Privacy Policy

Document status: Approved v1.9 (2026-10-21) Effective date: 2026-10-21 Last updated: 2026-10-21

1. Introduction

Oak Mountain Digital LLC (“SurveyRock”, “we”, “us”, or “our”) operates the SurveyRock platform and the websites located at https://www.surveyrock.com, app.surveyrock.com, and related subdomains (collectively, the “Service”).

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the Service or interact with us, and the choices you have regarding our use of your information.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Policy, do not use the Service.

2. Scope and Definitions

2.1 Who this Policy covers

This Policy applies to four distinct categories of individuals:

Customers — businesses and individuals who hold a SurveyRock account, including their authorized users (the “Customer” or “you” when context indicates the account holder)
Respondents — individuals who answer surveys distributed using SurveyRock by our Customers
Prospects / business contacts — individuals at businesses we contact about SurveyRock in a professional capacity, whether or not they have ever held an account
Free tool users — people who use a free tool on our website, such as the feedback readout, without a SurveyRock account

When Customers use SurveyRock to collect responses, the Customer is generally the data controller for the response data, and SurveyRock is the data processor. SurveyRock is the controller for information collected directly from Customers, for information collected from Respondents about the Service itself (e.g., session data, account information), for Prospect information described in Section 3.4, and for information collected from Free tool users through our free tools (Section 3.5).

2.2 Key definitions

“Personal Information” means any information relating to an identified or identifiable natural person
“Processing” means any operation performed on Personal Information (collection, storage, use, disclosure, deletion, etc.)
“Controller” and “Processor” have the meanings given to them under GDPR Article 4
“Sub-processor” means a third party that processes Personal Information on our behalf — see Section 11 and our Sub-processor List

3. Information We Collect

3.1 Information you provide

When you create a SurveyRock account or use the Service, we collect:

Account information: name, business email, password (hashed and salted), company name, role, billing address
Billing information: processed by Paddle as our Merchant of Record — see Section 11
Survey content you create: survey questions, design, logic, branding customizations
Survey distribution information: contact lists you upload, email addresses you target
Support communications: any messages you send to our support team or related agents
Profile information: any other information you choose to provide

3.2 Information collected automatically

When you use the Service, we automatically collect:

Usage data: pages visited, features used, time spent, click paths (via product analytics — see Section 12)
Device and connection data: IP address, browser type, operating system, device identifiers, language preferences
Signup fingerprint: when you sign up, a one-way fingerprint of your email address (so that variants of the same address, such as “+tag” or dots in a Gmail address, match), a fingerprint of your browser, and your IP address, country and browser details, with a score of how likely the signup is to be an abuse of the free trial
Cookies and similar technologies: see our Cookie Policy for details
Log data: server logs of requests, error events, performance data

3.3 Information collected from Respondents

When a Respondent answers a survey:

Response data: the answers they provide (controlled by the Customer who created the survey)
Metadata: completion time, response timestamp, IP address (omitted if the Customer enables anonymous response collection), device and browser information
Optional identifiers: only what the Customer has configured (e.g., email if survey requests it)

Respondent data is processed by SurveyRock as a processor on behalf of the Customer. Respondents should refer to the Customer’s privacy policy for how their response data is used.

Response metadata and response scores may be included in the anonymous, aggregated statistics described in Section 4.3. The text of questions and of open-ended answers is not.

3.4 Information from third parties

We may receive or collect information about you from sources other than you:

Identity providers (if you use SSO): name, email, work domain
Payment provider (Paddle): transaction status, payment method type, billing country and, when you pay by card, the card’s brand, last four digits and expiry date. We never receive your full card number or security code; you enter those directly with Paddle. Paddle’s payment notifications also include the name on the card, or the email address of a PayPal account, which we do not keep.
Publicly available business contact information (Prospects): name, job title, employer, business email address, and public professional profile URL, taken from the employer’s own website or from professional and industry directories
Sales conversations (Prospects): information you give us directly when you correspond or speak with us about SurveyRock
Referral partners (Prospects): name, job title, employer and business email address of a contact at an organization a SurveyRock partner introduces to us, with the partner’s note on why

Where we obtain a Prospect’s business contact details from a source other than the individual, we link to this Policy in the first message we send, and we record where each record came from — so if you ask us how we got your details, we can tell you exactly. Section 4 states the legal basis, Section 6.1 your right to object, and Section 9 how long we keep the record.

3.5 Information from our free tools

Some tools on our website, such as the NPS and sample-size calculators, run entirely in your browser: what you type in them is not sent to us.

The feedback readout is different. When you use it:

The comments you upload (and the scores, if your file has them) are sent to our servers. Before we analyse them, we remove email addresses, phone numbers and IP addresses. We send the comments to our AI providers (Section 14) to find themes and sentiment. You may only upload feedback you are allowed to share with us; please remove names and other personal details first. Do not upload health information or other sensitive information (such as racial or ethnic origin, religious beliefs or sexual orientation). The feedback readout is not covered by a HIPAA business associate agreement. If you uploaded something by mistake, email privacy@surveyrock.com and we will delete it.
Your email address, if you ask for the full readout, and whether you asked for follow-up emails, with the date and the wording you agreed to.
Technical data: your IP address, to limit how many readouts one network can request in 24 hours and for a bot check (Cloudflare Turnstile, which receives your IP address for that check). We don’t store your IP address with your readout. If our website’s analytics has given your browser an identifier, we store it with the readout so we can tell whether a readout led to a signup.

We use this to produce and send your readout, to let you open your file in a SurveyRock account if you sign up within 7 days, to protect the tool from abuse and, only if you ticked the box, to send you a few follow-up emails.

4. How We Use Information

We use the information we collect for the following purposes, on the legal bases shown:

Purpose	Legal basis (GDPR)
Provide, operate, and maintain the Service	Contract (Art. 6(1)(b))
Process payments and billing	Contract (Art. 6(1)(b)) — via Paddle
Send transactional communications (signup confirmation, password reset, account changes, billing)	Contract (Art. 6(1)(b))
Produce and deliver a free tool result you asked for, and let you move it into an account	Steps at your request / contract (Art. 6(1)(b))
Provide customer support	Legitimate interests (Art. 6(1)(f)) and contract
Improve the Service through analytics and product research	Legitimate interests (Art. 6(1)(f))
Produce anonymous, aggregated statistics and benchmarks (Section 4.3)	Legitimate interests (Art. 6(1)(f)) — Customers may exclude their account
Send bulk marketing and newsletter communications to Customers and subscribers	Consent (Art. 6(1)(a)) — opt-in only; opt-out available
Send follow-up emails after a free tool, if you asked for them	Consent (Art. 6(1)(a)); unsubscribe at any time
Contact business prospects about SurveyRock	Legitimate interests (Art. 6(1)(f)) — you may object at any time
Prevent fraud, abuse, and security incidents, including repeat free trials	Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c))
Comply with legal obligations (tax records, regulatory reporting)	Legal obligation (Art. 6(1)(c))
Enforce our Terms of Service and policies	Legitimate interests (Art. 6(1)(f))

4.1 AI features

How AI features handle your data — including our no-training commitment, transient processing by AI providers, and how to opt out — is described in Section 14 (AI and Automated Decision-Making).

4.2 Marketing to Customers, and contacting business prospects

The marketing row and the business-prospects row in the table above are different purposes with different legal bases, and the distinction is deliberate:

Bulk marketing and newsletters — product announcements, newsletters, and campaign emails sent to a list — go only to people who have opted in. Consent is the basis, and you can withdraw it at any time. See Section 13.1.
Individual business outreach — a named person at SurveyRock writing to a named individual at a business, in their professional capacity, about whether SurveyRock is relevant to their work — rests on legitimate interests (Art. 6(1)(f)), not consent. We use business contact details published by the individual’s employer or by a professional or industry directory, or given to us by a SurveyRock partner who is introducing the individual’s organization (Section 3.4). We do not buy lists, we do not guess or derive addresses, and we do not contact people at personal addresses. Every such message names a real sender, carries our postal address, links to this Policy, and tells you how to stop it. See Section 13.2.

4.3 Aggregate statistics and benchmarks

We use survey-response metadata (for example whether a survey was completed, how long it took, the country and device type) and response scores (for example NPS values) to produce anonymous, aggregated statistics about how surveys perform: completion-rate norms, response patterns and industry benchmarks.

Anonymous. These statistics never identify any Customer, Respondent, account or individual survey. A figure is published only if it draws on at least 20 accounts and at least 1,000 respondent sessions, and no single account contributes more than 25% of the sessions behind it.
No content. We do not use the text of your questions or of open-ended answers for these statistics.
Not sold. We do not sell or license this data, and we do not share it with anyone except as aggregated statistics that meet the minimums above. We publish some of these statistics openly, for example in benchmark reports, and may show them in the product.
Your choice. A Customer can exclude its account from future statistics at any time, in Workspace Settings → Anonymous Benchmarks or by emailing privacy@surveyrock.com. A statistic already published is anonymous and is not recalculated afterwards.

For response data, the Customer’s authorization for this is in our Data Processing Agreement, Section 2.4.

We do not sell Personal Information. We share information only as described in this Section.

5.1 With Sub-processors

We engage trusted third-party Sub-processors to provide the Service. Each Sub-processor is bound by a written agreement requiring them to protect Personal Information in accordance with applicable law and our instructions. Our current Sub-processor List is updated whenever we add or remove a Sub-processor.

5.2 With Customers

If you are a Respondent, your response data is shared with the Customer who distributed the survey. The Customer’s privacy policy governs their use of that data.

5.3 For legal and safety reasons

We may disclose information when required by law, valid legal process (subpoena, court order, warrant), or when we believe in good faith that disclosure is necessary to:

Comply with legal obligations
Protect the rights, property, or safety of SurveyRock, our Customers, Respondents, or others
Detect, prevent, or address fraud, security, or technical issues
Enforce our Terms of Service

We will notify you of legal demands for your data unless prohibited by law.

5.4 Business transactions

If SurveyRock is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. Any such transfer will require the receiving entity to honor commitments substantially similar to this Policy.

We share information with third parties when you direct us to (e.g., integrations with Zapier, HubSpot, your CRM).

5.6 Connected apps and AI assistants

You can connect SurveyRock to an AI assistant, such as Claude, so that it can work in your account for you. This is your choice. Nothing is connected unless you approve it on the SurveyRock consent screen.

What a connected app can do. It acts as you, in the one workspace you choose, and only as far as you can yourself. It can read and change your surveys and their questions, publish them, create and manage survey links, read and export responses, and read and add contacts. It cannot delete surveys, change billing, members or workspace settings, or create API tokens.

What it can see. It can read the surveys and results you can see, including the answers Respondents gave and contact details that are not marked sensitive. Open-text answers can contain personal information that a Respondent chose to write, and a connected app can read it. A connected app does not receive Respondents’ email addresses or IP addresses, or answers and contact fields you have marked sensitive.

Where the data goes. SurveyRock does not send your data to an assistant on its own. When a connected app asks for something, we answer the request, and the data then goes to the assistant’s provider (for Claude, Anthropic). The provider handles it under your agreement with them and their privacy policy, not under this Policy, and it is not a SurveyRock Sub-processor for this purpose. You decide what to ask an assistant to do. Before you let one read Respondent data, make sure that is consistent with what you told your Respondents and with the law that applies to you.

What we record. We keep a record of each connection: the app, who approved it, the workspace, the permissions granted, and when it was made and last used. Changes a connected app makes are recorded in our audit log, as with any other use of our API, and exports of response data are recorded in the response access log. See Section 9 for how long.

Disconnecting. You can see your connected apps and disconnect any of them in your account settings, under Connected apps. A disconnected app stops working at once. Removing a connector inside the assistant does not tell us, so disconnect it here as well.

6. Your Rights and Choices

Depending on your jurisdiction, you have the following rights:

Access — request a copy of the Personal Information we hold about you
Rectification — request correction of inaccurate or incomplete information
Erasure (“right to be forgotten”) — request deletion of your Personal Information, subject to legal retention requirements
Restriction — request that we limit how we process your information
Data portability — receive your Personal Information in a structured, commonly used, machine-readable format
Objection — object to processing based on legitimate interests or direct marketing
Withdraw consent — where processing is based on consent, withdraw it at any time
Lodge a complaint — with your local supervisory authority (e.g., your national Data Protection Authority)

We respond to verified requests within one month, as GDPR requires. For complex or numerous requests we may extend by up to two further months; if so, we will tell you within the first month.

6.2 Rights under CCPA/CPRA (California residents)

Right to know what Personal Information we collect, how we use it, and with whom we share it
Right to delete Personal Information we hold about you
Right to correct inaccurate Personal Information
Right to opt out of sale or sharing of Personal Information (we do not sell)
Right to limit use of sensitive personal information
Right to non-discrimination for exercising these rights

We respond to verified requests within 45 days, with one 45-day extension if reasonably necessary.

6.3 Other jurisdictions

If you reside in a jurisdiction with privacy rights not enumerated above (Brazil’s LGPD, Canada’s PIPEDA, etc.), please contact us to exercise applicable rights.

6.4 How to exercise your rights

Email us at privacy@surveyrock.com. We may need to verify your identity before fulfilling certain requests. There is no charge for exercising your rights, except where requests are manifestly unfounded or excessive.

7. International Data Transfers

SurveyRock stores Customer and Respondent data primarily in the European Union (AWS Stockholm). Some of our Sub-processors — for example payment, support, and AI providers listed in our Sub-processor List — process limited data in the United States or other countries whose privacy laws may differ from those of your jurisdiction.

For transfers from the EEA, UK, or Switzerland, we rely on:

Standard Contractual Clauses (SCCs) approved by the European Commission
UK International Data Transfer Agreement for UK transfers
Additional safeguards (encryption, contractual commitments) as required by Schrems II

8. Data Security

We implement reasonable technical and organizational measures to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include:

Encryption in transit (TLS 1.2+ for all connections)
Encryption at rest (AES-256 for databases and storage)
Access controls (role-based access, multi-factor authentication for staff)
Network security (VPC segmentation, security-group allowlists, VPC Flow Logs)
Audit logging (CloudTrail and application-level audit logs)
Regular security reviews and dependency vulnerability scanning

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

For details on our security posture, see our Trust Center.

9. Data Retention

We retain Personal Information only as long as necessary for the purposes described in this Policy or as required by law.

Data category	Retention period
Account information	Duration of account + 30 days after closure, then deleted
Survey content (questions, design)	Duration of account + 30 days after closure
Response data (collected by Customers)	Retained for the life of the Customer’s account unless the Customer configures a retention period per survey (auto-anonymize or auto-delete after a set number of days), or deletes it earlier. Deleted within 30 days of account closure like all account data.
Billing records	7 years (US tax law)
Support communications	3 years from last interaction
Reason you gave when closing an account (exit survey)	The category you chose is kept. Any free-text comment is removed 24 months after you gave it.
Win-back list (former customers we have emailed about coming back — see 13.2)	12 months after the last message if you have not signed back in; 24 months after you sign back in. If you ask us to stop, we keep only your email address on the suppression list (see 9.1).
Sign-in attempt records (IP address, browser, success or failure)	90 days
Email delivery records (who an email was sent to, subject, delivery status)	The recipient’s address is removed after 90 days; the rest of the record is deleted after 2 years.
Abuse-prevention records (the result of our checks on surveys and campaigns we hold or block)	1 year. A record of a hold or block on a survey that still exists is kept while the survey exists.
Signup fingerprint (the email fingerprint, and the browser, IP address and country recorded at signup)	While your account is open, and for 24 months after it is closed, then deleted. Used only to stop repeat free trials.
Prospect records — no reply	12 months from the last contact attempt, then deleted
Prospect records — replied, or in an active sales conversation	Life of the opportunity + 24 months
Suppression list (“do not contact”) entries	Retained indefinitely — see below
Server logs (access, error)	90 days
Backups	90 days
Audit logs	1 year
Connected-app records (the app, who approved it, the workspace, permissions, and when it was made and last used)	Until you disconnect the app, and for 90 days after. Sign-in tokens expire after 1 hour (access) and 30 days (refresh), and expired tokens are deleted.
Comments and scores uploaded to the feedback readout	7 days from upload, then deleted. If you sign up within that time and open them in your account, they become your survey’s responses and follow the Response data row.
Your feedback readout (the themes, summary, and up to three example comments for each theme)	30 days from creation, then deleted
Your email address, your follow-up choice (with when you made it and the wording you agreed to) and the analytics identifier stored with a readout	Deleted with the readout, 30 days from creation
Free tool email address held by our email provider (only if you asked for follow-up emails)	Until you unsubscribe or ask us to delete it. After you unsubscribe we keep only the address on the suppression list (Section 9.1).
Free tool rate-limit records (IP address)	24 hours from your network’s first readout

When you close your account, we delete your account data within 30 days. Records that the table above gives their own period (billing records, and the exit-survey, win-back, sign-in, email-delivery, abuse-prevention and signup-fingerprint records) are kept for that period, not for 30 days, and are then deleted. Where the law requires us to keep something longer (for example billing records), we keep it for that time.

9.1 Why the suppression list is kept indefinitely

If you tell us not to contact you, we keep your name and contact details on a permanent suppression list and check that list before every send. Deleting the entry would remove the only means we have of recognizing you and honoring the request, so we retain it for exactly that purpose. A suppression entry is never used for marketing, profiling, analytics, or any other purpose, and once the underlying Prospect record is deleted we hold nothing else about you.

10. Children’s Privacy

The Service is not directed to individuals under 16. We do not knowingly collect Personal Information from children below this age. If we become aware that we have collected Personal Information from a child, we will delete it.

If you are a parent or guardian and believe your child has provided us with Personal Information, please contact us.

11. Sub-processors

We use Sub-processors for cloud hosting, payment processing, email delivery, customer support, analytics, AI features, and related operations. The current list — the specific companies, what they do, and where they process data — is maintained at our Sub-processor List.

We notify Customers of material changes to our Sub-processor list at least 30 days in advance by email to the primary contact on each Account and by in-app notification.

12. Cookies and Tracking Technologies

We use cookies and similar technologies for authentication, session management, security, analytics, and remembering your preferences. For full details, see our Cookie Policy.

You can manage cookie preferences via our cookie banner or your browser settings.

13. Marketing Communications

13.1 Bulk marketing and newsletters

We send bulk marketing communications — newsletters, product announcements, and campaign emails — to Customers and subscribers only with your consent (opt-in). You can withdraw consent at any time by:

Clicking “unsubscribe” in any marketing email
Updating preferences in your account settings
Contacting us at privacy@surveyrock.com

13.2 Individual business outreach

Separately, we sometimes write directly to a named individual at a business about whether SurveyRock is relevant to their work. This includes writing to the business address on a former customer’s account to invite them back. These are individual messages from a named person rather than bulk sends, and they rest on legitimate interests (Art. 6(1)(f)) rather than consent — see Section 4.2.

You can object at any time and you do not have to give a reason. Reply to the message and say so, or email privacy@surveyrock.com. We stop as soon as we receive it — in practice the same working day — and we record the objection so it is honored permanently and across every channel. Section 9.1 explains what that record contains and why we keep it.

Transactional communications (signup confirmation, password reset, billing, security alerts) are not marketing and may continue even if you opt out of marketing.

14. AI and Automated Decision-Making

SurveyRock uses AI to provide certain features, including: survey question and structure generation; theme detection and sentiment analysis of open-text responses; summaries and insights (including executive summaries and dashboards); natural-language queries over your response data (AI Query); AI steps inside workflow automations (e.g., sentiment, urgency, and theme tagging); and — where the Customer enables it — automatically generated follow-up questions shown to Respondents during a survey when an open-text answer is brief.

These features are advisory — they suggest, categorize, or summarize, but do not make automated decisions that produce legal or similarly significant effects on individuals. Respondent-facing AI follow-ups are generated content; Customers who enable them are responsible for any Respondent-disclosure obligations that apply in their jurisdiction.

You retain full control:

Review and modify any AI suggestions before using them
Disable AI features for your account at any time
Export raw response data unchanged by any AI processing

Transparency commitments:

AI-generated content is labeled as such in Customer-facing surfaces (for example, dashboards and insight cards); AI-generated follow-up questions shown to Respondents during a survey are not currently distinguished from other survey questions
We disclose which AI providers process your data in our Sub-processor List
We do not use Customer survey content to train AI models without explicit opt-in
Data sent to AI providers is processed transiently — solely to provide the requested feature — and is not retained by them beyond the request lifecycle (subject to the provider’s own logging policies; see our Sub-processor List)

The feedback readout (Section 3.5) uses the same text analysis, with the same providers and the same commitments: we do not train AI models on what you upload, and the providers process it only to answer the request.

Connecting an AI assistant to your account (Section 5.6) is separate from the AI features described above. SurveyRock does not send your data to that assistant; it answers what the assistant asks for.

15. Changes to This Policy

We may update this Policy from time to time. When we make material changes:

We update the “Last updated” date at the top
We notify Customers by email and in-app notification, at least 30 days before material changes take effect
Continued use of the Service after the effective date constitutes acceptance of the updated Policy

Historical versions are available upon request.

16. Contact Us

For questions, requests, or complaints regarding this Policy or our privacy practices:

Privacy contact: privacy@surveyrock.com

Postal address: Oak Mountain Digital LLC, 16192 Coastal Hwy, Lewes, DE 19958, United States

For EU/UK residents: Data Protection Officer: We have not designated a Data Protection Officer. Contact privacy@surveyrock.com for all privacy matters.

You also have the right to lodge a complaint with your local data protection authority.