Privacy Policy.

PingPolls Privacy Policy

This Privacy Policy describes how PT Internet Respons Lab, operating under the brand name PingPolls ("PingPolls," "we," "us," or "our"), collects, uses, and handles information from our users, referred to as Form Creators, and individuals who respond to forms, referred to as Respondents. Our commitment is to transparency and providing you with control over your data.

This policy explains how information is handled when you use PingPolls. Form Creators decide what respondent information to request and are responsible for providing any notices or obtaining any permissions required for their forms. Where applicable law requires consent or another lawful basis, using the Service does not replace that requirement.

1. Information We Collect

A. From Form Creators (Our Users)

• Account and authentication information: We store account profile details such as name and email, linked sign-in provider identifiers, session and security records, and (if enabled) multi-factor authentication status and protected MFA material. Google or GitHub receives authentication requests when you choose that provider.
• Team and authorization information: We store team memberships, invitations, roles, and related access-control records. If you authorize an OAuth client or connected integration, we store the consent and authorization lifecycle data needed to issue, rotate, revoke, or validate access tokens. Token secrets are stored as hashes; authorized clients receive only the scopes and team/resource access you approve.
• Form and service data: We store form definitions and settings, drafts and revisions, submitted responses, uploaded files, and associated response and form metadata. If you use AI-assisted form creation or editing, we may store its run events and conversation messages to provide the feature and synchronize its progress.
• Email communications: We use Resend for transactional email and, when enabled by your preferences, optional mailing. Resend may process the recipient address and message delivery metadata.

B. From Respondents

• Responses and files: We receive the answers and files you submit, along with technical metadata needed to accept and associate a response with a form. What is collected depends on the form's questions and settings.
• Browser-side progress: The response experience may keep in-progress answers and temporary file data in IndexedDB so that progress can survive interruptions. This local data is cleared by submission, reset, or applicable local cleanup. Files and answers may be sent to PingPolls as part of upload or submission workflows before final submission where needed to support those workflows; do not treat browser storage as the sole location of draft data.
• Respondent identifiers and cookies: A respondent-id cookie supports continuity and response-related features. It is a pseudonymous identifier and should not be described as anonymous or unlinked in every circumstance. Password-protected forms may use a form-auth cookie after successful access. Essential application cookies also support signed-in sessions and team selection.
• AI and voice features: When enabled for a form or account action, relevant prompts, form content, response content, or retrieved context may be sent to the AI providers described below. Voice input may use browser/device speech-recognition capabilities; the provider and handling of audio or transcripts can depend on the browser/device and feature implementation. Review the applicable browser/device notices and form settings before using voice input.

C. General Data Collection

• Communications Data: When you contact us via the get in touch page, we collect your email address and any information you provide to respond to your inquiry.
• Operational and security information: We process service, diagnostic, abuse-prevention, and security events, including records needed to operate queues, integrations, exports, and deletion workflows. The precise information depends on the event and feature used.

2. How We Use and Handle Your Information

A. Core Operations

• We use information to operate accounts and teams; create, distribute, and analyze forms; accept responses and files; provide AI-assisted features; connect integrations and OAuth clients that users authorize; administer billing; provide support; and secure, maintain, and improve the Service.
• We use account and team information to authenticate users, apply permissions, process invitations, manage subscriptions, and fulfill support and privacy requests.
• Pseudonymous identifiers and essential cookies support sessions, respondent continuity, form access, security, and service operation. They do not guarantee anonymity.
• The team-id cookie is used to display the active team for Form Creators.
• We use Resend for transactional messages and, only with your consent, product updates or newsletters. You can withdraw that consent from your account or an unsubscribe link.

B. Data Processing & Security

• Data at Rest: Submitted response answer values are encrypted individually in their value columns using a per-response data-encryption key protected by an application-managed secret. Other fields are encrypted where implemented. This does not mean every stored field or copy is encrypted in the same manner. Do not submit passwords, payment card numbers, or other secrets in forms.
• Data in Transit: All communications between your browser and our servers are encrypted using HTTPS to ensure data security.
• Role-Based Access Control (RBAC): We use an RBAC concept to ensure that only authorized members of a team can access a specific form's data.
• AI providers: Depending on the feature and current configuration, relevant data may be sent to paid Google Gemini or OpenAI APIs for generation or analysis, and to Cloudflare Workers AI for embeddings used in retrieval and search. This can include relevant form content, prompts, submitted response context, and eligible uploaded-file content. AI results can be stored in PingPolls as part of conversations or feature records. Provider retention and processing are governed by the relevant provider terms and settings; we do not promise that all provider-side records are immediately erased or retained for a fixed period.

C. Data Ownership & Sharing

• Customer content: Between PingPolls and the Form Creator, the Form Creator retains rights in their form content and submitted data, subject to the rights of respondents and others. The Form Creator authorizes PingPolls to process that content to provide the Service under the Terms.
• Sharing with third parties: We do not sell respondent personal data. We disclose data to service providers needed to operate the product, including DigitalOcean (application, database, and Redis hosting), Cloudflare (object storage and certain AI embedding services), Resend (email), Google and GitHub when selected for sign-in, Dodo Payments (Merchant of Record), and AI providers when an AI feature is used. Information may also be sent to an OAuth client or integration expressly authorized by the user/team, and to a Form Creator with access to the form.
• Aggregated Data: We may use aggregated and anonymized data for our own publications and insights. This data cannot be traced back to an individual.
• Model training: PingPolls does not use respondent data to train its own general-purpose models. AI providers process inputs to return the requested outputs or embeddings under their applicable service terms. Provider data-use and retention commitments can vary by product, configuration, and terms; consult the provider's current documentation for details.

3. Data Storage & Transfer

• Hosting and transfers: Our application, database, and Redis infrastructure is hosted in DigitalOcean SFO2 (San Francisco). Cloudflare R2 stores object data in the Western North America (WNAM) region. Providers may process information in other locations as part of their services. Processing may therefore involve transfers outside your country, including to the United States and Indonesia. Contact us for information about safeguards applicable to a particular transfer; we do not claim a particular transfer mechanism where it has not been verified.
• File storage: Uploaded files may be stored privately in Cloudflare R2. Browser-side temporary file handling may also use IndexedDB. Upload and submission timing depends on the form workflow; local storage is not a substitute for a completed server-side submission.
• File Access Security: Files submitted by Respondents are stored privately. Access to uploaded files is strictly controlled and permitted only via a time-limited, pre-signed URL. This URL can be generated exclusively by the Form Creator or by the same respondent (identified by the 'respondent-id' cookie) that initially uploaded the file for temporary viewing.

Retention

• Responses and uploads: Form Creators may configure response retention where supported. Expired responses and related objects are deleted through queued background processing; physical deletion may take longer than the configured period while work and storage lifecycle cleanup complete.
• Operational events: Analytics session identifiers and integration delivery events are sanitized or removed on configured seven-day schedules. Other logs, backups, and security records may have different retention periods based on operational, security, legal, or provider requirements. Personal-export security audit events are configured for one year.
• Account deletion: An eligible deletion request places the account into an inaccessible deletion-pending state and invalidates its current session. Background cleanup removes PingPolls-managed objects and the Resend contact before deleting application records; retries may be required, so no completion time is guaranteed. Deletion is unavailable while the account's team has an active subscription. Pseudonymized security records may remain for up to one year. Dodo Payments and other providers retain their own records under their terms and legal obligations.

4. Your Rights & Data Deletion

• Rights requests: Subject to applicable law, you may request access, correction, deletion, restriction, objection, or portability by contacting us at /contact or [email protected]. Form Creators and Respondents can both make requests. A Form Creator may need to assist with respondent data held in their forms.
• Account export: Authenticated Form Creators can request an export from /account. It includes an Article 15 access-data file, supplementary processing information, exclusions/manual-review guidance, and a narrower Article 20 portability file. Automatic scope includes account/profile and MFA status, linked sign-in providers, sanitized session activity, memberships and owned-team context, local subscription/payment linkage, OAuth lifecycle metadata, sanitized export audit history, and the account's Resend contact when found. Secrets, token/recovery values, cryptographic hashes, encryption keys, encrypted object paths, and unrelated team/respondent records are excluded.
• Export access and manual review: PingPolls writes the archive to private Cloudflare R2 and emails a single-use application exchange link valid for up to 24 hours. Opening the link creates a short-lived HttpOnly landing grant. The signed-in owner must pass a fresh authenticator check or exact-primary Google reauthentication; accounts without that reauthentication path must enroll MFA. A successful check issues a private download URL valid for no more than five minutes. Cleanup and storage lifecycle enforcement may complete after expiry. Team, form, respondent, response, analytics, integration, AI conversation, uploaded object, infrastructure log, backup, and provider-side data may require manual review where it cannot be safely attributed automatically. Such data is not necessarily excluded from rights; contact us with the export ID, category, and date range. Never send credentials, TOTP/recovery codes, or tokens.
• Account deletion: Self-service deletion is available at /account when the account is eligible; it is unavailable while the account's team has an active subscription. The process removes PingPolls-managed account data, related objects, and the Resend contact after required cleanup succeeds. Provider-side records, legally required billing/tax/fraud/dispute records, security records retained under the schedule above, and data that cannot be attributed without manual review may remain. Dodo Payments is an independent Merchant of Record and controls its own payment records; contact Dodo through its privacy process for requests about those records.

5. Security Measures

• We take reasonable measures to protect your information. Access to our databases is restricted to founders and authorized database administrators.
• We do not currently claim a specific security certification such as SOC 2 or ISO 27001. No internet service can guarantee absolute security.

6. Applicable Law

PT Internet Respons Lab, operating under the PingPolls brand, is based in Indonesia. Applicable privacy laws, including Indonesia's PDP Law and the GDPR where its territorial scope applies, may provide rights and impose obligations relevant to your use of the Service. This policy is not a statement that every legal requirement or transfer mechanism applies identically to every user or processing activity.

7. Changes and Contact

We may update this policy as our product and practices change. We will notify users of material changes through reasonable channels, which may include email or in-product notice. For privacy requests or questions, contact us through /contact or at [email protected].