Trust center

Data flow

1. A feedbacker submits plain text through a cookie-free public form for the individual requester’s independent professional development.
2. Symfony validates the text, nonce, permitted-purpose prompt, and rolling channel quota before PostgreSQL stores a conversation and message atomically.
3. A secret return link is shown after the first accepted submission and remains usable until it is revoked or the conversation is deleted; after 24-hour retry material expires, only its lookup hash remains.
4. The authenticated individual requester reads and replies through an owner-scoped inbox.
5. An optional requester-authored report sends an opaque reference and description through the configured Symfony Mailer transport to the private report mailbox without copying feedback automatically.
6. An authenticated requester who opens paid-plan or subscription-management surfaces interacts with Stripe-hosted Pricing Table, Checkout, or Customer Portal pages; Stripe/Link is the merchant of record for Managed Payments transactions.

Subprocessors

Hostinger

EU-hosted application, PostgreSQL, network, and rolling VPS snapshots — Candidate for live service; production terms, location, logging, snapshot, and retention controls remain launch-time verification gates

Google

Requester OAuth and, when an approved Google mailbox is configured through Symfony Mailer, report or Enterprise-message delivery — Candidate for live service; production provider terms and the ordinary Gmail deviation require explicit owner approval before launch

Retention

Feedback messages

Each message expires no later than 12 months after its own receipt unless an earlier valid deletion instruction or documented legal hold applies; the requester cannot extend this maximum.

Conversation and return-secret material

Retained while a message remains; live deletion is immediate, while snapshots may retain and restore prior data for up to 30 days.

Form and idempotency hashes

No longer than 24 hours after their operational purpose ends.

Daily quota usage

31 days.

Requester OAuth identity and editable public display name

Active account lifetime, then verified closure or erasure within 30 days unless a narrow legal obligation applies.

Requester-authored feedback report descriptions

Potentially sensitive support data retained under the approved support-record policy; mailbox retention remains policy-owned and is not enforced or periodically verified by the application.

Permanent operator audit events

Retained indefinitely without feedback text or direct identity under the approved minimized-audit policy; residual linkability is an accepted limitation.

Documented operator claims

These server-side properties cannot be proved from a browser response. They require deployment review and operator evidence.

• Reverse-proxy diagnostics record only numeric HTTP and upstream statuses, including error responses; request metadata and unredacted proxy error logging are disabled.
• Application and infrastructure logs do not retain feedback content, bearer secrets, public tokens, source addresses, referrers, or user agents from public routes.
• The application increments aggregate daily operational counters without retaining public-route event records; the manual retention command removes counter rows older than 90 days.
• The named operator runs retention and privacy checks manually; the MVP has no scheduler or external monitoring service.