Privacy Policy

The data controller is Tomáš Nyč, company ID 22322531, with its registered office at Školská 660/3, Praha 1 - Nové Město 11000. Contact: support@asqiro.com.

• Account owner details - name, email address, profile photo if you upload one, and preferred language, as entered in the profile settings.
• Billing details - billing customer and subscription identifiers, plan status, and the account details needed to provide paid plans. Payment-card details are processed by Lemon Squeezy, not by Asqiro.
• Survey content - survey questions, structure, settings, and related metadata created by the account owner.
• Survey responses and response analytics - answers, response-session identifiers, completion status, question timing, and aggregate survey statistics submitted or generated through shared surveys.
• AI feature inputs - instructions and relevant survey content that a user chooses to send when using an AI-assisted feature, including a survey draft requested on the public website before signing in.
• Operational data - security, access, audit, quota, and AI-usage records needed to operate, protect, and improve the service. Rate-limit records are keyed by a hashed IP address or a random browser identifier and expire automatically.
• Technical data - IP address, browser type, and access time as part of standard server logs.
• App usage data - if you consent to analytics, we may process aggregate traffic and feature usage data through Firebase and Google Analytics.
• Advertising data - we use Google Ads to measure sign-ups from our advertising. The Google Ads tag loads only after you grant marketing consent. Personalized advertising and remarketing require a separate choice.
• Collaboration data - email addresses of people invited to a workspace, project, or survey, their roles, and comments written on surveys and results.
• API and integration data - API keys, webhook endpoint addresses, signing secrets, and delivery logs; the respondent identifier (externalUserId) that an API user attaches to embedded responses; and, when a Google Sheets connection is set up, an encrypted access token and the target spreadsheet.

We do not sell personal data. Advertising measurement, personalized ads, and remarketing are used only with your consent. Data is processed through the service providers listed below under their applicable contractual terms:

• Vercel - server infrastructure provider.
• Google / Firebase - authentication, database and file storage, optional analytics and advertising measurement (Google Analytics and Google Ads) according to your cookie choices, bot protection for the survey generator on the public website (reCAPTCHA through Firebase App Check), and the Google Sheets export when a user connects it.
• OpenAI - processing of instructions, relevant survey content, and aggregated survey analysis inputs only when you choose to use an AI-assisted feature.
• Resend - delivery of transactional emails, invitations, and feedback notifications where applicable.
• Lemon Squeezy - payment processing, customer billing, subscriptions, and the customer portal. The Lemon Squeezy checkout script is loaded on Asqiro pages so checkout can open in place; when it loads, Lemon Squeezy receives technical request data such as your IP address.
• Sentry - error monitoring and security diagnostics. We send only redacted technical error data, such as the error type, mapped stack trace, route template, and browser and operating-system details. We do not send survey responses, account content, request bodies, cookies, full URLs, or error-message text.
• jsDelivr - content delivery network that serves emoji images in the survey editor; it receives technical request data such as your IP address.
• Webhook and API recipients chosen by the survey owner - when a workspace member configures a webhook, integration, or API access, Asqiro sends survey events, including completed responses with their answers, to the destination that member chose. The survey owner is responsible for that recipient.

Some providers may process data outside the EEA. Where a transfer is required, we rely on the transfer mechanism made available by the relevant provider and applicable law. Data may also be disclosed to public authorities when required by law.

For personal data that a survey owner collects from respondents, the survey owner normally determines the purpose and means of processing and is the controller. Asqiro processes that data on the owner's documented instructions to provide the service. Asqiro is an independent controller for account, billing, security, legal-compliance, and optional product-analytics data.

Survey owners are responsible for providing respondents with their own privacy information, selecting a lawful basis, and entering into any data-processing terms required for their use of Asqiro. Contact us at support@asqiro.com to request data-processing terms.

AI features are optional. When you use one, Asqiro sends your instruction and the survey content needed to complete that request to OpenAI. This may include survey titles, descriptions, questions, answer options, and variant content. Smart Analysis also sends aggregate survey signals, such as answer distributions, common terms, sentiment totals, and completion metrics. It does not send raw open-text answers to OpenAI. Do not include personal or confidential information unless it is necessary and you are authorized to process it.

AI output is a draft that you can review, edit, ignore, or revert. Asqiro does not use AI as the sole basis for decisions about users or respondents.

• Account owner data - for the duration of the contract and up to 3 years after termination.
• Raw survey responses - retained for the survey owner's configured workspace retention period. The default is 730 days; eligible workspaces can set a period from 30 to 3,650 days. A legal hold can postpone deletion.
• Aggregate survey analytics - retained separately from raw responses so survey-level reporting remains available after raw-response deletion.
• Response-session analytics - up to 30 days.
• AI cost and usage records - approximately 13 months; these do not contain prompts, survey content, or respondent answers.
• Workspace audit records - up to 365 days where the audit-log feature is available.
• Server logs - up to 90 days.
• Sentry error-monitoring records - retained according to the Sentry project retention setting.
• Webhook delivery logs - 30 days; they record the outcome of each delivery, not its content.
• In-app notifications - 30 days.

Under GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase data where applicable
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent at any time where processing is based on consent

Send requests to support@asqiro.com. You may also file a complaint with the Czech Data Protection Authority: www.uoou.gov.cz.

Data is protected with encryption in transit (TLS), and access to the system is protected by authentication. We regularly apply security reviews and dependency updates.

More information about cookies is available in our Cookie Policy.

We may update this document when our processing changes or the law requires it. The current version is always available on this page. Where required, we will provide additional notice or request a new consent.