Privacy notice
This notice explains what Heardback (company in formation) ("Heardback", "we") collects when you use heardback.co, a survey you reach through a Heardback link, or the asker app; why we collect it; how long we keep it; and the rights you have wherever you live. It is written to meet the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA, and India's Digital Personal Data Protection Act 2023 (DPDP). Where those laws differ, you get the stronger protection.
Who is responsible
Controller for the website, the waitlist and the asker app: Heardback (company in formation), [registered address to be added], India. Contact: privacy@heardback.co.
Surveys are a shared arrangement. The organisation that asks the questions (the "asker") decides what to ask and why, and is the controller of the answers. Heardback processes those answers on the asker's behalf under our data processing addendum, and is the controller for the parts we run for ourselves: the consent record, the reveal cards, the referral link, and the aggregate statistics that make the product work.
India DPDP grievance officer: [grievance officer to be appointed], reachable at privacy@heardback.co.
EU and UK representative (GDPR Article 27): [EU/UK representative to be appointed before serving EU or UK users at scale].
What we collect, and why
| Who you are | What we collect | Why | Legal basis |
|---|---|---|---|
| Respondent | Your answers (choices, amounts, free text) | To run the survey, show you where you stand, and give the asker the results | Your consent (GDPR Art. 6(1)(a); DPDP s.6) |
| Respondent | A random session identifier in a cookie | To let you resume, and to stop one person answering twice | Strictly necessary for the service you asked for |
| Respondent | Phone number or email, only if you type one | To send your receipt and, if it unlocked later, your card | Your consent; you can withdraw by deleting your data |
| Respondent | Which referral link brought you, and any campaign tags (utm) on the link | To measure whether cards get shared and what an ad costs per completed survey | Legitimate interest in measuring the product; no profiling |
| Respondent | Language you chose, consent version and time | To prove consent was given and to show the interface in your language | Legal obligation to evidence consent |
| Asker (waitlist or account) | Email, optional name and company | To contact you about the asker app and, later, to run your account | Consent for the waitlist; contract for an account |
| Everyone | Server logs with truncated IP addresses and error traces | Security and debugging | Legitimate interest in keeping the service secure |
We do not collect precise location, device fingerprints, advertising identifiers, or anything from third-party trackers. There are none on the site.
How answers are shown to others
After you answer, you may see a reveal card: a statement such as "you answered higher than 71% of respondents". It is computed from all answers to that question in that survey, and is only shown once at least twelve people have answered, so no individual answer can be inferred. Other respondents never see your answer on its own.
Cards are images you may choose to share. A shared card carries a referral link with a random code. We count how many people the link brings in; we learn nothing about them from the link.
AI processing
Heardback uses a large language model (provided by Anthropic) for two narrow tasks: interpreting a free-text amount or reply when our rules cannot, and, for askers, drafting questions from a written goal. Replies are stripped of phone numbers and email addresses before they are sent. The model does not train on your data. No decision with legal or similarly significant effect on you is made automatically.
How long we keep data
| Data | Kept for |
|---|---|
| Answers and reveal cards | Until the survey's asker deletes the survey, or you delete your data, whichever is sooner |
| Free-text answers in their original wording | 365 days, after which the original text is removed and only the interpreted value remains |
| Unfinished sessions | Marked abandoned after 30 days of inactivity |
| Phone number or email you left | Until the receipt is sent and the survey closes, or until you delete your data |
| Consent record and the anonymised event log | Kept as evidence of consent and for product statistics; contains no contact details |
| Waitlist entries | 24 months from sign-up if we have not contacted you |
| Server logs | 30 days |
Where data is stored
Our database and card storage are in the ap-south-1 (Mumbai) region. The web front end is served from a global content delivery network; it holds no personal data at rest. Some providers listed under sub-processors operate from the United States or the European Union. Transfers out of the EU, UK or India rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and the transfer conditions of the DPDP Act, as applicable.
Your rights
Wherever you live, you can:
- Download everything we hold about you, in JSON, from the survey's final screen or the delete page. No account is needed; the request is tied to the session cookie in your browser.
- Delete everything from the same page. Answers, cards and any contact details are removed immediately; an anonymised record that a deletion happened remains.
- Withdraw consent at any time by deleting your data. Withdrawal does not affect processing that already happened.
- Correct an answer by contacting us; we will pass the correction to the asker.
- Object to processing based on legitimate interest, and ask us to restrict processing while we check.
- Complain to a supervisory authority: in the EU, your national data protection authority; in the UK, the Information Commissioner's Office; in India, the Data Protection Board of India after first raising it with our grievance officer.
California residents: we do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of. You have the rights to know, delete, correct, and to limit use of sensitive personal information (we do not use any), and we will not discriminate against you for exercising them. Our notice at collection is the consent screen shown before the first question. Requests: privacy@heardback.co. Authorised agents may act for you with written permission.
India residents: you may nominate another person to exercise your rights if you are unable to; write to the grievance officer named above. We respond within the time the DPDP Rules prescribe.
We answer every request within 30 days, or one month under GDPR, and tell you if we need longer.
Children
Heardback is for people aged 18 and over. The consent screen asks you to confirm this. If we learn that a respondent is under 18 we delete their data.
Security
Contact details are hashed for lookup and encrypted at rest with a key held outside the database. Traffic is encrypted in transit. Access to production is limited to named operators and logged. More in the security overview. If a breach is likely to put you at risk we will tell you and the relevant authority without undue delay, and within 72 hours where the law requires.
Cookies
We set only strictly necessary cookies. Details in the cookie notice.
Changes
We will post changes here with a new version and effective date. Where a change affects the consent you gave as a respondent, the consent version shown at the start of a survey changes too, and we will ask again where the law requires.
Change log
- 2026-09-08: first public draft, written for a global audience with India-first pilots.