SERVICECHEER · DEEMA LLC
Privacy Policy
Updated October 22, 2026 · Version 2026-10-22
1. Responsibility and contact
Deema LLC, United States, operates ServiceCheer. Contact /contact for privacy requests, legal correspondence or business contact details. The business collecting feedback normally determines its purposes and is the controller; Deema is its processor/service provider. Deema generally controls account administration, security, billing administration and support records. This notice identifies no EU/UK representative or data protection officer; legally required appointments and public contact details must be established before covered activity.
2. Data and sources
Account holders or inviting administrators supply names, emails, password hashes, plan/status and legal-acceptance records. Businesses supply names, addresses, logos, questions and review links. Respondents supply ratings and optional comments; no respondent name/email is requested, but comments can identify people. Contact forms collect email, category, message and optional business name. Required fields are indicated or enforced; omitting them prevents the requested action. Hosting/security providers may process IP addresses, request logs and browser/device details. Feedback is not guaranteed anonymous.
3. Purposes and legal bases
For Deema-controlled data under GDPR/UK GDPR, account/subscription administration relies on contract or legitimate interests when dealing with business representatives; security, abuse prevention, diagnostics and support rely on legitimate interests in a safe, reliable service; legally required accounting/disclosures rely on legal obligations. Optional marketing/tracking would require applicable consent or another lawful basis before introduction; neither is enabled here. Businesses determine their survey basis. Accepting Terms is not blanket privacy consent.
4. Recipients and providers
Survey content goes to the relevant business and authorized staff. Authorized Deema staff access necessary records for operations, support, security and legal duties. Depending on deployment, providers include OpenAI Sites/Cloudflare or Vercel and Supabase, Resend for configured transactional email and Stripe for configured billing. Stripe handles card details; ServiceCheer stores billing identifiers. Necessary records may go to advisers, lawful authorities or business successors with safeguards. Request the actual deployment’s providers and locations through /contact. Private feedback is not automatically published.
5. International transfers
Data may be processed in the United States and other provider locations; a U.S. region does not confine all support/subprocessing there. Restricted EEA transfers require a valid mechanism, such as applicable adequacy or signed EU Standard Contractual Clauses, and required assessments/additional measures. UK and Swiss transfers need their corresponding safeguards. We do not claim Deema is Data Privacy Framework certified or that clauses have already been signed. Request applicable safeguards through /contact. Covered processing must not start until required arrangements are in place.
6. Cookies, language and advertising
We use essential sign-in/security cookies, temporary tokens and a functional language cookie/browser preference when you choose a language. Interface translations are built in; text is not sent to a translation provider. This release uses no advertising cookies or optional analytics trackers. We do not sell personal information, share it for cross-context behavioral advertising, target advertising or perform consequential automated profiling. Global Privacy Control has no such activity to disable; this no-sale/no-sharing practice applies regardless of the signal. New optional technologies require updated notices and applicable consent/opt-out controls before activation.
7. Retention and safeguards
Accounts/business records are kept while needed for service and related obligations. Feedback follows the controller’s documented purposes/instructions rather than indefinite storage. Support, security, audit and billing records follow their necessary operational, dispute and legal purposes. Reset/verification links expire after one hour, sessions after seven days; rate-limit records are temporary. Provider log/backup periods depend on configuration; request details through /contact. Verified deletion is coordinated with the controller, with justified restricted legal holds and backup expiry. We use access controls, password hashing and encrypted transport; security is not absolute. Incident notices follow applicable law.
8. Exercising rights
Use /contact without an account for access/export, correction, deletion, restriction/objection, consent withdrawal, opt-outs or appeals. Give the business, approximate date and reference if available, without unnecessary sensitive information. We may proportionately verify identity or an agent’s authority. Some survey records cannot reliably be linked to a person. For business-controlled records, we route or assist the request rather than independently override the controller. We explain lawful exceptions and available appeals and do not discriminate for exercising applicable rights.
9. EEA, UK and Switzerland
Applicable rights include access, rectification, erasure, restriction, portability for qualifying automated consent/contract processing, objection to legitimate interests and consent withdrawal without affecting prior lawful processing. Direct-marketing objection is available at any time; this release sends transactional account email only. No solely automated decisions with legal or similarly significant effects are made. GDPR/UK GDPR requests are handled without undue delay, generally within one month, with an explained extension up to two further months where allowed. You may complain directly to your local supervisory authority, UK ICO or Swiss FDPIC. Mandatory local rules control.
10. United States
Where applicable, California CCPA/CPRA and other state laws may provide access to categories/specific data, correction, deletion, portability, authorized agents and opt-outs for sale/sharing, targeted advertising or certain profiling, plus sensitive-data restrictions. We do not currently conduct these activities or use sensitive data to infer characteristics. Coverage depends on statutory thresholds, exemptions and our role. Covered California requests generally receive a response within 45 days, with timely explained extensions where allowed; opt-outs follow applicable shorter deadlines. Covered Virginia requests receive a response within 45 days, extendable by 45 days where allowed. Virginia appeals receive a reasoned response within 60 days and, if denied, information for contacting the Virginia Attorney General. Other state deadlines and remedies apply when required.
11. Morocco and future markets
Law 09-08 provides information, access, rectification and opposition rights and CNDP complaint mechanisms for covered Moroccan processing. Responsible parties must complete required declarations/authorizations and foreign-transfer formalities before processing; overseas hosting may trigger these requirements. No CNDP filing number or approval is claimed. Morocco launch requires relevant filing references and local contact details. Before expansion elsewhere, assess local regimes, including Canada’s PIPEDA/provincial laws, Brazil’s LGPD and Australia’s Privacy Act, and publish required local supplements. This notice does not claim worldwide authorization or compliance.
12. Children, external sites and updates
Account holders must be 18. Surveys are intended for people 16 or older and are not directed to children; businesses must not solicit children’s personal data through this release. Report suspected child or unnecessary sensitive data through /contact for investigation and coordinated deletion. Google/external sites apply their own notices; copying feedback uses your clipboard and does not automatically send it to Google. We date changes and provide further notice/consent where required. Translations do not diminish mandatory local rights.