Privacy notice

TellsU is a service that lets software developers collect feedback from the people who use their apps. This notice explains what personal data TellsU handles, why, and what rights you have. It has two parts, because TellsU plays a different role in each:

• If you sent feedback through a TellsU feedback page, TellsU handles it for the app’s developer.
• If you use TellsU as a developer, TellsU handles your account details for itself.

Who we are

TellsU is a trading name of Zilobyte Ltd, a company registered in England and Wales (“TellsU”, “we”, “us”).

• Company number: 17576520
• Registered office and postal address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
• Email: privacy@tellsu.com
• Registered with the UK Information Commissioner’s Office: [ICO registration number]

If you sent feedback

You reached a TellsU feedback page from an app, a browser extension, a WordPress plugin or a link. The feedback goes to that app’s developer.

The developer is responsible for your feedback (under UK and EU data protection law, they’re the controller). TellsU processes it on the developer’s behalf and only on their instructions (we’re their processor), under a data processing agreement. The developer’s own privacy policy applies too, and they’re the right first contact for questions about your feedback.

What’s sent

Nothing is sent until you click Send. Before you do, the feedback page shows you everything about you and your environment that will be sent.

• What you write and choose: your message, the feedback type (bug, idea, question or praise), the face you picked if any, and your answers to any questions the developer added.
• Your email address, only if you type it, so the developer can reply.
• Your environment: the app’s version; your browser and operating system, with their versions, which the page detects; and the details the app passes, such as the software it runs inside (for example WordPress) and its version, the runtime (for example PHP) and its version, the release channel, the edition, the WordPress theme and whether the site is a multisite, and the name of the app’s screen you came from. The developer can allow a few extra values of their own, which are shown to you in the same way.
• Details of the developer’s set-up, which say nothing about you and so aren’t shown on the page: whether you came from the app’s button or a link, the button’s version, and whether it shows “Powered by TellsU”.

Values that look like email addresses or long codes are masked when they arrive in a link, and every value has a length limit.

TellsU never collects your browsing history, the addresses of pages you visit, your tabs, page contents or cookies from the app, and the app needs no extra permissions to use TellsU.

Spam protection and your IP address

The feedback page uses Cloudflare Turnstile to tell people from automated spam. Turnstile looks at technical information about your browser and your connection, including your IP address, to make that check; see Cloudflare’s privacy policy. TellsU also uses your IP address to limit how many submissions can come from one address. Your IP address isn’t stored with your feedback or shown to the developer; the counters that use it expire within an hour.

The feedback page sets no cookies and uses no analytics, advertising or tracking.

What happens to your feedback

The developer sees your feedback in their TellsU dashboard. Depending on their settings, TellsU also forwards it to them by email or to a destination they’ve set up, such as Slack, Discord or their own systems through a webhook.

TellsU deletes feedback automatically 12 months after it’s sent, or sooner if the developer has chosen a shorter period for their app. The developer can also delete it at any time. TellsU never sells feedback or uses it for its own purposes, beyond counting it in totals about how the service is used.

Your rights over your feedback

Because the developer controls your feedback, ask them to see, correct or delete it. If you contact us instead, we’ll pass your request to the developer and help them answer it.

If you use TellsU as a developer

For your account, TellsU is the controller: we decide how your details are used, as described here.

What we collect

• Account details: your name and email address, and for each way you sign in (GitHub, Google or an emailed link), the provider’s ID for you and the email address it reports. We receive these from GitHub or Google only if you choose to sign in with them.
• What you set up: your apps and their settings, forwarding destinations, custom questions and logos.
• Sign-in sessions: while you’re signed in, your IP address and your browser’s user agent are stored with your session, which ends after two hours without activity.
• Billing: payments are handled by Paddle (see below). We receive and keep your subscription, its status and your transactions (amounts, dates and invoice numbers), but never your card details.
• Email: we send you sign-in links, forwarded feedback if you’ve set it up, and messages about your account, such as reaching a plan limit. We don’t send marketing email.

Why we use it, and our lawful bases

• To provide TellsU to you (performance of our contract with you): signing you in, running your apps, forwarding feedback and billing.
• To keep TellsU secure and working (our legitimate interests): stopping abuse, fixing faults, and counting usage in totals to understand how the service is used and plan it.
• To meet legal obligations, such as keeping accounting and tax records.

How long we keep it

We keep your account details for as long as you have an account. Deleting your account, which you can do yourself in the dashboard, deletes your account details, your apps and all their feedback straight away. Copies in our backups are overwritten within [backup retention period]. We keep billing and accounting records for as long as UK tax law requires, usually six years.

Cookies and similar technology

• Dashboard (app.tellsu.com): two cookies needed to sign you in and keep you signed in securely: a session cookie and a security token against cross-site request forgery. They’re strictly necessary, so we don’t ask for consent to them.
• Feedback page (go.tellsu.com): no cookies.
• This website, the docs and the dashboard: if you choose a light or dark theme, one cookie (tellsu-theme) remembers it for a year on tellsu.com and its subdomains, so the choice holds across the website and the dashboard. It holds only light or dark, and choosing the system’s theme removes it. You set it yourself for a feature you asked for, so we don’t ask for consent to it. The feedback page receives it with your browser’s requests but doesn’t use it.

TellsU uses no analytics, advertising or tracking cookies anywhere.

Who we share data with

We use these providers to run TellsU. Each handles personal data only to provide their service to us, under contracts that require them to protect it.

Provider	What for	Where
[Hosting provider]	Hosting the service and its database	[Hosting region]
Cloudflare, Inc.	Network delivery and security; Turnstile spam protection	Worldwide, including the US
Resend (Plus Five Five, Inc.)	Sending email	United States
Netlify, Inc.	Hosting this website and the docs (no feedback or account data)	Worldwide, including the US

Paddle (Paddle.com Market Ltd) sells TellsU subscriptions as merchant of record: you buy from Paddle, which handles payment, tax and invoices, and uses your payment details as its own controller under Paddle’s privacy notice. GitHub and Google handle your details under their own privacy policies when you sign in with them.

We’d also disclose personal data if the law required it, and if TellsU were ever sold, the buyer would take on this notice. We never sell personal data.

International transfers

Some providers above are in the United States or elsewhere outside the UK and the European Economic Area. Where personal data goes to a country without an adequacy decision, we rely on the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified.

Your rights

Under UK and EU data protection law you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or send it to you or someone else in a portable form. As a developer, you can export your feedback and delete your account yourself, without asking.

To use any of these rights, email privacy@tellsu.com. We’ll answer within one month. If you’re unhappy with how we’ve handled your data, you can complain to the UK Information Commissioner’s Office, or to the data protection authority where you live in the EU, but we’d appreciate the chance to put it right first.

Changes to this notice

If we change this notice, we’ll update the date at the top. If a change matters to how we use developers’ data, we’ll email account holders before it takes effect.