Privacy Policy

Document status: Approved v1.0 (2026-07-21) Effective date: 2026-07-21 Last updated: 2026-07-21

1. Introduction

Oak Mountain Digital LLC (“SurveyRock”, “we”, “us”, or “our”) operates the SurveyRock platform and the websites located at www.surveyrock.com, app.surveyrock.com, and related subdomains (collectively, the “Service”).

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the Service or interact with us, and the choices you have regarding our use of your information.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Policy, do not use the Service.

2. Scope and Definitions

2.1 Who this Policy covers

This Policy applies to two distinct categories of individuals:

Customers — businesses and individuals who hold a SurveyRock account, including their authorized users (the “Customer” or “you” when context indicates the account holder)
Respondents — individuals who answer surveys distributed using SurveyRock by our Customers

When Customers use SurveyRock to collect responses, the Customer is generally the data controller for the response data, and SurveyRock is the data processor. SurveyRock is the controller only for information collected directly from Customers and from Respondents about the Service itself (e.g., session data, account information).

2.2 Key definitions

“Personal Information” means any information relating to an identified or identifiable natural person
“Processing” means any operation performed on Personal Information (collection, storage, use, disclosure, deletion, etc.)
“Controller” and “Processor” have the meanings given to them under GDPR Article 4
“Sub-processor” means a third party that processes Personal Information on our behalf — see Section 11 and our Sub-processor List

3. Information We Collect

3.1 Information you provide

When you create a SurveyRock account or use the Service, we collect:

Account information: name, business email, password (hashed and salted), company name, role, billing address
Billing information: processed by Paddle as our Merchant of Record — see Section 11
Survey content you create: survey questions, design, logic, branding customizations
Survey distribution information: contact lists you upload, email addresses you target
Support communications: any messages you send to our support team or related agents
Profile information: any other information you choose to provide

3.2 Information collected automatically

When you use the Service, we automatically collect:

Usage data: pages visited, features used, time spent, click paths (via product analytics — see Section 12)
Device and connection data: IP address, browser type, operating system, device identifiers, language preferences
Cookies and similar technologies: see our Cookie Policy for details
Log data: server logs of requests, error events, performance data

3.3 Information collected from Respondents

When a Respondent answers a survey:

Response data: the answers they provide (controlled by the Customer who created the survey)
Metadata: completion time, response timestamp, IP address (truncated unless Customer enables full collection), device and browser information
Optional identifiers: only what the Customer has configured (e.g., email if survey requests it)

Respondent data is processed by SurveyRock as a processor on behalf of the Customer. Respondents should refer to the Customer’s privacy policy for how their response data is used.

3.4 Information from third parties

We may receive information about you from:

Identity providers (if you use SSO): name, email, work domain
Payment provider (Paddle): transaction status, payment method type (not card details), billing country

4. How We Use Information

We use the information we collect for the following purposes, on the legal bases shown:

Purpose	Legal basis (GDPR)
Provide, operate, and maintain the Service	Contract (Art. 6(1)(b))
Process payments and billing	Contract (Art. 6(1)(b)) — via Paddle
Send transactional communications (signup confirmation, password reset, account changes, billing)	Contract (Art. 6(1)(b))
Provide customer support	Legitimate interests (Art. 6(1)(f)) and contract
Improve the Service through analytics and product research	Legitimate interests (Art. 6(1)(f))
Send marketing communications	Consent (Art. 6(1)(a)) — opt-in only; opt-out available
Prevent fraud, abuse, and security incidents	Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c))
Comply with legal obligations (tax records, regulatory reporting)	Legal obligation (Art. 6(1)(c))
Enforce our Terms of Service and policies	Legitimate interests (Art. 6(1)(f))

4.1 AI features

How AI features handle your data — including our no-training commitment, transient processing by AI providers, and how to opt out — is described in Section 14 (AI and Automated Decision-Making).

We do not sell Personal Information. We share information only as described in this Section.

5.1 With Sub-processors

We engage trusted third-party Sub-processors to provide the Service. Each Sub-processor is bound by a written agreement requiring them to protect Personal Information in accordance with applicable law and our instructions. Our current Sub-processor List is updated whenever we add or remove a Sub-processor.

5.2 With Customers

If you are a Respondent, your response data is shared with the Customer who distributed the survey. The Customer’s privacy policy governs their use of that data.

5.3 For legal and safety reasons

We may disclose information when required by law, valid legal process (subpoena, court order, warrant), or when we believe in good faith that disclosure is necessary to:

Comply with legal obligations
Protect the rights, property, or safety of SurveyRock, our Customers, Respondents, or others
Detect, prevent, or address fraud, security, or technical issues
Enforce our Terms of Service

We will notify you of legal demands for your data unless prohibited by law.

5.4 Business transactions

If SurveyRock is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. Any such transfer will require the receiving entity to honor commitments substantially similar to this Policy.

We share information with third parties when you direct us to (e.g., integrations with Zapier, HubSpot, your CRM).

6. Your Rights and Choices

Depending on your jurisdiction, you have the following rights:

Access — request a copy of the Personal Information we hold about you
Rectification — request correction of inaccurate or incomplete information
Erasure (“right to be forgotten”) — request deletion of your Personal Information, subject to legal retention requirements
Restriction — request that we limit how we process your information
Data portability — receive your Personal Information in a structured, commonly used, machine-readable format
Objection — object to processing based on legitimate interests or direct marketing
Withdraw consent — where processing is based on consent, withdraw it at any time
Lodge a complaint — with your local supervisory authority (e.g., your national Data Protection Authority)

We respond to verified requests within one month, as GDPR requires. For complex or numerous requests we may extend by up to two further months; if so, we will tell you within the first month.

6.2 Rights under CCPA/CPRA (California residents)

Right to know what Personal Information we collect, how we use it, and with whom we share it
Right to delete Personal Information we hold about you
Right to correct inaccurate Personal Information
Right to opt out of sale or sharing of Personal Information (we do not sell)
Right to limit use of sensitive personal information
Right to non-discrimination for exercising these rights

We respond to verified requests within 45 days, with one 45-day extension if reasonably necessary.

6.3 Other jurisdictions

If you reside in a jurisdiction with privacy rights not enumerated above (Brazil’s LGPD, Canada’s PIPEDA, etc.), please contact us to exercise applicable rights.

6.4 How to exercise your rights

Email us at privacy@surveyrock.com. We may need to verify your identity before fulfilling certain requests. There is no charge for exercising your rights, except where requests are manifestly unfounded or excessive.

7. International Data Transfers

SurveyRock stores Customer and Respondent data primarily in the European Union (AWS Stockholm). Some of our Sub-processors — for example payment, support, and AI providers listed in our Sub-processor List — process limited data in the United States or other countries whose privacy laws may differ from those of your jurisdiction.

For transfers from the EEA, UK, or Switzerland, we rely on:

Standard Contractual Clauses (SCCs) approved by the European Commission
UK International Data Transfer Agreement for UK transfers
Additional safeguards (encryption, contractual commitments) as required by Schrems II

8. Data Security

We implement reasonable technical and organizational measures to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include:

Encryption in transit (TLS 1.2+ for all connections)
Encryption at rest (AES-256 for databases and storage)
Access controls (role-based access, multi-factor authentication for staff)
Network security (VPC segmentation, security-group allowlists, VPC Flow Logs)
Audit logging (CloudTrail and application-level audit logs)
Regular security reviews and dependency vulnerability scanning

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

For details on our security posture, see our Trust Center.

9. Data Retention

We retain Personal Information only as long as necessary for the purposes described in this Policy or as required by law.

Data category	Retention period
Account information	Duration of account + 30 days after closure, then deleted
Survey content (questions, design)	Duration of account + 30 days after closure
Response data (collected by Customers)	Retained for the life of the Customer’s account unless the Customer configures a retention period per survey (auto-anonymize or auto-delete after a set number of days), or deletes it earlier. Deleted within 30 days of account closure like all account data.
Billing records	7 years (US tax law)
Support communications	3 years from last interaction
Server logs (access, error)	90 days
Backups	90 days
Audit logs	1 year

When you delete your account, we delete or anonymize Personal Information within 30 days, except where retention is required by law (e.g., billing records).

10. Children’s Privacy

The Service is not directed to individuals under 16. We do not knowingly collect Personal Information from children below this age. If we become aware that we have collected Personal Information from a child, we will delete it.

If you are a parent or guardian and believe your child has provided us with Personal Information, please contact us.

11. Sub-processors

We use Sub-processors for cloud hosting, payment processing, email delivery, customer support, analytics, AI features, and related operations. The current list — the specific companies, what they do, and where they process data — is maintained at our Sub-processor List.

We notify Customers of material changes to our Sub-processor list at least 30 days in advance by email to the primary contact on each Account and by in-app notification.

12. Cookies and Tracking Technologies

We use cookies and similar technologies for authentication, session management, security, analytics, and remembering your preferences. For full details, see our Cookie Policy.

You can manage cookie preferences via our cookie banner or your browser settings.

13. Marketing Communications

We send marketing communications only with your consent (opt-in). You can withdraw consent at any time by:

Clicking “unsubscribe” in any marketing email
Updating preferences in your account settings
Contacting us at privacy@surveyrock.com

Transactional communications (signup confirmation, password reset, billing, security alerts) are not marketing and may continue even if you opt out of marketing.

14. AI and Automated Decision-Making

SurveyRock uses AI to provide certain features, including: survey question and structure generation; theme detection and sentiment analysis of open-text responses; summaries and insights (including executive summaries and dashboards); natural-language queries over your response data (AI Query); AI steps inside workflow automations (e.g., sentiment, urgency, and theme tagging); and — where the Customer enables it — automatically generated follow-up questions shown to Respondents during a survey when an open-text answer is brief.

These features are advisory — they suggest, categorize, or summarize, but do not make automated decisions that produce legal or similarly significant effects on individuals. Respondent-facing AI follow-ups are generated content; Customers who enable them are responsible for any Respondent-disclosure obligations that apply in their jurisdiction.

You retain full control:

Review and modify any AI suggestions before using them
Disable AI features for your account at any time
Export raw response data unchanged by any AI processing

Transparency commitments:

AI-generated content is labeled as such in Customer-facing surfaces (for example, dashboards and insight cards); AI-generated follow-up questions shown to Respondents during a survey are not currently distinguished from other survey questions
We disclose which AI providers process your data in our Sub-processor List
We do not use Customer survey content to train AI models without explicit opt-in
Data sent to AI providers is processed transiently — solely to provide the requested feature — and is not retained by them beyond the request lifecycle (subject to the provider’s own logging policies; see our Sub-processor List)

15. Changes to This Policy

We may update this Policy from time to time. When we make material changes:

We update the “Last updated” date at the top
We notify Customers by email and in-app notification, at least 30 days before material changes take effect
Continued use of the Service after the effective date constitutes acceptance of the updated Policy

Historical versions are available upon request.

16. Contact Us

For questions, requests, or complaints regarding this Policy or our privacy practices:

Privacy contact: privacy@surveyrock.com

For EU/UK residents: Data Protection Officer: We have not designated a Data Protection Officer. Contact privacy@surveyrock.com for all privacy matters.

You also have the right to lodge a complaint with your local data protection authority.