Privacy Policy

Sensa is a visitor feedback platform operated by BNB, s.r.o., Vyšný Klátov 180, Vyšný Klátov, 04412, Slovakia (IČO 47483687).

If you have any questions about this policy, contact us at hello@sensahq.com.

When a visitor uses a Sensa feedback kiosk, we collect no personal data. Specifically:

• No name, email address, or other identifying information is requested.
• No cookies are set on kiosk devices.
• No device fingerprinting or IP address logging is performed.
• No account or login is required.

Feedback responses (ratings and optional text answers) are stored anonymously and linked only to the survey and location — never to an individual.

When you register for a Sensa account, we collect and process the following data:

• Name — to personalise your experience.
• Email address — for login, notifications, and support.
• Organisation name — to identify your account context.
• Billing information — processed by Stripe on our behalf (we do not store card numbers).

Legal basis (GDPR): Performance of a contract (Art. 6(1)(b)) for account and billing data; legitimate interests (Art. 6(1)(f)) for product improvement and security.

We use account holder data solely to:

• Provide and operate the Sensa service.
• Send transactional emails (account confirmation, password reset, invoices).
• Respond to support requests.
• Comply with legal obligations.

We do not sell your data to third parties or use it for advertising.

All data is stored in the European Union. Our infrastructure providers and their regions are:

• Supabase (database and authentication) — eu-west-1 (EU – Ireland)
• Vercel (application hosting) — EU edge regions
• Stripe (payment processing) — EU data residency

Data is not transferred outside the European Economic Area (EEA) except where sub-processors have appropriate safeguards in place (Standard Contractual Clauses or equivalent).

• Anonymous feedback responses — retained for 2 years from collection, then deleted.
• Account data — retained for the duration of your account. After account deletion, data is purged within 30 days.
• Billing records — retained for 10 years as required by Slovak accounting law.

Sensa uses minimal cookies. On the dashboard and account pages, a single authentication session cookie is set to keep you logged in. This cookie:

• Is strictly necessary — no consent banner is required under ePrivacy Directive.
• Is not used for tracking or advertising.
• Is not set on kiosk survey pages.

We use Vercel Analytics for aggregate, privacy-preserving site analytics. Vercel Analytics does not use cookies and does not track individual users.

We use PostHog for product analytics:

• Marketing pages (/, /pricing,/signup, etc.) — PostHog is only activated after you accept analytics cookies via the consent banner. You may decline and no analytics cookies or local storage entries will be set.
• Admin dashboard — PostHog is active for logged-in account holders. Use of the dashboard is governed by our Terms of Service, which include standard SaaS analytics.
• Kiosk survey pages — PostHog is never loaded on kiosk pages. Kiosk visitors are never tracked.

PostHog stores data in the EU (eu.i.posthog.com) using both cookies and local storage. Account holders' email addresses are used to link analytics sessions to accounts. You can withdraw or change your analytics consent at any time by clicking Cookie preferences in the footer; the consent banner will reappear immediately.

We use Google Ads with Consent Mode v2 (cookieless measurement) on our marketing website. Google Ads is loaded with all consent signals set to denied by default — meaning no advertising or analytics cookies are set. Google receives only cookieless, aggregated conversion signals (modelled conversions) to measure the effectiveness of our ads.

If you are in the European Economic Area, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data (“right to be forgotten”).
• Portability — receive your data in a structured, machine-readable format.
• Restriction — request that we limit processing of your data.
• Objection — object to processing based on legitimate interests.

To exercise any of these rights, email hello@sensahq.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Slovak Data Protection Authority (Úrad na ochranu osobných údajov Slovenskej republiky, dataprotection.gov.sk).

We share data with the following sub-processors, each bound by a Data Processing Agreement:

• Supabase, Inc. — database, authentication, and file storage
• Vercel, Inc. — application hosting and edge delivery
• Stripe, Inc. — payment processing and invoicing
• PostHog, Inc. — product analytics (EU hosting; consent-gated on marketing pages; always active on dashboard under SaaS terms)
• Google LLC — cookieless Google Ads conversion measurement (Consent Mode v2; no advertising cookies set)

We apply industry-standard security measures including TLS encryption in transit, row-level security in the database, and access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. Material changes will be communicated by email to account holders. Continued use of the service after changes constitutes acceptance.

BNB, s.r.o.
Vyšný Klátov 180
Vyšný Klátov, 04412
Slovakia

Email: hello@sensahq.com