Privacy Policy

Sensa is a visitor feedback platform operated by BNB, s.r.o., Vyšný Klátov 180, Vyšný Klátov, 04412, Slovakia (IČO 47483687).

If you have any questions about this policy, contact us at hello@sensahq.com.

When a visitor uses a Sensa feedback kiosk, we collect no personal data. Specifically:

• No name, email address, or other identifying information is requested.
• No cookies are set on kiosk devices.
• No device fingerprinting or IP address logging is performed.
• No account or login is required.

Feedback responses (ratings and optional text answers) are stored anonymously and linked only to the survey and location — never to an individual.

When you register for a Sensa account, we collect and process the following data:

• Name — to personalise your experience.
• Email address — for login, notifications, and support.
• Organisation name — to identify your account context.
• Billing information — processed by Stripe on our behalf (we do not store card numbers).

Legal basis (GDPR): Performance of a contract (Art. 6(1)(b)) for account and billing data; legitimate interests (Art. 6(1)(f)) for product improvement and security.

We use account holder data solely to:

• Provide and operate the Sensa service.
• Send transactional emails (account confirmation, password reset, invoices).
• Respond to support requests.
• Comply with legal obligations.

We do not sell your data to third parties or use it for advertising.

All data is stored in the European Union. Our infrastructure providers and their regions are:

• Supabase (database and authentication) — eu-west-1 (EU – Ireland)
• Vercel (application hosting) — EU edge regions
• Stripe (payment processing) — EU data residency

Data is not transferred outside the European Economic Area (EEA) except where sub-processors have appropriate safeguards in place (Standard Contractual Clauses or equivalent).

• Anonymous feedback responses — retained for 2 years from collection, then deleted.
• Account data — retained for the duration of your account. After account deletion, data is purged within 30 days.
• Billing records — retained for 10 years as required by Slovak accounting law.

Sensa uses minimal cookies. On the dashboard and account pages, a single authentication session cookie is set to keep you logged in. This cookie:

• Is strictly necessary — no consent banner is required under ePrivacy Directive.
• Is not used for tracking or advertising.
• Is not set on kiosk survey pages.

We use Vercel Speed Insights to measure page performance (loading and responsiveness). It measures the page, not the person: no cookies, no identifier, and no user-level data. It is not loaded on kiosk survey pages.

We use Umami (EU-hosted) for aggregate website traffic statistics — page views, referrers, country, browser and device type. Alongside page views it records a small set of anonymous interaction events that mark steps in our signup funnel — that a signup was started or completed, that a checkout was started, which plan and billing period you selected, and (if you join the waitlist) which organisation type you chose. These events carry only those non-identifying selections — never your name, email, or any other personal detail. Umami sets no cookies, stores nothing on your device, and creates no cross-site identifier, so no consent is required for it and there is nothing to decline. It records only the page path, never the query string, so anything carried in a link's parameters (such as a password-reset token) is never sent to it. It is never loaded on kiosk survey pages.

We use PostHog for product analytics:

• Marketing pages (/, /pricing,/signup, etc.) — PostHog is only activated after you accept analytics cookies via the consent banner. You may decline and no analytics cookies or local storage entries will be set.
• Admin dashboard — PostHog is active for logged-in account holders. Use of the dashboard is governed by our Terms of Service, which include standard SaaS analytics. Google Ads (Consent Mode v2) also loads here, but sets advertising cookies only if you accepted them via the cookie banner on our website; otherwise it stays cookieless (see below).
• Kiosk survey pages — PostHog, Umami, Google Ads and Speed Insights are never loaded on kiosk pages, and no analytics event of any kind is sent from them. Kiosk visitors are never tracked. The only thing recorded is the feedback you choose to submit, stored in our own database.

PostHog stores data in the EU (eu.i.posthog.com) using both cookies and local storage. Account holders' email addresses are used to link analytics sessions to accounts. You can withdraw or change your analytics consent at any time by clicking Cookie preferences in the footer; the consent banner will reappear immediately.

We use Google Ads with Consent Mode v2 across our website and the admin dashboard (never on kiosk survey pages). Google Ads is loaded with all consent signals set to denied by default. Advertising cookies are set only after you explicitly accept via the cookie banner on our website; your choice is remembered and carried across to the dashboard, so accepting once is what allows advertising cookies there too. If you decline or do not answer, no advertising cookies are set anywhere and Google receives only cookieless, aggregated conversion signals (modelled measurement) to gauge the effectiveness of our ads. You can withdraw your consent at any time by clicking Cookie preferences in the footer of our website; the banner reappears and declining clears the advertising signals again.

If you are in the European Economic Area, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data (“right to be forgotten”).
• Portability — receive your data in a structured, machine-readable format.
• Restriction — request that we limit processing of your data.
• Objection — object to processing based on legitimate interests.

To exercise any of these rights, email hello@sensahq.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Slovak Data Protection Authority (Úrad na ochranu osobných údajov Slovenskej republiky, dataprotection.gov.sk).

We share data with the following sub-processors, each bound by a Data Processing Agreement:

• Supabase, Inc. — database, authentication, and file storage
• Vercel, Inc. — application hosting and edge delivery
• Stripe, Inc. — payment processing and invoicing
• PostHog, Inc. — product analytics (EU hosting; consent-gated on marketing pages; always active on dashboard under SaaS terms)
• Umami Software, Inc. — aggregate website analytics (EU hosting; cookieless, no personal data, no cross-site identifiers)
• Google LLC — Google Ads conversion measurement (Consent Mode v2; cookieless by default, advertising cookies only after explicit consent)

We apply industry-standard security measures including TLS encryption in transit, row-level security in the database, and access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. Material changes will be communicated by email to account holders. Continued use of the service after changes constitutes acceptance.

BNB, s.r.o.
Vyšný Klátov 180
Vyšný Klátov, 04412
Slovakia

Email: hello@sensahq.com