Privacy
What ReviewLoop knows about you
ReviewLoop carries what someone says about a website to the people building it. This page says exactly what travels with it, which companies touch it, how long it is kept, and how to have it removed. Last updated .
The short version
- We sell nothing and share nothing for advertising. There is no advertising or analytics code here.
- The browser extension is off until you switch it on, one tab at a time.
- It records what you clicked, never what you typed. Password fields are not even named.
- This site sets two cookies, both strictly necessary. That is why you were not asked about cookies.
- Your feedback is never used to train an AI model, ours or anyone else’s.
- Write to privacy@durn.io and we answer within a month.
Who is responsible
The controller for the processing described here, in the sense of Article 4(7) GDPR, is:
Durn Studio UG (haftungsbeschränkt)Kienitzer Str. 5
12053 Berlin
Deutschland
privacy@durn.io
We have not appointed a data protection officer. We are below the threshold in § 38 BDSG, which requires one once at least twenty people are permanently engaged in automated processing. Data protection questions go to the address above and reach a person, not a queue.
When we are not the controller
Two organisations are involved in every piece of feedback, and which is which decides who you ask for what. The studio you are reviewing for decides that the review should happen, what to collect and how long to keep it. They are the controller for your feedback. We store and process it on their written instructions under Article 28 GDPR, and we do nothing else with it.
In practice you can write to either of us. If you ask us to delete feedback you left for a studio, we will tell you and pass the request on, because theirs is the copy that matters and the decision is legally theirs. For your own account with us, and for this website, we are the controller and we decide.
If you are reviewing a website
You arrived from a review link, you entered a code the studio sent you into the browser extension, or somebody paired the extension for you. Entering a code sends us the code and the name you typed, so the notes you leave carry your name; nothing else is collected until you place a note. When you place one, what goes with it is:
- What you wrote, kept as you wrote it, and the name shown on the note.
- Replies you write to other people on the same project. If you mention someone by name, they get an email with the lines you wrote so they can answer.
- Your email address, if the studio invited you by email or you asked to be told what happened.
- A picture of the visible part of the tab, taken at the moment you asked for it.
- Which element you pointed at, the text around it, and how it is styled.
- The last minute of what you did: clicks, page changes and form submissions, recorded as labels. A click on Save is recorded as a click on Save. What you typed into a field is not recorded, and a password field is not even named.
- Errors the page produced in that same minute, and requests that failed.
- Any file you attach yourself: a picture, or a PDF, which is split into one page per screen so you can point at things inside it. Only files you pick, paste or drag in. Nothing else is read from your computer, and there is no way for us to go looking.
- A voice note, if you choose to leave one instead of typing. Your browser asks for the microphone first, and the recording is kept with the note like any other words. Nothing listens at any other moment.
- A picture of a window you choose, if you use Add a screenshot. Your browser asks what to share and you pick it; we take one frame and the sharing stops immediately. Because the choice is yours, it can be a window other than the page you are reviewing, so pick the one you mean to send.
- The address and title of the page, the size of the window, your browser and its language, and the page you came from.
That is the whole list. Nothing follows you to other websites and no browsing history is collected. A file you attach is treated exactly like the rest of the round: it goes to the studio you are reviewing for, it is deleted when the project is, and you can remove one yourself before you send. Our legal basis is Article 6(1)(f) GDPR, our legitimate interest and the studio’s in getting a change described precisely enough to make once. Against that sits a deliberately narrow collection: one minute, labels only, and only on a page you opened for the purpose.
The browser extension
The extension is switched off until you click its icon, and then it works on that one tab only. Clicking the icon is what grants it access to the page, which is why it asks for no standing permission over your browsing. If you navigate to a different site it switches itself off rather than follow you.
It stores, in your own browser and nowhere else, the name you gave and your reviewer identity for each project you joined with a code. If a developer paired the browser instead, it also stores the token that identifies the browser to the studio’s account and the list of projects that account can see. Those never appear on a page and no website can read them. Removing the extension removes them. The studio decides whether the extension works for its project at all: when it switches it off, the identity stored for that project stops working. The extension reads the address of a tab you have switched it on for, so it can tell which project that site belongs to; it does not read the tabs you have not.
If you have an account
We hold your name and email so you can sign in and your colleagues can see who did what, the projects and review links you create, and a record of actions taken in your organisation. If you connect a code host or a project tool, we hold the access token until you disconnect it. If you pair a browser, we hold a token for it that you can revoke from the dashboard at any time. The legal basis is Article 6(1)(b) GDPR: this is the contract you signed up for.
If you only visit the website
Our host records the usual server log: the request, the time, the status, and a truncated IP address. It is kept briefly to keep the service up and to spot abuse, under Article 6(1)(f) GDPR. There is no tracking pixel, no advertising tag and no analytics product on this site.
Cookies
Two, both strictly necessary to deliver a service you asked for, which is why § 25(2) TDDDG does not require us to ask and why you have not seen a banner. Both are httpOnly, so no script can read them.
| Cookie | What it does | Days |
|---|---|---|
rl_session | Keeps you signed in to the dashboard. Only set when you sign in. | 30 |
rl_reviewer | Remembers which reviewer you are on a review link, so your notes stay yours. | 180 |
Who else receives it
The studio you are reviewing for, and the people they invited to that project. Beyond them, only the companies that run parts of the service we do not run ourselves. Each one is bound by a data processing agreement under Article 28 GDPR, sees only what its job needs, and may use it for nothing else.
| Company | What it does for us | Where |
|---|---|---|
| Vercel Inc. | Runs the website and the dashboard. | Frankfurt (fra1). US company. |
| Railway Corp. | Runs the API and the agent server that your developer’s coding agent talks to. | EU region. US company. |
| Supabase Inc. | Holds the database and the stored files: screenshots and saved copies of pages. | EU region. US company. |
| Resend Inc. | Delivers the emails: sign-in links, and the message that says a round is ready. | US company. |
| Anthropic PBC | Turns a cluster of notes into one instruction for a developer. Receives the notes, the element and its surrounding text and styles, and a crop of the screenshot. Does not use it for training. | US company. |
If your studio connects GitHub, GitLab, Bitbucket, Notion, Asana, Jira or Slack, the items they choose to send reach that service too. That happens only once they connect it, and it is their decision as controller. Signing in with Google, if you use it, tells Google that you signed in here.
Your feedback is not used to train any AI model, ours or a supplier’s. It is used to produce the change you asked for, and for nothing else. We do not sell personal data and we do not share it for advertising.
Data leaving the EU
The companies above store our data in the European Union, but all five are US companies, so access from the United States cannot be ruled out and counts as a transfer. Each transfer rests on the standard contractual clauses the European Commission adopted in decision 2021/914, together with the technical measures in those agreements. You can ask us for a copy of the clauses for any of them at the address above.
How long it is kept
| What | How long |
|---|---|
| Feedback, screenshots, recorded steps | As long as the studio keeps the project: they are the record of what was asked for. Deleting the project deletes them, stored files included. |
| Account and organisation records | While the account is open, then deleted within 90 days of closure. |
| Paired browser tokens | Until the browser is unpaired, the extension is removed, or the account closes. |
| Invoices and accounting records | Six or ten years, as § 257 HGB and § 147 AO require. These are kept because the law says so, not because we want them. |
| Server logs | Days, not months. |
Your rights
Under the GDPR you can ask us to:
- tell you what we hold about you and give you a copy (Article 15);
- correct anything wrong (Article 16);
- delete it (Article 17);
- stop using it while a dispute is settled (Article 18);
- hand it over in a portable form (Article 20);
- stop processing based on legitimate interests, including the recording described above (Article 21). Say so and we stop, unless we can show compelling grounds that override your objection.
Where we rely on consent you can withdraw it at any time, which does not affect what was lawful before. Write to privacy@durn.io. We answer within one month, and we will say so if we need the extension Article 12(3) allows. If you left feedback for a studio, tell us which one, so we can reach the right copy.
You may also complain to a supervisory authority, in the country you live or work in or where you think something went wrong. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin (www.datenschutz-berlin.de).
Keeping it safe
Everything travels over TLS. Tokens are stored hashed, never in a readable form, so a copy of the database does not yield a working key. Session and reviewer cookies are httpOnly. Access to production data is limited to the people who need it to run the service. No system is perfect, and we would rather say that than claim otherwise.
Children
ReviewLoop is a tool for people doing paid work on websites. It is not directed at anyone under 16.
Automated decisions
A model groups related notes and drafts one instruction from them. A person reads that instruction and decides what to do. There is no automated decision-making that produces a legal or similarly significant effect on anyone, in the sense of Article 22 GDPR.
Changes
When this page changes in a way that matters, the date above changes and we tell account holders by email before it takes effect. We do not make a quiet edit and call it an update.
Getting hold of us
Durn Studio UG (haftungsbeschränkt), Kienitzer Str. 5, 12053 Berlin, by email at privacy@durn.io.