SurveyKiller — Privacy Policy

Effective date: August 31, 2026

Who we are: Eigenlume LLC ("SurveyKiller," "we," "us"), 2108 N St, Ste N, Sacramento, CA 95816. Contact: support@surveykiller.com, or by mail at the address above.

This Policy explains what we collect, why we collect it, who we share it with, and the choices you have. It covers surveykiller.com and our related apps and APIs (the "Service").

1. Two different roles — please read this first

We handle personal information in two distinct roles:

• As a business (controller) for the account, billing, and usage data of the people who sign up for SurveyKiller — survey creators, account owners, and invited members. We decide how that data is used, as described in this Policy.
• As a service provider (processor) for the survey responses creators collect from their respondents, and for the contact lists creators upload to send survey invitations. The survey creator — not SurveyKiller — decides what to ask, whom to contact, and why. We process that data only on the creator's behalf, to provide the Service to them.

If you are a survey respondent: you do not need an account, and responses are anonymous by default — we do not require you to identify yourself, though the survey you answer may ask for information about you. You are never charged to answer a survey. For privacy requests about your responses, contact the organization that ran the survey; we will assist them (see Section 9).

2. Information we collect

a. Account and profile data. Name, email address, organization name, your role in the organization, password (stored hashed, never in plain text), and account settings.

b. Billing data. Your plan, transaction and invoice history, and billing contact details — name, company, country, and tax ID if you provide one. Payment cards are collected and processed by Stripe. We never store full card numbers.

c. Survey content. The surveys, questions, and branding you create — including uploaded logos — and the analytics dashboards you configure.

d. Survey responses. The answers respondents submit — whatever the survey asks. Responses may include free-text answers and, where the creator enables AI answer-assist, the comment a respondent types to get suggested answers. Responses carry coarse technical metadata (general browser/device type and locale). Creators control what their surveys collect (see Section 1).

e. Audience and contact data. Contact lists creators upload to send survey invitations — email address, name, company, and tags — plus invitation records and links. Creators must have permission to contact these people (see our Acceptable Use Policy).

f. AI interaction data. Prompts and content submitted to AI features, the AI outputs (including AI analysis of survey responses), and the usage metadata we log to operate and meter the Service: feature type, model used, token counts, and estimated cost.

g. Usage, device, and log data. IP addresses on public endpoints, used only for security and anti-abuse rate limiting and kept for about 24 hours in that system; standard server request logs at our hosting provider (Cloudflare); and audit logs of sensitive organization actions. We do not run in-app behavioral analytics, session replay, or advertising trackers.

h. Cookies and local storage. A sign-in session cookie and one functional cookie that returns you to the right page after sign-in — nothing else. Preferences and UI state are stored in your browser's localStorage. We use no analytics or advertising cookies. See Section 8.

i. Support communications. Emails you send to our support address.

3. How we use information

We use information to:

• provide, operate, secure, and improve the Service;
• create and manage accounts and organizations;
• process payments through Stripe and enforce plan limits and metering;
• power the AI features you choose to use (Section 4);
• respond to support requests;
• send transactional service emails — password resets, team and survey invitations, survey emails you ask us to send to your contacts, usage-threshold notices, and the billing, renewal, and subscription notices required by law;
• detect and prevent fraud, spam, abuse, and security incidents; and
• comply with law.

We use survey response data and uploaded contact data only to provide the Service to the creator who collected or uploaded it — not for our own unrelated purposes, not for advertising, and not to train AI models.

We do not currently send marketing email. If we ever start, those emails will include a working unsubscribe link, and we will honor opt-outs.

4. AI features and OpenAI

When you use AI features — survey generation and editing, response insights, or respondent answer-assist — we send the relevant content (survey text and, where enabled, response data or the respondent's typed comment) to our AI provider, currently OpenAI, to generate the output. Under OpenAI's API terms, business data submitted through the API is by default not used to train OpenAI's models. We do not use your data to train AI models ourselves. We log AI usage metadata (feature type, model, token counts, estimated cost) to operate, meter, and bill the feature.

Respondent answer-assist is optional per survey, is paid for entirely by the survey creator's plan, and never costs the respondent anything. AI-suggested answers are shown to the respondent to review, edit, and confirm before anything is submitted.

Do not submit content to AI features that you are not permitted to share with a third-party AI processor.

5. How we share information

We share personal information only:

• With the service providers (subprocessors) listed in Section 6, which help us run the Service and may use the data only to provide their services to us;
• With the survey creator, for survey responses and invitation data — respondents' answers go to the organization that ran the survey;
• For legal reasons — to comply with law, respond to lawful requests, or protect the rights, safety, and integrity of our users, the public, or the Service;
• In a business transfer (merger, acquisition, or sale of assets), in which case this Policy continues to apply to the transferred data.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined in California law. We have no advertising or third-party analytics partners.

6. Subprocessors

We will keep this list current as our providers change.

7. Data retention and security

7.1 Retention. We keep account data, survey content, and responses for as long as your account is active and as needed to provide the Service. Specific practices we apply today:

• IP addresses used for rate limiting are kept for about 24 hours.
• Billing records and records of your subscription consent are kept as long as the law requires — at least three years for auto-renewal consent records.
• You can delete individual surveys in-product at any time.
• To delete your account, email support@surveykiller.com. We verify the request and delete the account's data within a reasonable time, except what we must keep for legal, billing, or security reasons.

7.2 Security. We use reasonable safeguards appropriate to our size and the risk, including encryption in transit (HTTPS), hashed passwords, organization-scoped access controls, audit logs of sensitive organization actions, and payment handling by Stripe so card numbers never touch our systems. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

7.3 If we learn of a security breach affecting your personal information, we will notify you and regulators as applicable law requires.

8. Cookies, local storage, and "Do Not Track"

We use only two cookies, and neither tracks you:

• a session cookie that keeps you signed in (set by our authentication provider, Supabase); and
• one functional cookie that returns you to the right page after sign-in.

We set no analytics, advertising, or tracking cookies, and we use no third-party analytics, error-monitoring, session-replay, or ad-tech tools anywhere on the Service. Your preferences and UI state are stored in your browser's localStorage and stay in your browser.

You can block or delete cookies in your browser settings. Blocking the session cookie will prevent you from signing in.

Do Not Track and Global Privacy Control. We do not track users across other websites, and we do not sell or share personal information — so there is nothing for these signals to opt out of, and every visitor already receives the treatment these signals request. Our site therefore does not change its behavior in response to Do Not Track or Global Privacy Control signals. If our practices ever change, we will update this Policy and honor applicable opt-out preference signals as the law requires.

9. Your privacy rights

Everyone. You can access, correct, or delete your account information — much of it directly in your account settings, or by emailing support@surveykiller.com. We verify requests before acting on them.

California residents. This Policy is our notice under the California Online Privacy Protection Act (CalOPPA). As an early-stage company, we do not currently meet the CCPA/CPRA thresholds that define a regulated "business" (for example, $25 million in annual revenue or data on 100,000 or more consumers). We nonetheless voluntarily honor CCPA-style requests from anyone: the right to know/access, correct, and delete your personal information, and the right to opt out of sale or sharing — though there is nothing to opt out of, because we do not sell or share personal information. We will never discriminate against you for making a privacy request. Email support@surveykiller.com and we will respond within a reasonable time, and within any legally required deadline that applies.

Survey respondents. If your request concerns answers you submitted to someone's survey, the survey creator controls that data — contact the organization that ran the survey. We will assist them in fulfilling your request. If you cannot identify or reach them, email us and we will help route your request.

Outside California and the U.S. We honor similar rights where other laws apply to us. We do not currently target the EU or UK; if that changes, we will first update this Policy with the required disclosures and transfer mechanisms.

10. Children

The Service is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has given us personal information, email support@surveykiller.com and we will delete it. If you create surveys that may reach children, you are responsible for complying with the laws that apply (for example, COPPA); see Section 6.6 of the Terms of Service.

11. Where we process data

We are a U.S. company. The Service is hosted in the United States, and we store and process data in the United States using the U.S.-based providers listed in Section 6. If you use the Service from outside the U.S., you understand that your information is processed in the U.S.

12. Changes and contact

We may update this Policy. We will post the new version with its effective date, and for material changes we will give additional notice (for example, by email or in-product) before the change takes effect. Questions or requests: support@surveykiller.com, or Eigenlume LLC, 2108 N St, Ste N, Sacramento, CA 95816.

Last legal review: 2026-07-06. Effective date: August 31, 2026.