, but only if you request a proof-of-attendance certificate
• A one-way hash of your IP address, used only to prevent automated spam submissions — never your raw IP address, and never used to identify you

We ask respondents not to include patient- or client-identifiable information in free-text answers. We don't automatically screen or redact free-text content — please take care what you write.

Why we process it, and our legal basis

• Providing the service — creating your account, storing your sessions and responses, generating PDF exports and certificates (necessary to perform our contract with you)
• Preventing abuse — the IP hash above, used to rate-limit spam submissions to the public feedback form (our legitimate interest in keeping the service usable)
• Understanding usage — aggregate, non-identifying traffic analytics (see Cookies & analytics below)

Where your data is stored

Your data is stored in a Supabase database hosted in London, UK. The application itself runs on Vercel, a US-based hosting provider whose infrastructure may process requests outside the UK/EEA; where that happens, Vercel is contractually bound by Standard Contractual Clauses or an equivalent safeguard recognised under UK GDPR.

Who we share it with

We use a small number of service providers (“processors”) to run Praxis. We don't sell your data to anyone.

• Supabase — database hosting and authentication
• Vercel — application hosting, and privacy-friendly, cookie-free traffic analytics (page views only — no personal data)

If you request a proof-of-attendance certificate, or if a paid plan and its features (custom forms, AI-generated insights, billing) become available in future, additional processors may be involved — this policy will be updated before that happens, and any new processor will be held to the same standard of care as those listed above.

How long we keep it

We keep your account and session data for as long as your account is active. If you delete a session, its responses are deleted with it. If you delete your account, contact us and we will erase your personal data within 30 days, except where we're required to retain it for a legitimate purpose (for example, fraud prevention records held briefly after account closure). Certificates and PDF exports are generated on request and are not stored by us — you keep your own copy.

Cookies & analytics

Praxis uses one essential cookie to keep you signed in — this is required for the service to function and isn't used for tracking or advertising. We use Vercel's Web Analytics for aggregate traffic statistics (e.g. page views); it's designed not to use cookies or collect personal data.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data
• Object to or restrict certain processing
• Receive your data in a portable format

To exercise any of these, email privacy@praxisfeedback.com. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

Children

Praxis is intended for use by adults in professional or higher-education teaching contexts, not by children.

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page. We encourage you to review it occasionally.