Privacy Policy
Effective from: 2026-11-02 Provider: Paul Bengart, Keplerstraße 4A, 39104 Magdeburg, Germany
This privacy policy describes how Choicery processes personal data when you visit the website, create and use an account, contact us or purchase a plan. It also describes the role in which Choicery processes data of survey participants. If you take part in a survey, the short Privacy Information for Survey Participants and the privacy notice of the survey's creator apply to you in addition.
1. Controller and privacy contact
Unless section 2 provides otherwise, the controller within the meaning of the General Data Protection Regulation (GDPR) for the processing described in this policy is:
Paul Bengart Keplerstraße 4A 39104 Magdeburg Germany Email: info@choicery.ai Contact form
Privacy contact: privacy@choicery.ai (Paul Bengart). Please send requests concerning your rights to the privacy contact. Report security vulnerabilities to security@choicery.ai and abuse or illegal content to abuse@choicery.ai.
2. Roles: what Choicery is responsible for and what the survey creator is responsible for
Website, account and contract. Choicery is the controller for operating the website and for accounts, contract handling, billing, support, security and the handling of legal requests. Sections 3 to 10 describe this processing.
Survey content and responses. Whoever creates a survey with Choicery (the customer) determines the purpose, questions, audience, legal basis and retention period of that survey. The customer is therefore the controller for the survey content and for the participants' responses. Choicery provides the technical platform and, in that respect, acts as processor under Article 28 GDPR on the basis of the Data Processing Agreement, which is concluded when the Terms of Service are accepted. Choicery processes survey content and responses only on the customer's instructions and does not use them for its own purposes or for training models. This does not affect troubleshooting, security and aggregated usage statistics without content. Which functions an account uses in the application is recorded by Choicery as controller for no longer than 90 days with a reference to the account (section 3, row "Usage statistics of the application"); this is evaluated in aggregated form.
If the customer acts as an employee for an organisation (for example a company, a university or a public authority), the organisation is the controller; the customer acts on its behalf, and Choicery is the organisation's processor. If the organisation engages an agency or an institute that runs the survey with Choicery, the agency or institute is the organisation's processor and Choicery is a sub-processor in that chain (Section 5(4) of the Data Processing Agreement). The privacy notice provided by the survey's creator states who the controller is in the individual case.
As controller, the customer is responsible for the privacy notice towards participants. The customer is obliged to inform participants under Article 13 GDPR before the survey starts, to choose a lawful legal basis, to enable optional third-party features such as video embeds only with suitable information and a legal basis, and to answer participants' requests. Choicery provides technical means for this, for example a link or a page for the privacy notice in the survey; the customer may also provide the information outside Choicery, for example in the invitation. Before a survey is published for the first time, the customer confirms that participants receive the required privacy information. Where technically provided for, this confirmation is recorded with the user, the time and the version of the confirmed text.
Survey participants find a description of what the platform processes technically in the Privacy Information for Survey Participants. Please direct requests about survey content and responses to the controller named in the creator's privacy notice; if they reach us, we forward them to that controller (section 9).
3. Overview of processing
The following table summarises the individual processing operations. Where we rely on legitimate interests (Article 6(1)(f) GDPR), the table names the interest concerned. Recipients are described in section 5 with their location and transfer basis, retention periods in section 7.
| Operation | Data | Purpose | Legal basis | Recipients | Duration |
|---|---|---|---|---|---|
| Website visits and server logs | IP address, time, requested address, browser identifier, response status, technical error details | Delivering the pages, security, error analysis, defence against attacks and abuse | Article 6(1)(f) GDPR; legitimate interest in secure and uninterrupted operation | Netcup (hosting), coolLabs (deployment control) | application logs no longer than 14 days (daily rotation); container logs rotated by size (no more than 30 MB per service) without a guaranteed age limit |
| Reach measurement on the website (Google Analytics 4), only after consent | only on the marketing pages of the website (choicery.ai), not in the application and not in surveys: pages visited without query parameters except campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), referring page (only the domain of the referring website), time and duration of visits, clicks on buttons (for example to register or sign in), clicks on pricing plans, opened FAQ questions (their position only), scroll events, clicks on links to other websites, start of the demo video (event demo_video_play), cookie identifier, device and browser details including device brand and model, browser identification, version details and screen resolution, approximate location down to the city (derived by Google from the IP address; the IP address is discarded before storage) |
Understanding where website visitors come from, which pages they read and where they leave | Article 6(1)(a) GDPR and Section 25(1) TDDDG (consent through the website's cookie banner); withdrawal at any time via "Cookie settings" in the website footer | Google Ireland Limited as processor; processing also by Google LLC, USA (section 5) | event and user data at Google 14 months without reset on new activity; aggregated reports beyond that; cookies 12 months (section 6) |
| Daily totals of the website and the registration | when a marketing page of the website (choicery.ai) is requested, our server reads from the request: page requested, address of the referring page, browser identifier, language setting, IP address. From these it increases separate daily totals: per page, per type of referring website from a fixed list, per country, per device type, per browser language. In addition, daily totals of clicks on register and sign-in per page of origin and of tutorials requested. During registration only daily totals per sign-up method: form opened, form sent, type of error, account created, email confirmed, sending failure. Not stored: IP address, browser identifier, full addresses, any visitor identifier. No cookie and no script is used for this; a visitor is not followed from page to page, and the totals are not linked to an account | Understanding how many page views the website receives, roughly where they come from and at which step registration fails | Article 6(1)(f) GDPR; legitimate interest in a usable reach figure and a working registration. Objection at any time: "Cookie settings" in the website footer, there "Exclude my visits", or by email to privacy@choicery.ai. If your browser sends Do Not Track or Global Privacy Control, we do not count these requests | no analytics services; only the hosting providers from section 5 (Netcup, Ubicloud, coolLabs). Our server determines the country from a local database (IP Geolocation by DB-IP), without a request to its provider | the details from the request only for its duration; separately the server logs (row "Website visit and server logs"); daily totals without personal reference without a fixed period |
| Answer at registration "How did you hear about us?" (voluntary) | chosen answer from a fixed list, stored with your account | Understanding which routes lead to accounts | Article 6(1)(f) GDPR; legitimate interest in directing our own marketing. The answer is voluntary and not needed for the contract. Objection at any time via the switch "Usage statistics for product improvement" in your profile or by email to privacy@choicery.ai; the answer is then deleted | Netcup, Ubicloud, coolLabs. Only platform administrators see combined figures | 90 days, then automatic deletion; the number per answer remains as a total without account reference |
| Registration and account | Email address, password (stored only as a hash), optional name, verification status, account status, sign-in times, session data, workspace membership and role; when upgrading to a paid plan, additionally whether you are purchasing privately or for an organisation and, where applicable, the name of the organisation | Providing the account, sign-in, email verification, password reset, account notices | Article 6(1)(b) GDPR (contract) | Netcup, Ubicloud (database), coolLabs, Greenmark IT/do.de (sending account emails) | until account deletion (section 7) |
| Evidence of contract acceptance | Accepted version of the Terms of Service, the Data Processing Agreement and the Privacy Policy, time, customer type, IP address, browser identifier, place of acceptance (registration, re-acceptance, connecting a sign-in provider) | Evidence of which contract version you accepted and when; legal defence | Article 6(1)(b) and (f) GDPR; legitimate interest in evidencing the conclusion of the contract | Netcup, Ubicloud, coolLabs | until 3 years after the end of the calendar year in which the contract ended; longer in the event of a dispute |
| Sign-in with Google or Microsoft | Transmitted by the sign-in provider: email address and its verification status, unique identifier of your provider account (for Microsoft additionally the identifier of the organisation), display name; stored by us: time of connection and of the last sign-in | Signing in with a Google or Microsoft account that you have connected in your profile; confirmation of the email address | Article 6(1)(b) GDPR (sign-in method chosen by you) | Google Ireland Limited or Microsoft Ireland Operations Limited as independent controllers for the sign-in transaction; Netcup, Ubicloud, coolLabs | until you disconnect the sign-in provider in your profile or the account is deleted |
| Google Sheets connection (voluntary, only in plans that include this function) | At Choicery: identifier and email address of the Google account you choose, granted permissions, refresh token from Google (encrypted), connection data per project (identifiers of the spreadsheet and its sheets, selected variant, status, times of the last update and of the last attempt, error codes without content), time and text version of your confirmation; to Google: the project's responses as in the response export (section "Google Sheets connection" below) | Providing the connection you set up: creating a spreadsheet in your Google Drive and updating it about every hour | for the account data of the connecting person Article 6(1)(b) GDPR (contract); for the responses the customer's instruction under Article 28(3)(a) GDPR, the customer determines the legal basis for the transfer | Google as a recipient chosen by the customer, under the customer's agreement with Google; Netcup, Ubicloud, coolLabs | consent until disconnection, until a security event or until account deletion; connection data until the connection is stopped, the project is deleted or the account is finally deleted; Choicery does not delete the spreadsheet (section 7) |
| Contact form and support email | Email address, optional name, selected topic, message; for emails additionally the details transmitted by your mail program | Answering requests, support, contract matters | Article 6(1)(b) GDPR (pre-contractual or contractual requests), (c) (legal obligations) or (f); legitimate interest in answering requests and in secure operation | Greenmark IT/do.de (mailbox and delivery). The form does not create a record in the application; it sends the details as an email to our mailbox. Reports sent through the "Report abuse" link in a survey are stored as legal requests instead (row "Legal requests") | until the request is settled, at the latest after 15 months; requests relating to a contract according to the periods for legal requests |
| Payment through Polar | At Choicery: identifier, plan and status of the subscription, end of the current billing period, customer email address; for each order the order and invoice number, reason (purchase, first payment of a subscription, renewal, plan change), status, whether it is paid, amounts with currency (subtotal, discount, net amount, tax, total, applied balance, amount due, refunded amount and refunded tax), time of the order and of the payment, and the related Polar identifiers of customer, subscription, checkout and product; results of the daily reconciliation with Polar (account, workspace and subscription identifiers, plan and status details, discrepancies found, no email addresses); at Polar: name, billing address, payment instrument details, tax details, invoices. Choicery does not receive payment instrument details such as card numbers | Ordering, billing, activation of the plan (also immediately after payment by querying Polar directly), invoicing by Polar, carrying out cancellations at Polar; daily reconciliation of subscriptions and orders with Polar for correct plan activation; our own overview of payments that does not depend on Polar | Article 6(1)(b) GDPR; Article 6(1)(c) GDPR for retention required by tax law; Article 6(1)(f) GDPR for the reconciliation with Polar and our own payment overview; legitimate interest in correct activation and in a complete record of payments that does not depend on Polar | Polar Software, Inc. (USA) as merchant of record: independent controller for the sale, invoicing, taxes and payment processing; for the account, checkout and subscription data that Polar processes for us, our processor under the Polar Data Processing Addendum; Polar processes the payment through a payment service provider | subscription data: until 3 years after the end of the calendar year in which the contract ended; order data: 3 years from the end of the calendar year of its last change, after an account deletion without email address, account and customer reference; reconciliation results 90 days; our own accounting records under Section 147 of the German Fiscal Code (section 7) |
| Project and survey operation | Project names, survey configuration, uploaded media, designs, analysis settings and results, exports, sharing within a workspace | Creating, publishing and analysing surveys, generating exports | Article 6(1)(b) GDPR | Netcup, Ubicloud, coolLabs | until deleted by you or until the end of the contract; generated download files 30 days |
| Extent of use per account | Number and duration of analysis runs, number of projects and respondents, storage space used; no content and no responses | Stable operation for all customers; recognising use that deviates significantly from normal use, in order to suggest a suitable plan to you, for example through a notice in the application (Terms of Service Section 2(2)) | Article 6(1)(f) GDPR; legitimate interest in stable operation and in plans that match actual use | Netcup, Ubicloud, coolLabs | no separate storage; the figures are derived from the project and analysis data for as long as that data is stored |
| Usage statistics of the application | Account identifier, time, source of the event (page view or action), name of the function or page (including plan and billing pages), type of the question created (such as MaxDiff or Likert), family of the analysis started (such as HB or Latent Class), task type, export format or selected tab, plan chosen when starting a checkout, technical name of the endpoint, response time. Not included: content, responses, project identifier, IP address, browser identifier, device details | Understanding which functions are used in order to improve the application and to plan capacity | Article 6(1)(f) GDPR; legitimate interest in understanding which functions are used in order to improve the application and to plan capacity. Objection at any time via the switch "Usage statistics for product improvement" in your profile; the raw data of your account is then deleted immediately | no analytics services; only the hosting providers from section 5 (Ubicloud as database, Netcup, coolLabs). Only platform administrators see aggregated figures, cells with fewer than 3 users are suppressed; workspace administrators receive no evaluation per person | raw data with account reference 90 days, then automatic deletion |
| Participant data (processing on behalf of the customer) | Responses, completion status, timestamps, page times, assigned design version, experimental condition, optionally a panel code supplied by the customer. Response records contain no IP address, no full browser identifier and no device fingerprint | Running the survey on behalf of the customer | The customer determines the legal basis; Choicery processes on instructions under Article 28 GDPR | Netcup, Ubicloud, coolLabs | as instructed by the customer; no automatic deletion by Choicery during the contract |
| Embedded videos (only after a click) | From the click on play: IP address, browser data, cookies and storage of the video provider, playback data | Playing a video embedded by the customer | Before the click, the video provider does not process anything. The customer is responsible for the legal basis for the transfer from the click onwards and for informing participants (normally consent, Article 6(1)(a) GDPR, Section 25(1) TDDDG) | YouTube (Google Ireland Limited), Vimeo.com, Inc. (USA) | according to the video provider's policies |
| Audit and security events | Timestamp, action, outcome, user or project reference, requested address, browser identifier, IP address, session hash, technical details | Security, integrity, traceability of changes, defence against and investigation of abuse (such as an account shared by several persons), evidence, legal defence | Article 6(1)(f) GDPR in conjunction with Article 32 GDPR; legitimate interest in security and accountability | Netcup, Ubicloud, coolLabs | 3 years from the end of the calendar year of the event; IP addresses are truncated after 90 days |
| Error reports | Error message and technical location of the error, affected page without query parameters, interface elements last used without input values, account identifier, where applicable project or operation identifier, time, version of the application. If an error occurs in the application, your browser sends such a report automatically; further reports are created on the server, for example when an analysis fails | Detecting and fixing errors | Article 6(1)(f) GDPR; legitimate interest in a working application with as few errors as possible | Netcup, Ubicloud, coolLabs; Greenmark IT/do.de for error summaries sent to us by email | no longer than 90 days |
| Legal requests (reports about surveys and notices of illegal content, termination, withdrawal) | Name, email address, contract or order reference, reported survey or address, reason category and explanation, requested end date, voluntary reason for cancellation or withdrawal, time of receipt, follow-up correspondence; for a termination by Choicery also the dates communicated and an internal note | Handling reports about surveys (including through the "Report abuse" link) under the Digital Services Act and under US copyright law, including notice of the decision, terminations and withdrawals; terminations by Choicery; evidence of handling | Article 6(1)(c) GDPR (Article 16 DSA, Section 312k BGB, Sections 355 et seq. BGB), (b) and (f); legitimate interest in evidence and legal defence | Netcup, Ubicloud, coolLabs, Greenmark IT/do.de. We forward terminations and withdrawals concerning a subscription purchased through Polar to Polar or carry them out there. If we block a survey because of a report, its creator receives a statement of reasons with the content concerned, but neither the name nor the email address of the reporter; only copyright notices under 17 U.S.C. § 512 are forwarded as the law provides; beyond that, your data is disclosed only where the law requires it | 3 years from the end of the calendar year of receipt |
Additional notes on the table:
- You create an account with an email address and a password. Signing in with Google or Microsoft requires an existing Choicery account with the same email address; no account is created through it. When you sign in, Choicery does not transmit project or survey data to Google or Microsoft. The voluntary Google Sheets connection is separate: there Choicery transfers responses to Google on the customer's instruction (section "Google Sheets connection" below).
- We send emails that are necessary for the account and the contract (verification, password reset, account notices, contract confirmations, announcements of changes). We show notices about a suitable plan in the application.
- If you are our customer, we may send information about our own similar services to the email address you gave us in connection with the contract (Section 7(3) of the German Act against Unfair Competition, UWG; Article 6(1)(f) GDPR, legitimate interest in informing existing customers). You can object to this at any time, for example to privacy@choicery.ai, without incurring any costs other than the transmission costs at the basic rates.
- The AI-driven estimation methods in Choicery run on our servers; no data is transmitted to providers of language models or other AI services for this purpose.
- We accept notices of illegal content through the notice form, the "Report abuse" link in every survey and abuse@choicery.ai, terminations through the termination button and withdrawals through the withdrawal button. When signed in, you can also cancel your subscription on the "Plan & Billing" page. We store termination and withdrawal declarations received and their confirmations as evidence (row "Legal requests").
- If you request the deletion of your account while a subscription is running, Choicery cancels the subscription at Polar with effect from the end of the current billing period before the deletion. On the final deletion, Choicery asks Polar to delete you as a customer and to pseudonymise your customer data as far as Polar technically provides for this (notification of recipients under Article 19 GDPR). Where Polar retains your data as merchant of record for its own legal obligations, this is governed by the Polar Privacy Policy.
- Google Analytics runs only on the marketing pages of the website, including the guides under /guides/, and only if you chose "Accept" in the cookie banner. Google Analytics is not loaded in the application or in surveys. Google Signals, ad personalisation and the data sharing with Google products and services are switched off; page addresses are transmitted without query parameters except campaign parameters. The property is linked to Google Search Console to show search performance; this sends no visitor data of this website to Google. If your browser sends a Do Not Track or Global Privacy Control signal, we treat this on the website as a decline, even if you had accepted earlier.
- The usage statistics of the application count only page views and actions of signed-in users inside the application; survey pages are not counted. They work without cookies and without an analytics service provider. If your browser sends a Do Not Track or Global Privacy Control signal, the requests concerned are not counted; the signal does not delete data already stored, which is what the switch in your profile is for. Only accounts that have accepted the current version of the Terms of Service are recorded. Your own raw data is included in the account export as the file
usage_events.csv.
Google Sheets connection
In the plans that include this function, a user with export rights for a project can connect the project to Google Sheets under Data > Export. The connection is voluntary. The other exports and the export interface remain available in all plans regardless.
- Setup. You sign in to Google with a Google account of your choice (a private Google account or Google Workspace) and grant Choicery the permissions
openid,emailandhttps://www.googleapis.com/auth/drive.file. Thedrive.filepermission covers files created by an app or explicitly selected for it. This connection creates a new spreadsheet and updates only that spreadsheet; it does not offer access to your other Drive files. Before the first transfer, Choicery shows the selected Google account and you confirm: "I am authorized to transfer this project's responses to the selected Google account." Choicery stores the time and the text version of this confirmation. - Data transferred. Choicery creates a new spreadsheet in your Google Drive and writes the project's responses into it about every hour. The content is the same as the wide response export: all responses including incomplete ones, participant identifiers, panel IDs where collected, free-text answers, timestamps and system details, at your choice with answer texts or with codes and the codebook. On each update, Choicery replaces the sheets "Answers" and "Codebook"; other sheets of the spreadsheet remain unchanged. From Google, Choicery receives the identifier and email address of the Google account, the granted permissions and details of the spreadsheet created, such as its sheets and whether it is in the trash.
- Roles. For the participants' responses, the customer is the controller and Choicery the processor. Each connection is a documented instruction of the customer (Article 28(3)(a) GDPR), given and confirmed by a user of the customer. Google is a recipient chosen by the customer and acts under the customer's own agreement with Google; for this function, Google is not a sub-processor engaged by Choicery. Whether the transfer to Google is lawful, including any transfer to third countries under Google's terms, is the customer's responsibility as controller. For the account data of the connecting person (Google identifier, email address, token), Choicery is the controller; the purpose is providing the requested connection, the legal basis is Article 6(1)(b) GDPR.
- Storage at Choicery. Choicery stores the refresh token from Google in encrypted form (section 8). Choicery does not store access tokens; an access token exists only briefly in memory during an update. For each connection, Choicery stores the identifiers of the spreadsheet and its sheets, the selected variant, the status, the times of the last update and of the last attempt, and error codes without content.
- Pausing and ending. Updates pause automatically when the plan no longer includes the function, when you lose export rights for the project, while the project is in the trash and when the project moves to another workspace. "Stop updating" ends the connection of one project; "Disconnect" in your profile disconnects Google Sheets entirely. A password change, a password reset, "Sign out everywhere" and account deletion also end the consent. Choicery then asks Google to revoke the refresh token. The encrypted token stays in a revocation queue only until Google confirms the revocation or a new consent for the same Google account replaces the old consent, and is then deleted. You can also remove Choicery's access in your Google account at any time.
- Spreadsheet in your Google Drive. Choicery does not delete the spreadsheet, not even when the connection ends or the account is deleted. It stays in your Google Drive under your control; you decide at Google who can see it and how long it is kept. Processing at Google is governed by the terms of your Google account and the Google Privacy Policy.
- Google API Services User Data Policy. Choicery's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Choicery uses its access to Google only to create and update the spreadsheets you connected. Choicery does not use the data received from Google for advertising, does not sell it and does not use it to train AI models. People at Choicery do not read this data unless this is necessary for security or to comply with legal obligations, or you have agreed.
4. Obligation to provide data and automated decisions
An email address is required for an account; without it, no contract can be concluded and the account cannot be verified. All other details (name, name of the organisation, connected sign-in providers, the Google Sheets connection, details in the contact form) are voluntary; without them, we may be unable to attribute or answer a request. For a paid plan, Polar requires the details needed for invoicing and payment.
Choicery does not make automated individual decisions, including profiling, within the meaning of Article 22 GDPR. The statistical estimation methods in Choicery (such as hierarchical Bayes estimation, latent class analysis or TasteNet) calculate preference values from the responses to a survey on behalf of the customer. They do not make decisions about individual persons; whether and how the customer uses the results is the customer's responsibility.
5. Recipients and transfers to third countries
We disclose personal data to the following recipients. Processors are contractually bound under Article 28 GDPR; the list of sub-processors and recipients also contains the change history. How we inform customers of changes of processors and how they can object is governed by the Data Processing Agreement.
| Recipient | Role | Service and data | Location and place of processing | Basis for a third-country transfer |
|---|---|---|---|---|
| netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany | processor | Hosting of the application and file storage including backups (project data, responses, exports, application logs, and database backups with account, audit, contract and billing data) | Data centre in Nuremberg, Germany | no third-country transfer |
| Ubicloud B.V., Turfschip 267, 1186 XK Amstelveen, Netherlands | processor | Managed PostgreSQL database (accounts, projects, responses, audit events) including point-in-time recovery | Data centre in Frankfurt am Main, Germany; contracting party in the Netherlands. Remote access by the database provider's support from the USA (affiliated company Ubicloud Inc.) is possible | EU contracting party; for access from the USA, the database provider's intra-group Standard Contractual Clauses (Section 6.1 of its data processing agreement) |
| coolLabs Solutions Kft., Hungary (operator of Coolify Cloud) | processor | Deployment control with administrative access to the application server at Netcup | Hungary (EU) | no third-country transfer |
| Greenmark IT GmbH (do.de), Leinstraße 3, 31061 Alfeld (Leine), Germany | processor | Transactional emails (verification, password reset, account notices, contract confirmations), delivery of the contact form, email mailboxes | Germany | no third-country transfer |
| Polar Software, Inc., 548 Market Street PMB 61301, San Francisco, CA 94104-5401, USA (registered address 3500 South DuPont Highway, Dover, DE 19901) | merchant of record; independent controller for the sale, invoicing, taxes and payment processing; processor for the account, checkout and subscription data that Polar processes for us | Sale of the plans in its own name, payment processing, invoicing with tax statement, refunds; linking of account and subscription; carrying out cancellations and deleting the customer on Choicery's instruction; Choicery receives the subscription identifier, plan, status and end of the billing period, email address, customer identifier and the order data from section 3 (order and invoice number, reason, status, amounts with currency, times, identifiers of checkout and product). Choicery does not receive payment instrument details such as card numbers | USA; Polar's sub-processors are published at https://polar.sh/legal/sub-processors | EU Standard Contractual Clauses in accordance with the Polar Data Processing Addendum (part of the Polar Master Services Terms). The Polar Buyer Terms and the Polar Privacy Policy apply to the sale |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | processor (Google Ads Data Processing Terms) | Google Analytics 4 on the marketing pages of the website, only after consent: pages visited without query parameters except campaign parameters, referring page (domain only), time and duration of visits, clicks on buttons and pricing plans, opened FAQ questions, scroll events, clicks on links to other websites, start of the demo video, cookie identifier, device and browser details including device model, browser identification and screen resolution; the IP address is used to derive approximate location down to the city and discarded before storage. No account, project or response data | Ireland; processing also by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA | EU-US Data Privacy Framework (Google LLC is certified); as a fallback EU Standard Contractual Clauses under the Google Ads Data Processing Terms |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | independent controller | Sign-in with Google (email address, account identifier, display name) | Ireland; the sign-in provider may handle the sign-in transaction through infrastructure outside the EEA | in accordance with the safeguards published by the sign-in provider (adequacy decision or standard contractual clauses), see its privacy policy |
| Google as the provider of the Google account that the user chooses for the Google Sheets connection (a private Google account or Google Workspace) | recipient chosen by the customer; not a processor of Choicery; Google acts under the customer's agreement with Google | Google Sheets connection, only on the customer's instruction: the project's responses as in the response export, in a spreadsheet in the customer's Google Drive; Choicery receives from Google the identifier and email address of the Google account, the granted permissions and details of the spreadsheet created (section 3) | according to Google's terms for the chosen Google account | For the responses, the customer is responsible for the lawfulness of the transfer, including any transfer to third countries under Google's terms; for the account data of the connecting person, in accordance with the safeguards published by Google, see the Google Privacy Policy |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | independent controller | Sign-in with Microsoft (email address, account identifier, display name) | Ireland; the sign-in provider may handle the sign-in transaction through infrastructure outside the EEA | in accordance with the safeguards published by the sign-in provider (adequacy decision or standard contractual clauses), see its privacy statement |
| YouTube (Google Ireland Limited) | participant-facing third party, only after a click | Video playback via youtube-nocookie.com | Ireland; processing possible worldwide | in accordance with the safeguards published by the video provider (adequacy decision or standard contractual clauses), see the Google Privacy Policy; processing only after the participant clicks |
| Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA | participant-facing third party, only after a click | Video playback with the player's Do Not Track setting enabled | USA | EU-US Data Privacy Framework (Vimeo is certified) and EU Standard Contractual Clauses; processing only after the participant clicks |
An analytics service is used only on the marketing pages of the website, and only after your consent (Google Analytics 4, section 6). Inside the application, Choicery evaluates usage itself, without third parties and without scripts from third-party servers (section 3, row "Usage statistics of the application"). In the application and in surveys we use no advertising services, no fonts or scripts from third-party servers and no providers of AI services; the exception is embedded videos, whose content and scripts are loaded from the video provider only after the participant clicks.
Authorities and courts receive data where we are legally obliged to disclose it (Article 6(1)(c) GDPR) or where this is necessary for the establishment, exercise or defence of legal claims (Article 6(1)(f) GDPR). Advisers bound by professional secrecy (for example tax or legal advisers) receive data where this is necessary for their engagement (Article 6(1)(c) or (f) GDPR). We examine requests from authorities in third countries under Article 48 GDPR and Article 32 of the Data Act and disclose data only where a legal basis recognised there exists; we inform the affected customer where this is permitted.
A copy of the Standard Contractual Clauses and of the other safeguards is available on request from privacy@choicery.ai where it is not publicly accessible.
6. Cookies and browser storage
In the application and in surveys, Choicery sets only technically necessary cookies and uses your browser's storage only where this is necessary for the function you have expressly requested (Section 25(2) no. 2 TDDDG). There is therefore no cookie banner and no consent prompt there. Only the marketing pages of the website (choicery.ai) show a cookie banner: Google Analytics is loaded only once you choose "Accept" there. You can change your choice at any time via "Cookie settings" in the website footer; after a withdrawal the analytics cookies are deleted and nothing is loaded any more. We respond to Do Not Track and Global Privacy Control signals from your browser as follows: on the website we treat them as declining Google Analytics and do not count the requests in the daily totals, likewise during registration; in the application the requests concerned are not counted in the usage statistics; beyond that, they do not change the processing.
| Cookie or storage | Purpose | Lifetime |
|---|---|---|
| Application session cookie | sign-in, session protection | session; limited server-side to one hour |
| "Remember me" cookie | persistent sign-in, only if you select the option when signing in | 14 days |
| CSRF token | protection against forged requests | session |
| Session cookie on survey pages | progress and resumption of the survey, protection against manipulation | 24 hours |
Cookie choicery_asset_release_<ID> (for participants, only for addresses under /images/) |
loads images and media from the version of the survey you started on; technically necessary | 24 hours |
Cookie choicery_survey_preview (only for signed-in users in the preview of a survey) |
links the preview to your sign-in; technically necessary | 24 hours |
| Local browser storage (only for signed-in users in the editor and in analysis views) | short-lived interface state, such as the last selected view; contains no survey responses and stays in the browser | until you clear your browser storage |
Cookie choicery_consent (only on the website choicery.ai) |
stores your choice in the website's cookie banner (accept or decline); technically necessary so that the banner does not reappear on every visit | 12 months |
Cookies _ga and _ga_<ID> (Google Analytics, only on the website choicery.ai, only after consent) |
recognising your browser for reach measurement; set only on the website host, not for the application and not for surveys | _ga: 12 months from the first visit, not extended; _ga_<ID>: 12 months from the last visit, each visit renews it |
Cookie choicery_no_count (only on the website choicery.ai, only if you choose "Exclude my visits" in "Cookie settings") |
remembers your wish that your requests are not counted in the daily totals; contains no identifier; expressly requested by you | 12 months, or until you choose "Include my visits" |
In the application and in surveys there are no analytics, statistics or advertising cookies, no tracking across other websites and no fonts or scripts from third-party servers; the exception is embedded videos, whose content and scripts are loaded from the video provider only after the participant clicks. The usage statistics of the application (section 3) work without cookies; they count on the server which functions your signed-in account calls. Third-party cookies arise on the website after your consent (Google Analytics) and when a participant clicks on an embedded video (section 3, row "Embedded videos").
7. Retention
We store personal data only for as long as is necessary for the respective purpose or required by a legal obligation. The main periods:
| Data | Duration |
|---|---|
| Application logs | no longer than 14 days (daily rotation) |
| Container logs | rotated by size, no more than 30 MB per service, without a guaranteed age limit |
| Account after a deletion request | 30-day grace period during which you can cancel the deletion; then permanent deletion without undue delay, at the latest within 30 days. On request, deletion without a grace period, at the latest 30 days after the request. A running subscription is cancelled at Polar with effect from the end of the billing period before the deletion; on the final deletion, Choicery asks Polar to delete the customer and to pseudonymise the customer data as far as Polar technically provides for this |
| Inactive free accounts | We may terminate free accounts that have not been used for at least 6 months by email with 30 days' notice; if you sign in within the notice period, the termination lapses. You can export your data until the notice period ends; the account is then deleted |
| Project data and analysis results | until deleted by you or until the end of the contract; projects you delete remain recoverable for at least 30 days and are then permanently deleted, at the latest after 60 days; after the end of the contract 30 days for retrieval, then deletion at the latest within 30 days |
| Survey responses | no automatic deletion during the contract. Responses you delete remain recoverable in the project's bin until you delete them there or empty the bin; imported responses are permanently deleted immediately |
| Generated download files | 30 days |
| Evidence of contract acceptance | until 3 years after the end of the calendar year in which the contract ended; longer in the event of a dispute |
| Audit and security events | 3 years from the end of the calendar year of the event (Sections 195 and 199 BGB); IP addresses are truncated after 90 days |
| Usage statistics of the application (raw data with account reference) | 90 days, then automatic deletion by a nightly job; immediate deletion on objection in the profile |
| Daily totals of the website and the registration | totals without personal reference, no fixed period; the details from the individual request are not stored |
| Answer "How did you hear about us?" on the account | 90 days, then automatic deletion by a nightly job; immediate deletion on objection |
| Error reports | no longer than 90 days |
| Contact requests | until settled, at the latest after 15 months; requests relating to a contract according to the periods for legal requests |
| Legal requests (terminations, withdrawals, notices under the Digital Services Act, data protection requests) | 3 years from the end of the calendar year of receipt |
| Accounting records | under Section 147 of the German Fiscal Code, in particular accounting vouchers and invoices 8 years, books and records 10 years, in each case from the end of the calendar year |
| Order data from Polar | 3 years from the end of the calendar year of its last change (limitation period, Sections 195 and 199 BGB), then automatic deletion by a daily job. After an account deletion, it is kept until then without email address, account and customer reference; order and invoice number remain traceable through Polar, so the data is pseudonymised, not anonymised |
| Results of the reconciliation with Polar | 90 days, then automatic deletion |
| Google Sheets consent (Google identifier, email address, permissions, encrypted refresh token) | until you disconnect Google Sheets in your profile, until a security event (password change, password reset, "Sign out everywhere") or until account deletion |
| Connection data per project (Google Sheets) | until you end the connection with "Stop updating", the project is deleted or the account is finally deleted |
| Revocation request to Google (encrypted refresh token) | until Google confirms the revocation or a new consent for the same Google account replaces the old consent |
| Spreadsheet in the customer's Google Drive | not deleted by Choicery; it stays at Google under the customer's control |
Deleted data may remain in backups until the backup cycles expire; we keep our own backups on the server for no longer than 30 days and encrypted external copies for no longer than 45 days; backups of the hosting providers follow their periods. After a restore, documented deletions are carried out again. Statutory retention duties, ongoing disputes or a documented legal hold may justify longer retention limited to what is necessary. The complete overview with start dates, grace periods and exceptions is set out in the Retention and Deletion Policy.
8. Security
We protect your data with technical and organisational measures under Article 32 GDPR, for example encrypted transmission, access controls and backups. Details are described in the Technical and Organisational Measures.
We notify security incidents to supervisory authorities and data subjects in accordance with Articles 33 and 34 GDPR and to customers under the Data Processing Agreement. Please report security vulnerabilities to security@choicery.ai.
9. Your rights
Towards Choicery as controller, you have the following rights:
- Access (Article 15 GDPR) to the data stored about you and a copy of that data,
- Rectification (Article 16 GDPR) of inaccurate or incomplete data,
- Erasure (Article 17 GDPR), unless a retention duty or another exception applies,
- Restriction of processing (Article 18 GDPR),
- Data portability (Article 20 GDPR) of the data you have provided to us, in a structured, commonly used and machine-readable format,
- Withdrawal of consent (Article 7(3) GDPR) at any time with effect for the future; the lawfulness of processing carried out before the withdrawal is not affected.
Account holders can export their account data, change their details, disconnect sign-in providers and delete their account themselves in their profile. For all other requests, write to privacy@choicery.ai or use the contact form. We normally verify your identity by means of the email address on file for the account and ask for further details in case of doubt. We respond without undue delay and at the latest within one month; for complex or numerous requests this period may be extended by up to two months, of which we will inform you. Exercising your rights is generally free of charge (Article 12(5) GDPR).
Please direct requests about survey responses to the controller named in the privacy notice of the survey's creator. If such a request reaches us, we forward it to the customer and inform you of this. We do not handle it ourselves, because we can normally not attribute responses to a person and the customer decides about them.
Right to object (Article 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that we base on Article 6(1)(f) GDPR (legitimate interests). This concerns in particular server logs, audit and security events, error reports, the evidence of contract acceptance, the handling of contact requests, the reconciliation with Polar and our own payment overview, the extent of use per account, and the usage statistics of the application. The easiest way to object to the usage statistics is the switch "Usage statistics for product improvement" in your profile; the objection takes effect immediately, without you having to give reasons, and deletes the raw data stored for your account. If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where we process your data for direct marketing (for example information about our own similar services by email, section 3), you can object to this at any time without giving reasons; we will then no longer process it for this purpose (Article 21(2) and (3) GDPR). Please send your objection to privacy@choicery.ai.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR). The authority competent for Choicery is:
Landesbeauftragte für den Datenschutz Sachsen-Anhalt (State Commissioner for Data Protection of Saxony-Anhalt) Otto-von-Guericke-Straße 34a 39104 Magdeburg Germany PO Box 1947, 39009 Magdeburg Telephone: +49 391 81803-0 https://datenschutz.sachsen-anhalt.de
Other administrative or judicial remedies remain unaffected.
10. Changes to this privacy policy
We amend this policy when the processing, the providers used or the legal situation change. The current version is published with its effective date on this page. In the event of material changes, we inform registered users in a suitable manner, for example by email or in the application.