Legal
Privacy Policy
How we collect, use, share, and protect personal information in the Conejo Survey service.
1. Overview
Conejo Survey is a service provided by Market Action Research, Inc. ("Conejo Survey", "we", "us", "our"). This Privacy Policy explains how we handle personal information in our website, account, billing, and survey platform. It applies to information we control directly and also explains our role when customers use the Service to collect respondent data.
2. Roles: When We Are a Controller and When We Are a Processor
Information we control directly
For your account information, billing profile, subscription records, website usage analytics, and support communications, we generally act as the controller or business.
Survey response data you collect
When you use the Service to collect survey responses, you generally decide what data to collect and why. In that context, you are typically the controller or business, and Conejo Survey acts as your processor or service provider.
If you need processor terms for business use, see our Data Processing Addendum.
3. Information We Collect
Account information
- •Username and email address
- •Password hashes and authentication metadata
- •Name fields or profile information you add in settings
Billing and business profile information
Payment processing is handled by Stripe. We do not store full payment card numbers or CVC values. We may receive and store:
- •Billing email, billing contact name, company name, phone number, and billing address
- •Tax or business identifier details you choose to provide
- •Card brand, last four digits, expiration date, subscription status, and invoice history
Survey and workspace data
- •Survey questions, settings, branching logic, dashboards, and project configuration
- •Uploaded media such as logos, image-choice assets, and photo uploads
- •Response exports, usage tied to your plan, and support-related account context
Respondent information
- •Survey answers, comments, uploads, and timestamps
- •Email address, if the customer enables email gating or response restrictions
- •A device identifier cookie used to resume sessions or reduce duplicate submissions within a survey or chain
We do not use respondent data for advertising, and our device identifier is intended for response integrity and session continuity rather than cross-survey profiling.
Cookies, embedded forms, and technical data
- •Authentication, session, and security cookies needed to sign in and keep forms secure
- •Cross-site form and embed cookies used when customers embed surveys on third-party sites
- •Analytics identifiers and browser/device information when website analytics are enabled
Optional AI feature inputs
If you intentionally use an AI-assisted feature, we may process the prompt, related survey content, or a website snapshot you choose to analyze for that feature. We do not send customer survey data to AI services unless the feature requires it and you initiate that feature.
4. How We Use Information
- •Provide the Service: Host surveys, collect responses, render dashboards, manage projects, and deliver exports
- •Process billing: Create and manage subscriptions, invoices, and payment-method records
- •Maintain security: Authenticate users, prevent fraud or abuse, and enforce response controls
- •Improve the product: Analyze usage, debug issues, and make product decisions
- •Support optional AI features: Run the AI-assisted functionality you intentionally choose to use
- •Communicate with you: Send billing notices, product updates, and support responses
5. How We Share Information
We may share information with:
- •Stripe: Payment processing, billing records, and subscription management
- •Google: Website analytics when enabled, and web font delivery used by our site
- •Anthropic: Optional AI-assisted features you initiate
- •Service providers: Vendors that help us operate the Service, such as infrastructure, storage, security, or support providers, under confidentiality obligations
- •Legal or business events: If required by law, to protect rights and safety, or in connection with a merger, financing, or asset transfer
A current overview of key vendors is available on our Subprocessors page.
6. Data Retention
Active accounts
Retained while your account is active and while needed to provide the Service
Deleted accounts
Deleted within 30 days after confirmed account deletion, unless retention is required for legal or security reasons
Canceled subscriptions
Workspaces may remain on the Free tier until the account is deleted
Billing records
Retained as needed for tax, accounting, and legal compliance, generally up to 7 years
7. Your Choices and Rights
- Access and correction: You can review and update account and billing profile details in settings.
- Export: You can export survey data using the tools available in the product.
- Deletion: You can request account deletion at [email protected].
- Respondent rights: If you are a survey respondent, requests about a specific survey should generally be directed to the survey creator first because they control the survey and its purpose.
California notices
If California law applies to our handling of your information, California residents may request disclosure of the categories of personal information we collect, the sources and purposes for collection, the categories of third parties we disclose to, and, where applicable, a copy, correction, or deletion of personal information we control. We do not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for exercising applicable privacy rights.
You may submit requests by emailing [email protected]. We may verify requests by matching the request to account information we already have. Authorized agents may submit requests on your behalf where permitted by law.
8. Cookies and Similar Technologies
- •Essential cookies: Used for authentication, session continuity, fraud prevention, and CSRF protection.
- •Response integrity cookie: The `survey_device_key` cookie helps resume public sessions and reduce duplicate responses within a survey or survey chain.
- •Embedded forms: Some cookies may need to operate across sites when customers embed surveys on third-party domains.
- •Analytics: When enabled, Google Analytics helps us understand website usage and improve the product.
9. Security
Encryption in transit
Traffic to the Service is protected with HTTPS/TLS
Payments via Stripe
Full card data is handled by Stripe rather than stored by us
Secure password handling
Passwords are stored using industry-standard hashing practices
Access controls
Administrative and application access is restricted to what is reasonably needed
No system is perfectly secure. If we become aware of a security incident requiring notice under applicable law, we will provide notice as required.
10. U.S. Processing and International Use
Conejo Survey is operated from the United States, and customer data is generally stored and processed in the United States. If you use the Service from another country, you understand that your information may be transferred to and processed in the United States.
Our self-serve offering is primarily designed for U.S.-based customers. If you need region-specific data residency, international transfer commitments, or additional privacy terms, contact us before using the Service for that purpose.
11. Children and Restricted Data
The Service is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13 for our own purposes. If you believe a child has provided us with personal information in a way that should not have happened, contact us.
The Service is also not intended for the collection of highly sensitive or regulated data, such as full payment card data, Social Security numbers, government IDs, protected health information, or similar regulated data, unless we separately agree in writing.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy and may also provide notice through the Service or by email. The "Last updated" date reflects the latest revision.
13. Contact
Privacy questions, rights requests, or data-processing questions can be sent to [email protected].