Privacy Policy

Last updated: July 26, 2026

What Mamtack Is

Mamtack is a visual feedback widget that lets people pin comments directly on web pages. It consists of a JavaScript widget embedded on your website and a dashboard application for managing feedback.

Data We Collect

When someone uses Mamtack on your website, we collect:

Comment content — the text of the feedback
Display name — optionally provided by the commenter (or "Anonymous")
Page URL — the page where the comment was pinned
Element selector — which page element the comment is attached to
Browser viewport dimensions — for accurate pin positioning

We do not collect:

IP addresses of commenters
Cookies or browser fingerprints
Any personal data beyond what the commenter voluntarily provides
Page content, DOM snapshots, or screenshots

Authentication

Site owners and team members sign in via email magic link, Google OAuth, or GitHub OAuth. OAuth providers share only your name, email, and profile picture — we request minimum scopes. Guest commenters (reviewers) do not need to sign in.

Where Data Is Stored

All data is stored in a Supabase-hosted PostgreSQL database. Supabase runs on AWS infrastructure in the US. Real-time communication uses Supabase Realtime (WebSockets). See Supabase's privacy policy.

Third-Party Services

Supabase — database, authentication, real-time, edge functions
Lemon Squeezy — payment processing for paid plans (Merchant of Record; we never see or store card numbers)
Brevo — transactional emails (assignment notifications, account emails)
unpkg.com — CDN for serving the widget JavaScript (no data sent to unpkg)
Google / GitHub — OAuth identity providers (optional, for team sign-in)

Data Controller & Processor Roles

Under GDPR and similar data protection laws:

You (the site owner) are the data controller. You determine why and how personal data from your site visitors is processed.
Mamtack is the data processor. We process comment data on your behalf, according to your instructions (embedding the widget, configuring settings).

As the data controller, you are responsible for:

Informing your site visitors that comments are processed via Mamtack (e.g., in your privacy policy)
Ensuring you have a lawful basis for collecting feedback (typically legitimate interest or consent)
Responding to data subject access/deletion requests (Mamtack provides project and comment deletion tools in the dashboard)

Recommended disclosure for your privacy policy:

"This website uses Mamtack for visual feedback and comments. When you leave a comment, your display name and comment text are stored by Mamtack (our data processor) on secure servers. No cookies are used and no tracking occurs. For details, see Mamtack's privacy policy."

Data Retention

Comment data is retained as long as the site project exists. When a site owner deletes a project, all associated threads, comments, and member data are permanently removed. Account deletion removes all user data.

WordPress Plugin

The Mamtack WordPress plugin is a thin PHP wrapper that injects the widget script tag. The plugin itself does not collect, transmit, or store any data. All data handling occurs through the widget JavaScript and Mamtack's Supabase backend as described above.

Your Rights

You can request access to, correction of, or deletion of your data by contacting us. Site owners can delete projects, threads, and comments directly from the dashboard.

Contact

For privacy questions or data requests, email support@mamtack.com.