Privacy Policy

Our Commitment to Privacy

1. Anonymous Surveys

Here's how we protect your anonymity:

• Your email address is stored in a separate authentication table, not in our main database alongside your survey responses
• Survey administrators and HR personnel can only see aggregated, anonymized data
• Individual responses are never linked to identifiable information in reports or analysis
• Your email is used solely to allow you to log back in and edit your responses

2. Information We Collect

We believe in data minimization. We collect only what is necessary to provide our service:

For Survey Participants:

• Email address - Used only for authentication (allowing you to log back in)
• Survey responses - The answers you provide to survey questions

That's it. We do not collect your name, job title, department, or any other identifying information.

For Account Holders (HR/Administrators):

• Email address - For account creation and communication
• Password - Securely hashed and stored for authentication
• Company/Organization name - To identify your surveys and data
• Internal account identifier - When you register to create and manage surveys, we generate an internal ID for your account. Your email address is stored alongside this ID so that we can identify account owners when providing support or resolving issues

3. How We Use Your Information

We use the information we collect solely to:

• Provide and maintain the Service
• Allow you to access and manage your surveys or responses
• Generate anonymized, aggregated analysis and insights
• Send you important service-related communications
• Improve and develop new features for the Service

4. Data Storage and Security

Your data is stored securely using industry-standard practices:

• All data is encrypted in transit using HTTPS/TLS
• Data is stored in secure, access-controlled cloud infrastructure
• Authentication credentials are stored separately from survey data
• We implement access controls to limit who can access data
• Regular security reviews and updates are performed

5. Third-Party Services

We use a limited number of third-party services to operate Springboard:

Analytics

We use Google Analytics and similar tools to understand how users interact with our website. These analytics tools are only loaded if you consent by accepting analytics cookies. When active, they collect:

• Pages visited and time spent on pages
• General geographic location (country/region level)
• Device type and browser information
• Referring websites

This analytics data is aggregated and does not identify individual users.

Infrastructure

We use cloud infrastructure providers (such as Google Cloud/Firebase) to host and operate our service. These providers are bound by their own privacy policies and data protection agreements.

6. Cookies

We use two categories of cookies:

• Essential cookies - Required for the website to function (authentication, session management). These are always active.
• Analytics cookies - Used to understand how visitors use our site. These are only set if you consent by clicking "Accept all" on our cookie banner.

We do not use advertising cookies or tracking cookies from third-party advertisers.

You can change your cookie preference at any time by clearing your browser's local storage and reloading the page. The cookie consent banner will reappear, allowing you to make a new choice.

7. Data Retention & Deletion

We retain your data for as long as necessary to provide the Service:

• Survey responses and analysis are retained for as long as the survey owner's account is active
• Account information is retained until the account is deleted
• If a survey owner has not logged in for a period of two (2) years, their account and all associated data will be automatically deleted

Deletion Rights

You can delete your data at any time without needing to contact us:

• Survey respondents may delete their own survey responses at any time through the Service. Note: any survey analysis already generated or reports downloaded by the survey owner prior to deletion will not be retroactively affected.
• Survey owners may delete all data associated with an individual survey, an entire survey collection, or their full account (including all survey data) at any time.

Deletion Process

• When data is deleted, it enters a 30-day recovery period to protect against accidental deletion, after which it is permanently and irreversibly removed
• Authentication credentials (email, password) are deleted immediately upon account deletion — they are not subject to the 30-day recovery period
• Data held by third-party processors (e.g. analytics providers) is deleted according to their respective retention policies

8. Regulatory Compliance

Lawful Basis for Processing (GDPR Article 6)

• Authentication data (email, password) — processed under contract performance (Art. 6(1)(b)), as it is necessary to provide the Service
• Survey responses — processed under legitimate interest (Art. 6(1)(f)); the employer has a legitimate interest in understanding workplace culture, balanced against employee rights by collecting responses anonymously
• Analytics — processed under consent (Art. 6(1)(a)) via cookie consent

AI Transparency (EU AI Act)

• All analysis and insights are clearly identified as AI-generated content
• Survey respondents are informed before submission that their responses will be analysed by AI
• No automated decisions are made about individual employees — all AI outputs are advisory and require human review
• We do not train or fine-tune AI models on your data; we use commercial AI services via API and your data is not retained by those providers for training purposes
• Only anonymised survey text is sent to AI providers — no personal identifiers are included

9. Your Rights Under GDPR

Under the UK/EU GDPR, you have the following rights regarding your personal data:

• Access (Art. 15) — Request a copy of the personal data we hold about you. Survey owners can view all their data directly in the Service.
• Rectification (Art. 16) — Request correction of inaccurate personal data. Email addresses can be updated via account settings.
• Erasure (Art. 17) — Request deletion of your personal data. Self-service deletion is available for all users (see Section 7 above).
• Restriction (Art. 18) — Request restriction of processing of your data.
• Portability (Art. 20) — Request a copy of your data in a portable format. Survey response data can be exported as CSV.
• Objection (Art. 21) — Object to processing of your data based on legitimate interest.

Note for anonymous survey respondents: Because survey responses are not linked to any personal identifier, we cannot identify which response belongs to which individual. This is a privacy feature by design. If you wish to delete your response, you can do so directly through the Service while your session is active.

To exercise any of these rights, please contact us using the information provided below.

10. Children's Privacy

The Service is not intended for use by children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us through our website's contact form or at the contact details provided on our website.