Privacy policy

Who's responsible for your data

Listener is operated by [legal entity name — org.nr to add], [registered address], Norway. You can reach us at [email protected].

Two roles apply here, and they matter for who to contact. When you leave feedback as a guest, the business you gave it to is the data controller — they decide why feedback is collected — and Listener processes that feedback on their behalf as a data processor, under a data processing agreement with each business. For a business's own account data, and for this website, Listener is the data controller.

Feedback you give as a guest

Feedback given through a QR code is anonymous. We never ask for your name, email address, phone number, or any other information that identifies you.

What we store: the category and rating you choose, any free text or voice transcript you give, the table and location, the time, and a one-way cryptographic hash of your IP address — never the IP address itself — kept only to stop spam and cleared after an hour.

If you choose to talk instead of type

Choosing “Talk to us” connects your device directly, in real time, to our voice AI provider, ElevenLabs, so it can hold the conversation and turn your speech into a text transcript. That choice is how you consent to this — you can pick “Write instead” at any point if you'd rather not.

Our own servers never receive or store the audio itself — only the resulting text transcript reaches our database. That processing happens on ElevenLabs' infrastructure, which by default is located in the United States rather than the EU/EEA; see “Data transferred outside Norway and the EU/EEA” below for how that's safeguarded.

How we use AI on your feedback

We use Anthropic's Claude to ask a relevant follow-up question during the conversation, sort your feedback into a category, and summarize trends for the business over time. Anthropic processes this text under a data processing agreement with us and does not use it to train its models.

If you run a business on Listener

To create and run your account, we store your business name, organization number, contact name, email address, phone number, logo, and language preference. If you sign in with Google, we receive your Google account email to match it to your account.

Billing is handled by Stripe; we never see or store your full card number. If you turn on real-time alerts, your browser registers a push subscription (an address and encryption keys) so we can notify you the moment a guest leaves negative feedback — this is tied to your browser, not to you personally, and you can turn it off any time in Settings.

Legal basis for processing

Guest feedback is processed on the business's legitimate interest in understanding and improving their service, weighed against your privacy — which is why it's anonymous by default and never asks you to identify yourself. If you choose the voice option, your active choice to speak is also your consent to that specific processing.

A business's own account data is processed because it's necessary to provide the service under our contract with them, and to meet our legal obligations (for example, invoicing).

How long we keep data

Free-text detail from a written conversation is deleted automatically 12 months after the conversation; the category, rating, and AI-generated summary are kept longer for trend statistics, with nothing left that identifies who left it.

A business's account data is kept for as long as the account is active, and for a reasonable period afterwards to meet accounting and legal obligations. A business can ask us to delete all data tied to their account at any time.

Who we share data with

Data transferred outside Norway and the EU/EEA

Some of the providers above process data in the United States. Where that happens, it's covered by that provider's standard contractual clauses or an equivalent safeguard recognized under GDPR, as part of our data processing agreement with them. You can ask us for a copy of the relevant safeguard.

Your rights

Under GDPR, you can ask to access, correct, or delete your personal data, restrict or object to some processing, and receive a copy of your data in a portable format. Where we rely on your consent — the voice option — you can withdraw it at any time by switching to text.

As a guest, since we don't hold any identifying information about you, we can only act on a request if you give us enough to find the right conversation — the business, table, and approximate date and time. As a business, contact us directly and we'll respond within a month.

You can also complain to the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no, or to your own country's supervisory authority if you're elsewhere in the EU/EEA.

Cookies

This site uses one strictly necessary cookie to remember your language choice, and — if you run a business on Listener — a session cookie to keep you signed in. We don't use marketing or analytics cookies.

Contact us

Questions about your privacy? Email us at [email protected], or reach out to the business you gave feedback to.