palmkinWho is responsible and what this notice covers
Palmkin is the operator and controller responsible for the personal data described here. Our address is Ben Essingstraat 15, 1695 CV Blokker, Noord-Holland, the Netherlands. For contact, support and privacy requests, email support@palmkin.ai.
This notice covers visitors, feedback contributors, verified voters, moderators and people who contact us. It does not mean that data stored locally in the Palmkin app is uploaded to this website. The website does not take payments or collect payment-card details.
Visiting the website
Opening a page sends ordinary connection information to our server, including your IP address, request time, requested page and browser information. We use this to deliver pages, investigate faults and protect the service. Server logs are kept for no more than 14 days.
There are no website analytics, advertising trackers, tracking cookies, remote fonts or embedded third-party content. The illustrated AI examples do not run AI or access your microphone or camera. Following an external link sends you to another service with its own privacy rules.
After email verification, a necessary cookie keeps your voting or moderation session signed in for up to 30 days. Page scripts cannot read it, and signing out revokes the session. Blocking or deleting it prevents the associated signed-in functions, not ordinary reading. A fixed hint in browser session storage helps administrators navigate; it is not a personal tracking identifier and lasts only for that browser session.
Finding similar feedback
While you type a feedback title, the title can be sent to our feedback service before you submit, to look for similar approved public items. It is processed temporarily for that lookup, not published or saved as a feedback submission.
The title travels in the request content, not in the web address. Ordinary connection and security information can still appear in server logs under the 14-day limit. Keep private or sensitive information out of the title.
Sending feedback and what becomes public
You can submit without an account or verified email. We store your chosen topic (general, website or Android app), feedback type, title, description, language and submission time. For a problem, you can add steps to reproduce it. Device model, Android version and app version are optional fields for Android app problems only; they are entered by you, not read automatically from your device.
An optional contact email is private and lets us follow up on your submission. Screenshots, diagnostic reports, conversations and a device profile are not automatically collected. Do not include passwords, health information, confidential documents or personal information about other people.
Moderators review submissions and may edit, translate, reject, merge or hide them. Only separately approved topics, English and Dutch titles and summaries, statuses, team updates, update information and total vote counts are public. Raw submissions, contact emails, verified email identities and individual votes are not public. Links to merged items lead to the remaining item.
Public text can be read and copied by others, including search engines. Ask us to remove personal information published by mistake; removal from our website cannot guarantee removal of copies made elsewhere.
Verifying your email and voting
Voting requires a verified email address. We store the address in a consistent form, an internal identity, its role and votes. Each verified email identity can have one vote per item; that is not a guarantee of one vote per person. You can withdraw a vote, and merging items does not count the same identity twice.
A verification link works once and expires after 15 minutes. The database stores protected checks of verification and session codes, not the usable codes themselves. Request limits use temporary protected identifiers derived from connection addresses and email groups to reduce spam and misuse, rather than raw IP addresses in the feedback database. This does not mean that our server or email provider has no logs.
You do not need to verify an email to read public feedback or submit feedback. If you do not supply an optional contact address, we cannot use it to follow up with you. Verification and contact addresses are not an advertising list, and requesting a link or sending feedback is not marketing consent.
Why we process data and our legal grounds
Under the GDPR, our legitimate interests are providing a useful moderated feedback board, answering people who contact us and keeping the service safe. We limit the data and its use and weigh these interests against your rights; you can object as explained below. We rely on a legal obligation only where a specific duty applies, as distinguished in the table.
| Purpose | Data used | Legal ground |
|---|---|---|
| Deliver pages and keep the service reliable and secure | Connection information, short-lived server logs and request-limit identifiers | Legitimate interests in operating and protecting the website |
| Find similar items and review, translate and publish approved feedback | Entered title, submission fields and separately approved public text | Legitimate interests in organising feedback and informing the community |
| Verify access and maintain fair voting and moderation | Email address, verification records, identity, role, session, votes and moderation records | Legitimate interests in reliable participation and preventing abuse |
| Answer feedback, support questions and privacy requests | Contact details, message content and related correspondence | Legitimate interests in responding; legal obligation where GDPR request handling is required |
| Meet an applicable legal duty | Only data required for that duty, such as a lawful authority request | Legal obligation, only where a specific duty applies |
Hosting, access and other recipients
The website and feedback database are hosted on the owner-operated CyberPanel server in the Netherlands. CyberPanel is the software used to manage that server, not a claim that every other service involved stores data in the Netherlands.
Access to private submissions, identities and correspondence is restricted to the people who need it to operate, moderate, secure or support the service. Approved feedback is shared publicly as described above. We do not sell contact details or use them for advertising.
Our verification-email provider processes the information needed to deliver those messages, as explained in the next section. Your own email provider also handles messages you send or receive. We disclose other personal data only where necessary for a lawful obligation or the establishment, exercise or defence of legal claims, with appropriate limits and safeguards.
Postmark email and transfers to the United States
Verification emails are sent through Postmark, provided by AC PM LLC, part of ActiveCampaign. It receives the recipient address, verification message and link, and message-delivery information. We do not send your feedback description or local app conversations as part of that message. Open and link tracking are switched off; delivery, bounce and complaint records can still be processed.
Postmark states that its servers and data are in the United States, using Deft and Amazon Web Services. It normally retains email content and metadata for 45 days. Records of undeliverable messages, spam complaints and addresses blocked from further email can be kept longer, including indefinitely in suppression lists, to prevent unwanted or failed delivery. These are separate from Palmkin’s own retention periods.
Postmark acts as a processor for this recipient and message data under its Data Processing Addendum (DPA), not the general marketing privacy policy for visitors to its own website. Its terms incorporate the DPA and EU Standard Contractual Clauses for relevant international transfers. Those clauses provide contractual safeguards and enforceable rights; they do not make US processing the same as storage in the Netherlands or rule out all foreign-government access risks.
The Postmark EU data-protection information and DPA are linked below. Contact support@palmkin.ai for information about the applicable transfer safeguards or a copy, subject to protecting other people’s data and confidential information.
How long we keep data and how deletion works
We keep data only for its stated purpose. These periods apply to our website and feedback service; the separate Postmark periods are explained above.
Removing a private submission does not automatically remove the separately approved public item. You can withdraw a vote or ask us to remove your identity or personal information; we assess the request under the GDPR.
Deletion removes data from active use. An older restore backup may still contain a copy until that backup expires within 30 days. Backups are for recovery, not ordinary use. If we restore one, we reapply deletions before putting the restored data back into use.
Where a specific legal obligation or legal claim requires a limited record to be kept, we restrict it to that purpose and delete it when that need ends. This is not a reason to keep all feedback or correspondence indefinitely.
| Data | Retention |
|---|---|
| Private feedback, including optional contact and manually entered device fields | 90 days from submission, removed at the next cleanup |
| Moderation audit records | 180 days, removed at cleanup |
| Server logs | No more than 14 days |
| Server restore backups | No more than 30 days |
| Verification links and sessions | Links expire after 15 minutes; sessions last at most 30 days or end earlier on sign-out; expired records are cleaned up |
| Temporary request-limit records | Only for the relevant protection window; expired records are cleaned up |
| Approved public items, team updates, verified identities and votes | As long as needed for the feedback board and participation, until removal or closure; reviewed when no longer needed |
| Support and contact correspondence | While handling the matter, then only as necessary for follow-up, an applicable legal duty or a specific legal claim |
Security and human review
We use protected connections, restricted access, protected verification and session checks, request limits and moderation to reduce unauthorised access and abuse. No website or email system is completely secure. Do not send secrets or sensitive personal data through feedback or ordinary email.
Publication decisions are reviewed by a moderator. Similar-title matching and request limits assist the service; we do not use this data for profiling or solely automated decisions with legal or similarly significant effects.
Your rights, requests and complaints
You can ask for access to your personal data, correction, deletion or restriction of its use. You can object to processing based on legitimate interests; we must stop unless we can demonstrate overriding compelling grounds or need the data for legal claims. Where the GDPR conditions apply, you can request data portability. If processing relies on consent, you can withdraw it without affecting earlier lawful processing; sending feedback or verifying an email does not create marketing consent.
Email support@palmkin.ai with your request and enough information to locate the relevant submission or identity. We may ask only for proportionate information needed to verify that the data is yours; do not send an identity document unless we explain why it is necessary and how to provide it safely. Requests are normally free of charge.
We respond without undue delay and within one month of receiving a request. If its complexity or the number of requests requires up to two additional months under the GDPR, we explain the reason within the first month. If a right does not apply or we cannot fulfil a request, we explain why and how to challenge that decision.
You can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at https://autoriteitpersoonsgegevens.nl, or to the competent authority where you live or work in the EEA. You do not have to contact us first.
Local app data is separate
Local app conversations, memories and files are not part of the website feedback database and are not automatically collected by the feedback form. If you choose to copy app information into feedback or an email, that copy is processed under this notice. Remove personal or confidential details first.
Managing data on your device, sharing it with another app or contacting an external download or online service are separate actions. This website notice does not promise that any described app feature is publicly available, or that every external service processes data in the Netherlands.
Changes to this notice
We update this notice when the website’s processing changes and show the latest revision date. We explain material changes on the website and provide any further notice or choice required by law before a new use begins. Publishing a revised notice does not itself give us consent for advertising or unrelated processing.