Privacy Policy

Document status: Approved v1.26 (2026-11-07) Effective date: 2026-11-07 Last updated: 2026-11-04

1. Introduction

Oak Mountain Digital LLC (“SurveyRock”, “we”, “us”, or “our”) operates the SurveyRock platform and the websites located at https://www.surveyrock.com, app.surveyrock.com, and related subdomains (collectively, the “Service”).

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the Service or interact with us, and the choices you have regarding our use of your information.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Policy, do not use the Service.

2. Scope and Definitions

2.1 Who this Policy covers

This Policy applies to seven distinct categories of individuals:

Customers — businesses and individuals who hold a SurveyRock account, including their authorized users (the “Customer” or “you” when context indicates the account holder)
Respondents — individuals who answer surveys distributed using SurveyRock by our Customers
Prospects / business contacts — individuals at businesses we contact about SurveyRock in a professional capacity, whether or not they have ever held an account
Free tool users — people who use a free tool on our website, such as the feedback readout, without a SurveyRock account
Website visitors — people who visit our websites without signing in
Contact form senders — people who write to us through the contact form on our website
Newsletter subscribers — people who sign up for our newsletter

When Customers use SurveyRock to collect responses, the Customer is generally the data controller for the response data, and SurveyRock is the data processor. SurveyRock is the controller for information collected directly from Customers, for information collected from Respondents about the Service itself (e.g., session data, account information), for Prospect information described in Section 3.4, for information collected from Free tool users through our free tools (Section 3.5), and for information about Website visitors, Contact form senders and Newsletter subscribers (Sections 3.2 and 3.6).

2.2 Key definitions

“Personal Information” means any information relating to an identified or identifiable natural person
“Processing” means any operation performed on Personal Information (collection, storage, use, disclosure, deletion, etc.)
“Controller” and “Processor” have the meanings given to them under GDPR Article 4
“Sub-processor” means a third party that processes Personal Information on our behalf — see Section 11 and our Sub-processor List

3. Information We Collect

3.1 Information you provide

When you create a SurveyRock account or use the Service, we collect:

Account information: name, business email, password (hashed and salted), company name, role, billing address
Billing information: processed by Paddle as our Merchant of Record — see Section 11
Survey content you create: survey questions, design, logic, branding customizations
Survey distribution information: contact lists you upload, email addresses you target
Support communications: any messages you send to our support team or related agents
Profile information: any other information you choose to provide

3.2 Information collected automatically

When you use the Service, we automatically collect:

Usage data: pages visited, features used, time spent, click paths (via product analytics — see Section 12)
Device and connection data: IP address, browser type, operating system, device identifiers, language preferences
Signup fingerprint: when you sign up, a one-way fingerprint of your email address (so that variants of the same address, such as “+tag” or dots in a Gmail address, match), a fingerprint of your browser, and your IP address, country and browser details, with a score of how likely the signup is to be an abuse of the free trial
Cookies and similar technologies: see our Cookie Policy for details
Visitor identification (our marketing website only): a visitor-identification service reads your IP address, browser and device details, and the pages you view and for how long, to work out which organization a visit comes from. In countries outside the European Economic Area where it works at the level of a person, it may also identify the individual and return their business contact details. We use the result to decide which businesses to contact (Section 4.2). It does not run on survey pages, in the application, on our support pages, or on the legal and trust pages. Outside the United States it runs only after you accept Marketing cookies; in the United States it may run before you have chosen, and your choice stops it on every later page (see our Cookie Policy)
Log data: server logs of requests, error events, performance data

3.3 Information collected from Respondents

When a Respondent answers a survey:

Response data: the answers they provide (controlled by the Customer who created the survey)
Metadata: completion time, response timestamp, IP address (omitted if the Customer enables anonymous response collection), device and browser information
Optional identifiers: only what the Customer has configured (e.g., email if survey requests it)

Surveys shown on a Customer’s website. A Customer can show a survey on its own website or product as a small prompt (the “website widget”). When a Respondent answers one, we also record how the prompt was shown (for example, after scrolling or when leaving the page), and, unless the Customer turns this off, the address of the page it was shown on, without the part after “?” unless the Customer’s settings use it. If the Customer’s website tells us who the Respondent is, we keep the user ID and the details the website sends with it. We link the response to an email address only when the Customer’s own server has signed that identity. An email address sent without a signature is not kept. None of this is kept for a survey that collects responses anonymously. To decide whether and when to show a prompt, our script keeps a small record on the Respondent’s device, on that website, as described in our Cookie Policy.

Respondent data is processed by SurveyRock as a processor on behalf of the Customer. Respondents should refer to the Customer’s privacy policy for how their response data is used.

Response metadata and response scores may be included in the anonymous, aggregated statistics described in Section 4.3. The text of questions and of open-ended answers is not.

3.4 Information from third parties

We may receive or collect information about you from sources other than you:

Identity providers (if you use SSO): name, email, work domain
Payment provider (Paddle): transaction status, payment method type, billing country and, when you pay by card, the card’s brand, last four digits and expiry date. We never receive your full card number or security code; you enter those directly with Paddle. Paddle’s payment notifications also include the name on the card, or the email address of a PayPal account, which we do not keep.
Business contact information (Prospects): name, job title, employer, country, business email address and professional profile URL. We take it from public sources such as company websites and professional and industry directories, and from business data and lead-intelligence providers. Where a lead-intelligence provider suggests a contact, we also receive the public professional activity that led it to suggest them, such as following a company page or a topic on a professional network.
Visitor identification (Prospects): the organization behind a visit to our marketing website and, for visitors in countries outside the European Economic Area where the service works at the level of a person, that person’s name, job title, work email address, phone number and professional profile URL, from the visitor-identification service described in Section 3.2
Sales conversations (Prospects): information you give us directly when you correspond or speak with us about SurveyRock
Referral partners (Prospects): name, job title, employer and business email address of a contact at an organization a SurveyRock partner introduces to us, with the partner’s note on why

Where we obtain a Prospect’s business contact details from a source other than the individual, we record where each record came from, so if you ask us how we got your details, we can tell you exactly, including the name of any provider. Where the law requires it (for example, for Prospects in the European Economic Area or the United Kingdom), the first message we send links to this Policy. Section 4 states the legal basis, Section 6.1 your right to object, and Section 9 how long we keep the record.

3.5 Information from our free tools

Some tools on our website, such as the NPS and sample-size calculators, run entirely in your browser: what you type in them is not sent to us.

The feedback readout is different. When you use it:

The comments you upload (and the scores, if your file has them) are sent to our servers. Before we analyse them, we remove email addresses, phone numbers and IP addresses. We send the comments to our AI providers (Section 14) to find themes and sentiment. You may only upload feedback you are allowed to share with us; please remove names and other personal details first. Do not upload health information or other sensitive information (such as racial or ethnic origin, religious beliefs or sexual orientation). The feedback readout is not covered by a HIPAA business associate agreement. If you uploaded something by mistake, email privacy@surveyrock.com and we will delete it.
Your email address, if you ask for the full readout, and whether you asked for follow-up emails, with the date and the wording you agreed to.
Technical data: your IP address, to limit how many readouts one network can request in 24 hours and for a bot check (Cloudflare Turnstile, which receives your IP address for that check). We don’t store your IP address with your readout. If our website’s analytics has given your browser an identifier, we store it with the readout so we can tell whether a readout led to a signup.

We use this to produce and send your readout, to let you open your file in a SurveyRock account if you sign up within 7 days, to protect the tool from abuse and, only if you ticked the box, to send you a few follow-up emails.

Contact form. When you write to us through the contact form on our website, we collect your name, your work email address, your message and, if you give it, your company. A bot check runs first, and its provider receives your IP address for that check. We send your message by email to our support inbox and answer it from there.

Newsletter. When you subscribe on our website, your browser sends your email address and the page you subscribed from directly to our email provider. We send the newsletter once you confirm your address through the link in our email. Our email provider records when you subscribed and confirmed, whether each email was delivered, and whether you opened it or clicked a link.

3.7 Whether you have to give us this information

No law obliges you to give us Personal Information. What happens if you don’t depends on what you want to do:

An account: your name, email address and password are needed to create one, and billing information is needed to buy a Plan. We cannot provide the Service without them. Other profile information is optional.
The contact form: we need your name, email address and message to answer you. Your company is optional.
The newsletter and follow-up emails: these are your choice, and we need your email address to send them.
Free tools: the feedback readout needs your comments to work, and an email address only if you ask for the full readout.
Surveys: whether you answer a survey, and which questions must be answered, is up to the Customer who runs it.
Cookies: non-essential cookies are your choice. See our Cookie Policy.

4. How We Use Information

We use the information we collect for the following purposes, on the legal bases shown:

Purpose	Legal basis (GDPR)
Provide, operate, and maintain the Service	Contract (Art. 6(1)(b))
Process payments and billing	Contract (Art. 6(1)(b)) — via Paddle
Send transactional communications (signup confirmation, password reset, account changes, billing)	Contract (Art. 6(1)(b))
Produce and deliver a free tool result you asked for, and let you move it into an account	Steps at your request / contract (Art. 6(1)(b))
Provide customer support	Legitimate interests (Art. 6(1)(f)) and contract
Answer messages sent through our contact form	Legitimate interests (Art. 6(1)(f)); steps at your request before a contract (Art. 6(1)(b)) where you ask about buying
Improve the Service through analytics and product research	Legitimate interests (Art. 6(1)(f)), including inside the signed-in application and for the visit counting without cookies described in our Cookie Policy. On our website and sign-up pages, analytics that stores an identifier on your device runs outside the United States only with your consent (Art. 6(1)(a))
Produce anonymous, aggregated statistics and benchmarks (Section 4.3)	Legitimate interests (Art. 6(1)(f)) — Customers may exclude their account
Send bulk marketing and newsletter communications to Customers and subscribers	Consent (Art. 6(1)(a)) — opt-in only; opt-out available
Send follow-up emails after a free tool, if you asked for them	Consent (Art. 6(1)(a)); unsubscribe at any time
Contact business prospects about SurveyRock	Legitimate interests (Art. 6(1)(f)) — you may object at any time
Identify which organizations visit our marketing website, to decide which businesses to contact	Consent for the cookies and similar technologies outside the United States (Art. 6(1)(a)); legitimate interests (Art. 6(1)(f)) for what we do with the result
Prevent fraud, abuse, and security incidents, including repeat free trials	Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c))
Comply with legal obligations (tax records, regulatory reporting)	Legal obligation (Art. 6(1)(c))
Enforce our Terms of Service and policies	Legitimate interests (Art. 6(1)(f))

4.1 AI features

How AI features handle your data — including our no-training commitment, transient processing by AI providers, and how to opt out — is described in Section 14 (AI and Automated Decision-Making).

4.2 Marketing to Customers, and contacting business prospects

The marketing row and the business-prospects row in the table above are different purposes with different legal bases, and the distinction is deliberate:

Bulk marketing and newsletters — product announcements, newsletters, and campaign emails sent to a list of Customers and subscribers — go only to people who have opted in. Consent is the basis, and you can withdraw it at any time. See Section 13.1.
Business outreach — messages from a named person at SurveyRock to an individual at a business, in their professional capacity, about whether SurveyRock is relevant to their work, which may include a short series of follow-ups — rests on legitimate interests (Art. 6(1)(f)), not consent. We use the business contact details described in Section 3.4, including details given to us by a SurveyRock partner who is introducing the individual’s organization. A visit to our website can be what prompts us to look at an organization, but we never mention it in a message. We do not contact people at personal addresses. Every such message names a real sender, carries our postal address and tells you how to stop it. See Section 13.2.

4.3 Aggregate statistics and benchmarks

We use survey-response metadata (for example whether a survey was completed, how long it took, the country and device type) and response scores (for example NPS values) to produce anonymous, aggregated statistics about how surveys perform: completion-rate norms, response patterns and industry benchmarks.

Anonymous. These statistics never identify any Customer, Respondent, account or individual survey. A figure is published only if it draws on at least 20 accounts and at least 1,000 respondent sessions, and no single account contributes more than 25% of the sessions behind it.
No content. We do not use the text of your questions or of open-ended answers for these statistics.
Not sold. We do not sell or license this data, and we do not share it with anyone except as aggregated statistics that meet the minimums above. We publish some of these statistics openly, for example in benchmark reports, and may show them in the product.
Your choice. A Customer can exclude its account from future statistics at any time, in Workspace Settings → Anonymous Benchmarks or by emailing privacy@surveyrock.com. A statistic already published is anonymous and is not recalculated afterwards.

For response data, the Customer’s authorization for this is in our Data Processing Agreement, Section 2.4.

We do not sell Personal Information. We share information only as described in this Section.

5.1 With Sub-processors

We engage trusted third-party Sub-processors to provide the Service. Each Sub-processor is bound by a written agreement requiring them to protect Personal Information in accordance with applicable law and our instructions. Our current Sub-processor List is updated whenever we add or remove a Sub-processor. The visitor-identification service may also use the IP address and cookie data it receives for its own purposes, as its own privacy notice describes; that notice is linked from the Sub-processor List.

5.2 With Customers

If you are a Respondent, your response data is shared with the Customer who distributed the survey. The Customer’s privacy policy governs their use of that data.

5.3 For legal and safety reasons

We may disclose information when required by law, valid legal process (subpoena, court order, warrant), or when we believe in good faith that disclosure is necessary to:

Comply with legal obligations
Protect the rights, property, or safety of SurveyRock, our Customers, Respondents, or others
Detect, prevent, or address fraud, security, or technical issues
Enforce our Terms of Service

We will notify you of legal demands for your data unless prohibited by law.

5.4 Business transactions

If SurveyRock is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. Any such transfer will require the receiving entity to honor commitments substantially similar to this Policy.

We share information with third parties when you direct us to (e.g., when you connect an integration such as Slack, HubSpot, Zendesk, Freshdesk or Zapier, or send data to your own systems by webhook or through our API).

5.6 Connected apps and AI assistants

You can connect SurveyRock to an AI assistant, such as Claude, or an automation service, such as Zapier, so that it can work in your account for you. This is your choice. Nothing is connected unless you approve it on the SurveyRock consent screen.

What a connected app can do. It acts as you, in the one workspace you choose, and only as far as you can yourself. It can read and change your surveys and their questions, publish them, create and manage survey links, read and export responses, and read and add contacts. It cannot delete surveys, change billing, members or workspace settings, or create API tokens.

Sending email. When you connect Zapier, the consent screen also offers a separate choice, off by default, to let it send survey invitations. If you turn it on, the app can ask SurveyRock to send the invitation of an email campaign that a person in your workspace has switched on for it, to the address the app names, within the daily limit set on that campaign. It cannot switch a campaign on, change the invitation or raise a limit. The email is a standard SurveyRock campaign email with an unsubscribe link. We do not email an address that has unsubscribed, bounced, complained or opted out, or that you deleted and asked us to keep out.

What it can see. It can read the surveys and results you can see, including the answers Respondents gave and contact details that are not marked sensitive. Open-text answers can contain personal information that a Respondent chose to write, and a connected app can read it. A connected app does not receive Respondents’ email addresses or IP addresses, or answers and contact fields you have marked sensitive, with one exception. When you connect Zapier, the consent screen offers a separate choice, off by default, to share who responded. If you turn it on, Zapier also receives Respondents’ email addresses and names, and answers marked sensitive, wherever you can see them yourself. It does not receive IP addresses.

Where the data goes. SurveyRock does not send your data to an assistant on its own. When a connected app asks for something, we answer the request, and the data then goes to the app’s provider (for Claude, Anthropic; for Zapier, Zapier, Inc.). For an instant trigger, we tell Zapier a response has arrived, and it then asks for it. The provider handles it under your agreement with them and their privacy policy, not under this Policy, and it is not a SurveyRock Sub-processor for this purpose. You decide what to ask an assistant to do. Before you let one read Respondent data, make sure that is consistent with what you told your Respondents and with the law that applies to you.

What we record. We keep a record of each connection: the app, who approved it, the workspace, the permissions granted, and when it was made and last used. Changes a connected app makes are recorded in our audit log, as with any other use of our API, and exports of response data are recorded in the response access log. See Section 9 for how long.

Disconnecting. You can see your connected apps and disconnect any of them in your account settings, under Connected apps. A disconnected app stops working at once. Removing a connector inside the assistant does not tell us, so disconnect it here as well.

6. Your Rights and Choices

Depending on your jurisdiction, you have the following rights:

Access — request a copy of the Personal Information we hold about you
Rectification — request correction of inaccurate or incomplete information
Erasure (“right to be forgotten”) — request deletion of your Personal Information, subject to legal retention requirements
Restriction — request that we limit how we process your information
Data portability — receive your Personal Information in a structured, commonly used, machine-readable format
Objection — object to processing based on legitimate interests or direct marketing
Withdraw consent — where processing is based on consent, withdraw it at any time. This does not affect the lawfulness of processing before you withdraw.
Lodge a complaint — with your local supervisory authority (e.g., your national Data Protection Authority)

We respond to verified requests within one month, as GDPR requires. For complex or numerous requests we may extend by up to two further months; if so, we will tell you within the first month.

6.2 Rights under CCPA/CPRA (California residents)

Right to know what Personal Information we collect, how we use it, and with whom we share it
Right to delete Personal Information we hold about you
Right to correct inaccurate Personal Information
Right to opt out of sale or sharing of Personal Information (we do not sell)
Right to limit use of sensitive personal information
Right to non-discrimination for exercising these rights

We respond to verified requests within 45 days, with one 45-day extension if reasonably necessary.

6.3 Other jurisdictions

If you reside in a jurisdiction with privacy rights not enumerated above (Brazil’s LGPD, Canada’s PIPEDA, etc.), please contact us to exercise applicable rights.

6.4 How to exercise your rights

Email us at privacy@surveyrock.com. We may need to verify your identity before fulfilling certain requests. There is no charge for exercising your rights, except where requests are manifestly unfounded or excessive.

7. International Data Transfers

SurveyRock stores Customer and Respondent data primarily in the European Union (AWS Stockholm). Some of our Sub-processors — for example payment, support, and AI providers listed in our Sub-processor List — process limited data in the United States or other countries whose privacy laws may differ from those of your jurisdiction.

For transfers from the EEA, UK, or Switzerland, we rely on:

Standard Contractual Clauses (SCCs) approved by the European Commission
UK International Data Transfer Agreement, or the UK Addendum to the Standard Contractual Clauses, for UK transfers
Additional safeguards (encryption, contractual commitments) as required by Schrems II

You can ask for a copy of these safeguards by writing to privacy@surveyrock.com.

Oak Mountain Digital LLC is itself a company in the United States. When you give us information directly, for example by creating an account, using our contact form or subscribing to our newsletter, you are giving it to a company outside the EEA, the UK and Switzerland, and the people who run the Service may access it from wherever they work, which may be outside your country. Where we handle Personal Information for a Customer as its processor, the transfer to us is covered by the Standard Contractual Clauses in our Data Processing Agreement.

8. Data Security

We implement reasonable technical and organizational measures to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include:

Encryption in transit (TLS 1.2+ for connections to the Service, and between our application and its database and cache)
Encryption at rest (AES-256 for databases and storage)
Access controls (role-based access; two-factor authentication required for administrator access to the application and available to every user)
Network security (VPC segmentation, security-group allowlists, VPC Flow Logs)
Audit logging (CloudTrail and application-level audit logs)
Regular security reviews and dependency vulnerability scanning

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

For details on our security posture, see our Trust Center.

9. Data Retention

We retain Personal Information only as long as necessary for the purposes described in this Policy or as required by law.

Data category	Retention period
Account information	Duration of account + 30 days after closure, then deleted, or anonymized where a billing record must stay. A free account that stays inactive is closed after notice (Section 9.2).
Survey content (questions, design)	Duration of account + 30 days after closure. A free account that stays inactive is closed after notice (Section 9.2).
Response data (collected by Customers)	Retained for the life of the Customer’s account unless the Customer configures a retention period per survey (auto-anonymize or auto-delete after a set number of days), or deletes it earlier. A survey the Customer deletes is kept for 90 days, then permanently deleted with its responses. Deleted after account closure like all account data, including closure of an inactive free account (Section 9.2).
Billing records	7 years (US tax law)
Support communications, including contact form messages	3 years from last interaction
Reason you gave when closing an account (exit survey)	The category you chose is kept. Any free-text comment is removed 24 months after you gave it.
Win-back list (former customers we have emailed about coming back — see 13.2)	12 months after the last message if you have not signed back in; 24 months after you sign back in. If you ask us to stop, we keep only your email address on the suppression list (see 9.1).
Sign-in attempt records (IP address, browser, success or failure)	90 days
Email delivery records (who an email was sent to, subject, delivery status)	The recipient’s address is removed after 90 days; the rest of the record is deleted after 2 years. For a send asked for by a connected app, we also keep for 90 days a one-way code of the address, with the result of the request (queued, skipped or refused, and why).
Abuse-prevention records (the result of our checks on surveys and campaigns we hold or block)	1 year. A record of a hold or block on a survey that still exists is kept while the survey exists.
Signup fingerprint (the email fingerprint, and the browser, IP address and country recorded at signup)	While your account is open, and for 24 months after it is closed, then deleted. Used only to stop repeat free trials.
Prospect records — no reply, or never contacted	12 months from the last contact attempt or, if we never wrote to you, from when we obtained the record; then deleted
Prospect records — replied, or in an active sales conversation	Life of the opportunity + 24 months
Suppression list (“do not contact”) entries	Retained indefinitely — see below
Address of a contact that a Customer has deleted from a workspace and asked us to keep out, or that had unsubscribed, bounced or complained before it was deleted	A one-way code made from the address (a keyed hash: it cannot be turned back into the address) and the date, kept in that workspace only so the address is not added or emailed again. Deleted with the workspace when the account is closed.
Usage and analytics data (pages viewed, features used, browser and device details)	7 years, the period our analytics provider sets. Session recordings are deleted after 30 days.
Server logs (access, error)	30 days in our hosting provider’s logs. Our log-monitoring provider receives a copy with IP addresses shortened and query strings removed, and keeps it for 90 days, in the EU.
Audit records (permission and role changes, administrative actions, and records of who viewed or exported response data)	Kept, including after the account is closed, as a record of who did what. The IP address, browser details and email addresses in them are removed after 1 year.
Connected-app records (the app, who approved it, the workspace, permissions, and when it was made and last used)	Until you disconnect the app, and for 90 days after. Sign-in tokens expire after 1 hour (access) and 30 days (refresh), and expired tokens are deleted.
Comments and scores uploaded to the feedback readout	7 days from upload, then deleted. If you sign up within that time and open them in your account, they become your survey’s responses and follow the Response data row.
Your feedback readout (the themes, summary, and up to three example comments for each theme)	30 days from creation, then deleted
Your email address, your follow-up choice (with when you made it and the wording you agreed to) and the analytics identifier stored with a readout	Deleted with the readout, 30 days from creation
Free tool email address held by our email provider (only if you asked for follow-up emails)	Until you unsubscribe or ask us to delete it. After you unsubscribe we keep only the address on the suppression list (Section 9.1).
Free tool rate-limit records (IP address)	24 hours from your network’s first readout
Newsletter subscription (your email address, when you subscribed and confirmed, and delivery and engagement records)	Until you unsubscribe or ask us to delete it. After you unsubscribe we keep your address on the suppression list (Section 9.1).

When you close your account, we delete your account data 30 days after closure, in the nightly run that follows, or straight away if you choose immediate deletion when you close it. Records that the table above gives their own period (billing records, audit records, and the exit-survey, win-back, sign-in, email-delivery, abuse-prevention and signup-fingerprint records) are kept for that period, not for 30 days. Where the law requires us to keep something longer (for example billing records), we keep it for that time.

9.1 Why the suppression list is kept indefinitely

If you tell us not to contact you, we keep your name and contact details on a permanent suppression list and check that list before every send. Deleting the entry would remove the only means we have of recognizing you and honoring the request, so we retain it for exactly that purpose. A suppression entry is never used for marketing, profiling, analytics, or any other purpose, and once the underlying Prospect record is deleted we hold nothing else about you.

9.2 Inactive free accounts

A free account is inactive when, for 24 months, nobody with access to it has signed in and it has not been used through the API or a connected app. Responses arriving at a live survey do not count as use. We close inactive free accounts.

We email the account owner at least 90 days before closing an inactive account that holds surveys, and at least 30 days before closing one that does not. Signing in, using the account through the API or a connected app, or asking us to keep it open, before the date in the email keeps the account and starts the 24 months again. If email to the owner’s address has already failed, or the owner has asked us not to email them, we close the account on the same timetable without sending the email.

For 30 days after closure you can ask us to reopen the account. After those 30 days, and no later than 35 days after closure, we delete the account’s data, including its surveys and any responses collected through them. Records that the table above gives their own period are kept for that period.

10. Children’s Privacy

The Service is not directed to individuals under 16. We do not knowingly collect Personal Information from children below this age. If we become aware that we have collected Personal Information from a child, we will delete it.

If you are a parent or guardian and believe your child has provided us with Personal Information, please contact us.

11. Sub-processors

We use Sub-processors for cloud hosting, payment processing, email delivery (including our business outreach), email address verification, customer support, analytics, AI features, and related operations. The current list — the specific companies, what they do, and where they process data — is maintained at our Sub-processor List.

We notify Customers of material changes to our Sub-processor list at least 30 days in advance by email to the primary contact on each Account and by in-app notification.

12. Cookies and Tracking Technologies

We use cookies and similar technologies for authentication, session management, security, analytics, remembering your preferences, and, on our marketing website, identifying which organization a visit comes from. For full details, see our Cookie Policy. When a Customer shows a survey on its own website, our script also keeps a record on that website that holds no identifier; see the Cookie Policy.

You can manage cookie preferences via our cookie banner or your browser settings.

13. Marketing Communications

13.1 Bulk marketing and newsletters

We send bulk marketing communications — newsletters, product announcements, and campaign emails — to Customers and subscribers only with your consent (opt-in). You can withdraw consent at any time by:

Clicking “unsubscribe” in any marketing email
Updating preferences in your account settings
Contacting us at privacy@surveyrock.com

13.2 Business outreach

Separately, we write to individuals at businesses about whether SurveyRock is relevant to their work. This includes writing to the business address on a former customer’s account to invite them back. These are messages from a named person at SurveyRock, which may include a short series of follow-ups, and they rest on legitimate interests (Art. 6(1)(f)) rather than consent — see Section 4.2.

You can object at any time and you do not have to give a reason. Reply to the message and say so, or email privacy@surveyrock.com. A reply stops the series of messages it belongs to at once. We act on an objection promptly, and in any case within 10 business days, and we record it so it is honored permanently and across every channel. Section 9.1 explains what that record contains and why we keep it.

Transactional communications (signup confirmation, password reset, billing, security alerts) are not marketing and may continue even if you opt out of marketing.

14. AI and Automated Decision-Making

SurveyRock uses AI to provide certain features, including: survey question and structure generation; theme detection and sentiment analysis of open-text responses; summaries and insights (including executive summaries and dashboards); natural-language queries over your response data (AI Query); AI steps inside workflow automations (e.g., sentiment, urgency, and theme tagging); and — where the Customer enables it — automatically generated follow-up questions shown to Respondents during a survey when an open-text answer is brief.

These features are advisory — they suggest, categorize, or summarize, but do not make automated decisions that produce legal or similarly significant effects on individuals. Respondent-facing AI follow-ups are generated content; Customers who enable them are responsible for any Respondent-disclosure obligations that apply in their jurisdiction.

You retain full control:

Review and modify any AI suggestions before using them
Turn off AI for any workspace: workspace owners and admins can switch off every AI feature in a workspace, including the automatic Insight card, and SurveyRock’s AI features then send no data from that workspace to AI providers
Decide which AI features run: apart from the Insight card described below, AI features run only when someone in your account starts them or sets them up
Export raw response data unchanged by any AI processing

On plans that include AI response analysis, results dashboards and response lists show an automatic Insight card. It is generated from aggregate statistics about the survey’s responses (counts, completion rate, timing, device and time-of-day mix) and sends no question text, answers or respondent identifiers to the AI provider. Each user can turn it off from the card’s menu in their browser, and workspace owners and admins can turn it off with the rest of AI for the workspace.

Transparency commitments:

AI-generated content is labeled as such in Customer-facing surfaces (for example, dashboards and insight cards); AI-generated follow-up questions shown to Respondents during a survey are not currently distinguished from other survey questions
We disclose which AI providers process your data in our Sub-processor List
We do not use Customer survey content to train AI models
Data sent to AI providers is processed transiently — solely to provide the feature — and is not retained by them beyond the request lifecycle (subject to the provider’s own logging policies; see our Sub-processor List)

The feedback readout (Section 3.5) uses the same text analysis, with the same providers and the same commitments: we do not train AI models on what you upload, and the providers process it only to answer the request.

Connecting an AI assistant to your account (Section 5.6) is separate from the AI features described above. SurveyRock does not send your data to that assistant; it answers what the assistant asks for.

15. Changes to This Policy

We may update this Policy from time to time. When we make material changes:

We update the “Last updated” date at the top
We notify Customers by email and in-app notification, at least 30 days before material changes take effect
Continued use of the Service after the effective date constitutes acceptance of the updated Policy

Historical versions are available upon request.

16. Contact Us

For questions, requests, or complaints regarding this Policy or our privacy practices:

Privacy contact: privacy@surveyrock.com

Postal address: Oak Mountain Digital LLC, 16192 Coastal Hwy, Lewes, DE 19958, United States

For EU/UK residents: Data Protection Officer: We have not designated a Data Protection Officer. Contact privacy@surveyrock.com for all privacy matters.

You also have the right to lodge a complaint with your local data protection authority.