Privacy & data rights

Asking respondents to agree

A survey can show a short consent statement that each respondent ticks before they can send their answers. Their agreement is stored with the response: which version of the statement they saw, and when.

1. 1

   Write the statement

   In the builder, open Survey details and find Consent statement. The Ask respondents to agree switch is on for new surveys, with a plain statement you can keep or rewrite in both languages (keep it to a few sentences — respondents read it on a phone); a counter shows how much room is left. Switch it off and the survey asks for nothing.

2. 2

   Link your privacy notice

   An admin adds the address of your organisation's privacy notice once, under Privacy & data → Privacy notice, and presses Save. It must be an https address; type it without https:// and that part is added for you. It then appears under every consent statement in the workspace; to remove it, clear the field and save. Until one is linked, the builder says so under the statement.

3. 3

   See it on each response

   Open a response and the Consent line shows when the respondent agreed, and the statement's version. Editing the statement changes the version, so earlier answers keep a record of what they agreed to.

Consent statements are on every plan. The owner can switch them off for the whole workspace in Plan & usage → Modules; the builder then shows the section without its controls.

ID numbers and health information

Asking for a national ID or passport number, or for health information, is allowed on every plan — a clinic booking appointments needs to. Because it is sensitive, publishing such a survey asks two things of you first.

• The consent statement must be on, so every respondent agrees in writing. If it is off, publishing offers Turn it on and publish. If the owner has switched consent statements off for the workspace, they switch them back on in Plan & usage → Modules first.
• You say what the answers are for, tick the sentence confirming you have a lawful basis to collect them, and press Save and publish. The purpose is stored with the survey and recorded in the activity log; you are asked once, and again only if the survey starts asking for another kind of sensitive data.

Deleting responses automatically

Each survey can keep its responses for 30, 90, 180 or 365 days, or Until I delete them (the default). Choose it in the builder's Survey settings, under Keep responses; the line under the choices says when the next deletion is due. Every night, responses older than the period are deleted with the files uploaded with them and the contact entries they created, and one line is written to the activity log saying how many.

When someone asks for their data

Someone you surveyed asks what you hold about them, or asks you to delete it. Admins answer that from Privacy & data → Requests from the people you survey — the Privacy & data page is for admins and the owner.

1. 1

   Find them

   Type their email address, phone number or name — or a reference they gave in an answer, like a booking or staff number — and press Find (or Enter); the line under the field says how much to type. The search looks in the contact directory and inside every answer, in every survey of the workspace, and runs only when you ask — a half-typed name never lists anyone.

2. 2

   Check what was found

   The card says how many responses match, and how many survey invitations went to that address. Each match shows its survey, its date and whether it matched the contact or matched an answer; a long list pages like every other list, newest first.

3. 3

   Hand it over

   Download as JSON gives one file with every response found — each answer beside its question, in the language they answered in — and their contact details. It is something you can send them.

4. 4

   Or erase it

   Erase asks you to confirm, then deletes every response found, its files and contact entries, and any survey invitations sent to that address. It cannot be undone. The card then searches again and shows what is left — normally nothing.

The download and the erasure cover every match, however many there are, not just the ones on the screen. Each download and erasure is recorded in the activity log — with a shortened version of what was searched for, never the full address. Responses held back by your plan's monthly cap are marked Over plan limit: they are erased along with the rest, but their answers are left out of the download until the workspace can see them.

A respondent deleting their own answer

When a survey collects a respondent's email address, a confirmation is sent to it after they answer, with a link that deletes their response — without an account, and without having to ask you. The link opens a page where they press Delete my response; the response goes with its files and contact entry. It works once, and only for that response. Your activity log records that a respondent deleted their response, on which survey — never who they were.

Exporting everything

Admins can download the whole workspace as one ZIP file from Privacy & data → Export everything: press Prepare an export. It holds every survey and its versions, every response (as JSON and as a spreadsheet-ready CSV), every uploaded file, the contact directory, the team, saved templates and the activity log. It is prepared in the background and you are emailed when it is ready; then Download appears beside it, for 7 أيام. One export is prepared at a time, and a workspace can prepare up to 3 exports a day.

Responses over your plan's monthly cap are left out until you upgrade, and a note inside the archive says how many. If the uploaded files are very large, the archive copies as many as fit and lists the rest; each one can still be downloaded from its response.

Deleting the workspace

The owner deletes the workspace from the last section of the Workspace page, Delete this workspace. Type the workspace's name where it asks — click the name in the sentence to copy it — and press Schedule deletion; if you signed in more than fifteen minutes ago, you confirm it's you first, on the same page. Its surveys stop answering at once and nothing more is sent. For 30 days the owner can press Restore the workspace on the notice that replaces the dashboard and get it back exactly as it was; after that every survey, response, file, contact and log entry is deleted for good. The last person to leave a team schedules the same deletion.

The data processing agreement

The agreement between your organisation and us is published in full on our website, and Privacy & data → Our policies links to it alongside the privacy policy, the terms, the security page and the acceptable use policy. On the Pro plan and above, the Data processing agreement card on the same page has a copy filled in with your workspace's name, owner and date, ready to sign: Open shows it as a page you can print, and Download PDF saves it as a file — both in the language you are using the dashboard in.

Reports, suspensions and appeals

Every public survey has a Report link at the bottom. A person on our team reads every report, and the survey's owner is not told who sent it. When you publish, a survey that seems to ask for something our Acceptable Use Policy does not allow — passwords, verification codes or card details — shows you the questions concerned: Edit the questions, or Publish anyway if they were misread, and a person takes a look.

If a survey or the workspace is taken offline, the owner is emailed the reason and nothing is deleted. A notice gives the reason — on the survey's page and in the builder, or across the dashboard for the whole workspace — and admins and the owner see an Appeal button on it. Say why the decision should be reversed (at least 10 characters) and press Send appeal. A person reads every appeal and emails the decision either way; if it is overturned, the survey is back online at once, and if it stands you can appeal again with new information. Whenever a survey comes back online after a review, the owner is told by email. The rules themselves are in the Acceptable Use Policy.