Privacy Policy

2. Data We Collect

2a. Account Data (we are data controller)

• •Name, email address, and organization name provided at registration
• •Billing information (processed and stored by Stripe, we never store raw card data)
• •Login activity, session metadata, and IP addresses for security purposes
• •Aggregate feature-usage analytics (no individual behavioral profiling)

2b. Customer-Uploaded Data (you are data controller)

• •Survey responses, email content, voice recordings, and any other data you upload
• •Respondent identifiers (if provided by you)
• •Classification labels, tags, and analysis outputs generated from your data

3. Legal Basis for Processing (GDPR)

Where GDPR applies, we process your personal data under the following lawful bases:

• •Contract performance: To provide, maintain, and support the StatQuestions service you have contracted with us for
• •Legitimate interests: To improve platform security, prevent fraud, and develop our services
• •Legal obligation: To comply with applicable laws, regulations, and lawful requests from authorities
• •Consent: For optional communications such as product newsletters (you may withdraw consent at any time)

4. How We Use Data

• •Delivering the platform's core features: analysis, dashboards, reporting
• •Processing payments and managing subscriptions via Stripe
• •Sending transactional communications (receipts, service notices, security alerts)
• •Improving platform reliability, performance, and security
• •Complying with legal obligations and enforcing our Terms of Service

5. Data Sharing & Sub-Processors

We share data only with the sub-processors named below. Each works under a written data protection agreement, each performs one defined function, and none receives your data for its own purposes. All are located in the United States.

• •Supabase, Database and platform backend (AWS, US East). This is where data you upload is stored.
• •Base44, Application hosting, authentication and deployment
• •Modal, Speech-to-text for English call recordings, using a model we host ourselves
• •Deepgram, Speech-to-text for French call recordings
• •Anthropic, Language model, used only on the small share of records our deterministic rules cannot categorize. Before text is sent we reduce the sender to its domain and mask email addresses and phone numbers in the body. Anthropic's commercial terms prohibit training models on customer content.
• •Resend, Delivery of scheduled reports and notifications
• •Stripe, Card payment processing. Receives billing details only, never data you upload.

We will give customers advance notice before adding or replacing a sub-processor that handles uploaded content.

We may also disclose data if required to do so by law, court order, or governmental authority.

We do not sell, rent, or trade your personal data to any third party.

6. Data Security

• •All data is encrypted in transit (TLS) and at rest (AES-256)
• •Role-based access controls restrict data access to authorized personnel only
• •Each organization's data is logically isolated from others
• •Regular security reviews and access audits

7. Data Retention

• •Uploaded content: Because you are the controller of this data, you set its retention period and we delete on that schedule. If you have not set one, content is kept while your account is active so that historical comparison remains possible, and you can ask us to delete it at any time.
• •Raw intermediate files: Working copies created during processing, such as raw transcript payloads already written into your analysis, are deleted within 30 days.
• •Active account data: Retained for the duration of your subscription
• •Post-cancellation: Data is retained for 30 days to allow export, then permanently deleted
• •Billing records: Retained for 7 years as required by applicable tax and financial regulations
• •Security logs: Retained for up to 12 months for fraud prevention and audit purposes

Payment card numbers and government identification numbers are never retained. Where these appear in free-text content you upload, they are detected and replaced at the moment of writing, before the record is stored.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• •Access (GDPR Art. 15): Request a copy of the personal data we hold about you
• •Rectification (GDPR Art. 16): Correct inaccurate or incomplete data
• •Erasure (GDPR Art. 17): Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements
• •Portability (GDPR Art. 20): Receive your data in a machine-readable format
• •Restriction (GDPR Art. 18): Request we limit how we process your data
• •Objection (GDPR Art. 21): Object to processing based on legitimate interests
• •California (CCPA): Rights to know, delete, opt-out of sale, and non-discrimination

To exercise your rights, email privacy@statquestions.com. We will respond within 30 days. We may need to verify your identity before processing your request.

If you believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your relevant EU supervisory authority).

9. International Data Transfers

StatQuestions is operated from the United States and every sub-processor listed above is located in the United States. Data you upload is stored in AWS US East. If you, or the people your data describes, are located outside the United States, that data is transferred to and processed in the United States.

European Economic Area and United Kingdom: where required we rely on Standard Contractual Clauses approved by the European Commission, or the UK International Data Transfer Addendum, together with supplementary measures.

Canada: we process personal information in the United States. Canadian customers should know that while their information is outside Canada it may be accessible to courts and government authorities in the United States under the laws of that country. We handle Canadian personal information consistently with PIPEDA.

Quebec: in most engagements we receive data that our customer has already moved outside Quebec into its own systems, and the assessment Quebec's Law 25 expects before personal information is communicated outside the province is the customer's to make, not ours. What we owe our customers is the information they need to make it, and we provide that on request: what we hold, which sub-processors receive it, where it is stored, what protects it, and how long it is kept.

Where we are the party communicating personal information out of Quebec, for example where a Quebec-based customer sends data to us directly, we complete that assessment ourselves before the transfer. Either way, Quebec customers can request our current data protection summary from the address below.

10. Cookies & Tracking

Our public website uses cookies for analytics and advertising measurement. The signed-in product does not: inside the platform we use only the cookies needed to keep you logged in. We do not sell your data, and we do not use the contents of your customer feedback for advertising.

• •Session cookies: Required for login and platform functionality.
• •Google Analytics 4: Which pages are visited and for how long, so we can see what is useful. Sets _ga and _ga_*.
• •Google Ads: Tells us which advert led to a demo booking or a purchase. Sets _gcl_au, _gcl_aw and GCL_AW_P.
• •PostHog: Product analytics on how the app is used.
• •Warmly: Identifies the company a website visitor is browsing from, so we know which businesses are looking at us. It does not read anything you have stored in the platform.

You can block these in your browser, or with any standard blocker, and the site will still work. Blocking them does not affect your account.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or a prominent notice on the platform at least 30 days before taking effect. Continued use of StatQuestions after the effective date constitutes acceptance of the updated policy. We recommend reviewing this page periodically.