The short version
We collect what we need to run the service and bill you, and nothing else. We do not sell personal data, and we do not use your content or your respondents' answers to train machine learning models.
Two different roles
This distinction matters, so it comes first.
Your account data — we decide how this is handled. We are the controller.
Your respondents' answers — you decide what to ask and why. You are the controller; we only process it on your instructions. If a respondent asks us about their data, we will point them to you.
What we collect about you
Account details — name, email address, hashed password, workspace names
Billing details — plan, subscription status and invoice history. Card numbers are handled by Paddle and never reach our servers
Content you create — quizzes, questions, designs and settings
Technical data — IP address, browser type, pages visited and error logs, used to keep the service running and secure
Support messages — what you write to us, so we can answer
What we collect about respondents
Whatever your quiz asks for, plus a session identifier so a part-finished response can be resumed, the time the response started and finished, and basic technical data. Partial responses are stored — if someone gives an email address and then abandons the quiz, that address is kept and shown to you as a lead. Please tell respondents this in your own notice.
Why we process it
To provide the service you signed up for — performance of our contract with you
To take payment and keep accounting records — contract and legal obligation
To keep the service secure, prevent abuse and fix faults — our legitimate interests
To send service messages such as password resets and billing notices — contract
To send product updates, where you have asked for them — consent, withdrawable at any time
Who we share it with
Only the providers needed to run the service:
Our hosting provider — stores the application and database
Paddle — payment processing, invoicing and tax as merchant of record
Our email provider — delivers transactional email such as password resets
Mailing list providers you connect yourself — Mailchimp, Brevo, MailerLite, ActiveCampaign or ConvertKit. Nothing is sent to these until you connect one, and then only the fields you map
We may also disclose data where the law requires it, or to establish or defend legal claims. If the business is ever sold, data may transfer to the buyer, who would remain bound by this policy.
Where data is stored
Data is stored on servers in [the region your host operates in — check your hosting control panel]. Where data moves between countries we rely on the safeguards our providers have in place.
How long we keep it
Account and content — while your account is open, then deleted within 30 days of closure
Responses — until you delete them or close your account
Invoices and billing records — as long as tax law requires, typically several years
Server and error logs — a short rolling window, typically 30 days
Security
Traffic is encrypted in transit with HTTPS. Passwords are stored hashed, never in readable form. Credentials for the mailing list services you connect are encrypted at rest. Workspaces are isolated so one customer's queries cannot reach another's data. No system is perfectly secure, and if a breach affects your data we will tell you and any regulator we must, without undue delay.
Your rights
Depending on where you live you may have the right to see a copy of your data, correct it, delete it, object to certain processing, or receive it in a portable format. Write to [support@yourdomain.com] and we will respond within the period the law allows — a month in most jurisdictions.
You can also complain to your local data protection authority.
Cookies
We use a small number of cookies, all necessary for the service to work: one to keep you signed in, one to protect forms against cross-site request forgery, and one to remember your light or dark theme preference. We do not use advertising or cross-site tracking cookies.
Children
The service is not directed at children and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it. If your own quizzes are aimed at children, that is your responsibility to handle lawfully.
Changes
We will update this policy as the service changes, and will note the revision date. Material changes will be notified by email.