Privacy

The operator of this wrkflow deployment runs wrkflow and is responsible for the data described here as controller: the account and billing data of the people who sign in, and the technical data needed to run and secure the service.

For everything an organization puts into wrkflow, such as its surveys, contacts, participants and responses, the organization is the controller and the operator of this wrkflow deployment is its processor. If you answered someone else’s survey, they decide what happens to your answers; ask them first. The terms for that role are in the data processing summary.

Questions about this page or your rights: the contact address of the operator, once set.

• Account data: your name, email address, photo (if you add one), language and the organizations you belong to with your role. Passwords are handled by the sign-in service and are never readable by us. Why: to give you an account, which is the contract between us.
• What your organization stores: surveys and their answers, contacts and their attributes, participants and their personal links, follow-ups, files respondents upload, and the audit log of what members did. Why: to provide the service the organization asked for. Answers to questions marked sensitive are encrypted before they are stored, or refused when the deployment has no encryption key set.
• Billing data: the billing contact, plan and payment status. Card numbers go to the payment provider directly and never reach wrkflow. Why: to charge for paid plans, where online payment is available, and to meet accounting duties.
• Technical data: the network address and browser of requests, used to limit abuse (rate limits count a one-way hash of the address and keep it for a day or two) and to enforce an organization’s network allowlist. The server’s logs, kept for 30 days, can include email addresses, for example in sign-in errors. Why: security of the service, our legitimate interest.
• Email delivery data: when the deployment sends email, whether each email was delivered, bounced or marked as spam, so we stop writing to addresses that cannot receive it. Why: to run the service and protect the sender’s reputation.

We do not sell personal data, and we do not use it for advertising.

A survey page shows who sent it. A personal link connects your answers to you unless the survey says it is anonymous. In an anonymous survey your answers are stored without a link to you, times are rounded to the day, and results never show a group smaller than the threshold the survey states, so no one can pick you out.

You can stop at any time. If you ask to be removed from further emails there is an unsubscribe link in every survey email; one press stops them.

wrkflow uses only what it needs to work. There are no advertising or analytics cookies and no tracking scripts, so there is no cookie banner to dismiss.

• Your sign-in session, while you are signed in.
• Your interface language, your light or dark choice, and how you chose to move around the workspace.
• On a survey: a marker that you already answered, and a saved draft so you can continue later, if the survey allows it.
• On a live poll: a random identifier so one browser casts one vote.
• While connecting an outside account: a short-lived value that proves the return trip is yours.

Companies that help us run wrkflow handle data on our behalf, only for that purpose. The current list, what each does and what it receives, is on the security page; it is kept in step with how this deployment is set up.

Data is stored in India (Mumbai, AWS region ap-south-1). Services that receive part of it, such as the email, payment or AI providers listed there, process what they receive in their own locations.

We share data with authorities only when the law requires it, and we tell the organization concerned when we are allowed to.

Organizations on the Enterprise plan choose how long responses are kept, from 90 days to three years, and wrkflow applies the choice every night; otherwise responses stay until the organization deletes them. Account data stays while your account does. Audit entries stay as long as the organization does. When an organization or an account is deleted, its data is deleted with it. The nightly database backup is deleted after 30 days, earlier versions of deleted files are removed from the file store after 30 days, and server logs are kept for 30 days.

Under the GDPR and similar laws you can ask to see your data, correct it, have it erased, restrict or object to its use, and receive it in a portable form. You can also complain to your data protection authority.

For your own account, write to the operator. For answers or contact details held by an organization, write to that organization; its administrators can look up, export and erase a person’s data from within wrkflow, and we help them do it.

Access is limited by organization and role, two-factor authentication is available, changes are logged, and answers to sensitive questions are encrypted where the deployment has its encryption key set. What is in place, described as it is built, is on the security page. No system is perfectly safe; if something goes wrong that affects you, we say so and what to do.

When this page changes in a way that matters, signed-in organizations are told before it takes effect. The date at the top is the date of the latest change.