Privacy Policy

This English version is provided for convenience. In the event of any conflict or inconsistency, the Japanese version prevails.

Masashi Ohtsubo, trading as DESIGN PIECE (“we”, “us”, or “our”) establishes this Privacy Policy for the handling of personal information in NeedBack (the “Service”).

1. Information we collect

We collect the following information when providing the Service.

Account information, including name, email address, authentication information, and organization information
Information about external reviewers registered by users, including email addresses, display names, invitation status, and usage status
Review comments and related data, including comment text, target URLs, and positions on the screen
Evidence screenshots automatically captured by the Service
Screen recordings and microphone audio where the user has granted permission
Payment information, collected through our payment processor as described in “4. Payment information” below
Log information about use of the Service, including access time, IP address, and features used

2. Purposes of use

We use the information we collect for the following purposes.

To provide, maintain, protect, and improve the Service
To respond to user inquiries
To bill for and process payments for Service fees
To send important notices about the Service
To address conduct that violates the Terms of Service
For purposes incidental to those listed above

3. Information about external reviewers registered by users

When a user invites a client or other third party as a registered reviewer, we process the reviewer’s email address, display name, and usage status on the user’s behalf to the extent necessary to provide the Service. The user that registered the reviewer is responsible for managing this information, and we process it according to that user’s instructions. A reviewer who wishes to request disclosure, correction, or deletion should first contact the user who sent the invitation. We enable that user to use the Service’s deletion features and assist as necessary.

4. Payment information

Payments for paid plans are processed through Stripe, Inc. (“Stripe”). Stripe directly collects and manages payment information such as credit card numbers; we do not store credit card numbers on our servers.

5. Disclosure to third parties

We do not provide personal information to third parties without the user’s consent. However, to the extent necessary to provide the Service, we may entrust the following infrastructure and service providers with the handling of information.

Stripe (payment processing)
Cloudflare (D1/R2/API infrastructure, email delivery, application hosting, content delivery, and security)

These providers handle information appropriately under their privacy policies and our agreements with them.

6. Cookies and analytics tools

We use Google Analytics and Google Tag Manager, provided by Google LLC, on the Service’s website to understand how it is used and to improve it. These tools use cookies and send the following information to Google LLC.

Identifiers assigned by cookies
IP address
URLs of the pages viewed and referring URLs
Browser and device information, including user agent, language settings, and screen size
Interactions on the website, such as buttons clicked, questions opened, and pricing display switched

The information sent is handled under Google LLC’s privacy policy. We do not identify individuals from this information, and we do not send the text entered in the website’s search form or chat to these tools.

We also use cookies necessary for the Service to work, such as retaining the display language.

If you do not want cookies to be used, you can disable them in your browser settings or use the Google Analytics Opt-out Browser Add-on provided by Google. Disabling cookies that are necessary for the Service may prevent some features from working correctly.

For access from the European Economic Area, the United Kingdom, and Switzerland, we do not store analytics cookies.

7. Evidence data, including screenshots and screen recordings

Screenshots and screen recordings are stored in private storage. Access is limited to authenticated users in the relevant organization or through signed URLs valid for 10 minutes. Our authorized personnel may access them only to the minimum extent necessary for support, incident or security investigations, or where required by law. Password fields and elements marked with data-needback-redact are automatically masked when screenshots are captured. Screen recordings record the screen selected by the user in the browser, and microphone audio is recorded only when the user grants permission. Content displayed in a screen recording is not automatically masked; please ensure that the selected recording area does not include confidential information.

8. Retention period

We retain users’ project data, including review comments, evidence screenshots, screen recordings, and recorded microphone audio, for the following periods according to the applicable plan, and delete data in sequence after the relevant period.

Free: 30 days
Pro: 1 year (365 days)

Deleted review comments are deleted immediately on Free. On Pro, they remain recoverable for 30 days before being permanently deleted.

When a registered reviewer is deleted, we immediately delete that reviewer’s email address and display name and anonymize their name as “Former reviewer” in past comments and replies. Comment text is retained as part of the user’s business records for the project-data retention period.

When a user withdraws from the Service by deleting an account, we delete that user’s account information and related data within a reasonable period, except where retention is required by law.

9. Contact

For inquiries about the handling of personal information in the Service, or requests for disclosure, correction, or deletion, please contact us at the address below.

hello@needback.io