Privacy Policy

1. Who we are

SurveyZero (the "Service") is provided and operated by Jumpei Takiyasu, a sole proprietor based in Japan ("we", "us"). "SurveyZero" is the name of the service; the operator responsible for the processing described in this policy — the personal information handling business operator and data controller — is Jumpei Takiyasu, subject to the exception in section 3.

You can reach us through the contact form. Our address and phone number are disclosed without delay on request.

2. Who this policy covers

This policy distinguishes three groups of people, because both the data involved and our role differ between them.

• Website visitors: people who browse surveyzero.app without signing in.
• Account and workspace users: people who sign in to the Service to create, publish, and analyze surveys.
• Survey respondents: people who answer a survey created by a user.

3. Our role for survey responses

For information about website visitors and users, we determine the purposes and means of processing.

For survey responses, the user who created the survey decides what to ask, whom to distribute it to, and how to use the answers. That user is the party responsible for the response data; we process it on their behalf in order to deliver the survey and to store, aggregate, and analyze the answers.

The specific terms of that relationship are set out in ourData Processing Agreement.

If you are a respondent and want to access, correct, or delete your own answers, please contact the organization that distributed the survey first. If you cannot reach them, contact us and we will help route the request.

4. Data we process

Account data: name, email address, and the information required to authenticate you (passkey/WebAuthn credential identifiers, magic-link tokens, identifiers from Google and Microsoft OAuth sign-in). We do not offer password authentication and do not store passwords.

Workspace and usage data: workspace and membership records, the surveys you create and edit, operational logs of creation, editing and publication, access logs, IP address, and browser information.

Survey response data: the answers submitted to a survey, together with associated information such as timestamps, completion state, invitation token state, and the acquisition parameters attached to the response link. What is collected as answer content is designed by the user who created the survey.

Billing and metering data: your plan, Stripe customer and subscription identifiers, and the counters needed to calculate charges and enforce limits (submission counts, AI usage). Payment details such as card numbers are collected and managed directly by Stripe; we never receive them.

Product analytics data: a pseudonymous identifier, your user and workspace identifiers after sign-in, page paths, campaign and referrer information, and product events such as "survey generated" or "signup completed". See sections 6 and 7.

Cookies and similar technologies: see section 7.

5. Why we process it, and on what legal basis

We use the information we collect for the purposes below. Where the EU or UK GDPR applies to our processing, we rely on the following legal bases.

Where we process response data on behalf of a user (section 3), the legal basis for collecting those responses is determined by the user who created the survey, not by us.

6. Service providers

We entrust processing to the following providers to the extent necessary to operate the Service. Each receives only what that function requires.

Details of each provider's purpose, the data involved, and where it is processed are on theSubprocessors page, which separates the providers we engage as subprocessors for response data from those we use as a controller. The terms that apply when we process response data as a processor are set out in our Data Processing Agreement.

We do not sell personal data. Apart from the providers above, we do not disclose personal data to third parties except with your consent or where required by law.

7. Cookies and similar technologies

We use cookies and browser storage in two categories.

• Strictly necessary: sign-in session management, security and abuse prevention, and retaining in-progress answer drafts and display preferences. These are indispensable to providing the Service, so we use them without asking for consent.
• Analytics: PostHog, as described in section 6. These are not enabled until you accept them. We do not even load or initialize the analytics library before you choose, and if you choose "Reject" they stay off.

You can change your analytics choice at any time from "Cookie settings" in the footer. You can also disable cookies in your browser, but disabling the strictly necessary category will break core functions including sign-in.

8. International processing

We operate the Service from Japan, and the providers in section 6 process data in multiple countries, including the United States. Your information may therefore be transferred to and processed in countries other than your own. Where the EU or UK GDPR applies to such a transfer, we rely on the transfer mechanisms our providers make available, including standard contractual clauses.

9. Retention

We retain your data while your account or workspace is active, and for up to 90 days after deletion. Information we must keep because of legal obligations or billing and audit needs may be retained beyond that. Account closure and workspace deletion can each be requested from the settings within the Service.

Retention of individual surveys, responses, events, uploaded files, and local drafts follows our operational retention policy. If we change that policy materially, we will also update this page.

10. Storage and security

Your data is stored primarily on Cloudflare infrastructure. We apply technical and organizational measures including encryption in transit, authentication and authorization, tenant isolation, access control, and monitoring.

11. Your rights

Depending on applicable law, you may request access to, correction of, deletion of, or suspension of use of your information, request data portability (export), object to or seek restriction of specific processing, and withdraw consent you previously gave. Where we rely on consent — for analytics — you can withdraw it at any time from "Cookie settings" in the footer. Withdrawal does not affect the lawfulness of processing carried out before it.

• Requests to disclose, correct, or delete the personal data we hold
• Unsubscribing from marketing email
• Data export to the extent the Service provides it

To exercise these rights, contact us through the contact form. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection supervisory authority.

For requests about answers you gave to a survey created by someone else, see section 3.

12. Children

The Service is not directed at children. Only people aged 18 or over may create an account. Where minors are surveyed as respondents, deciding whether that is permissible and obtaining any consent required is the responsibility of the customer who created the survey.

13. Changes to this policy

We may revise this policy as needed. If a change is material, we will notify you by an appropriate means, such as email to your registered address or an in-service notice.

14. Contact

Questions or requests about this policy: contact form.

15. Authoritative version

The authoritative version of this privacy policy is the Japanese version. Translations into other languages are provided for the convenience of users; if there is any inconsistency or discrepancy with the Japanese version, the Japanese version prevails.