Who we are
Samplesay is a service operated by AISIGHT DEVELOPMENT S.R.L., a company registered in Bucharest, Romania (sole registration code 47282323, trade register number J40/24050/2022). For any privacy question or to exercise your rights, contact us at office@samplesay.com.
Samplesay (“Samplesay”, “we”, “us”) provides a survey platform that lets you build surveys, collect responses as live data — online or offline through the Samplesay Field mobile app — and analyse the results. For data you collect through your own surveys, you are the data controller and Samplesay acts as your processor. For your account and billing data, Samplesay is the controller.
Data we process
Account data
When you register, we process your name, email address, and authentication credentials. Sign-in and account storage are handled by Supabase, our authentication and database provider.
Survey content
The surveys, questions, logic, branding, and distribution links you create are stored so we can run the service.
AI assistant
When you use the AI builder, the text of your request and a summary of the survey you are editing are sent to Google Gemini to generate or refine questions. If you attach a document (such as a Word, text, or Markdown file), its extracted text is sent to Google Gemini for the same purpose and is not stored — it is processed in the request and then discarded. Generated changes are only applied to your survey after you review and approve them.
Respondent data
When someone answers one of your surveys, we process their responses on your behalf. Depending on how you configure a survey, this may also include:
- a respondent email address, where your survey collects one and is not anonymous;
- the respondent’s IP address, used for security and to derive an approximate location;
- an approximate location (country and city) derived from the IP address using the offline MaxMind GeoLite2 database — never a precise location;
- a per-device marker stored in the respondent’s browser (
localStorage) when you enable “one response per device”, so the same browser is not counted twice.
If you run a survey as anonymous, we do not attach respondent email or identity to the responses.
Samplesay Field (mobile app)
Samplesay Field is the Android and iOS app your field team uses to run interviews, including with no internet connection. Field accounts are created by a workspace administrator — there is no public sign-up — and we process the operator’s username and display name to authenticate them. In the app we process:
- Location — if the operator grants the permission, the app takes a single GPS reading at the moment an interview is finished and stores it (coordinates, accuracy, timestamp) with that response, so answers can be mapped and audited. Location is never tracked in the background and never collected while the app is closed. The app works fully without this permission — responses are simply saved without a GPS point.
- Photos and files — when a survey asks for a photo or file, the captured image or document is attached to that response. It is held on the device until the response is uploaded, then stored with the response.
- Camera — used only to take those photos and to scan a workspace provisioning QR code. We do not access your photo library beyond the file you pick.
- Push notifications — if the operator allows them, the device registers a notification token with Google Firebase Cloud Messaging so their team can send alerts about new surveys and ask devices to sync. The token is deleted when the operator logs out.
- On-device storage — because the app is offline-first, draft and completed responses are stored on the device until they upload. Logging out erases the local data from the device.
Responses collected in the field belong to the workspace that assigned the survey; that workspace is the controller for them, exactly as for responses collected on the web.
Technical data
We use strictly necessary authentication cookies and browser localStorage to keep you signed in and to remember interface preferences. See our Cookie Policy for details.
How we use data
- to provide, secure, and operate the platform;
- to run the surveys you build and present the analysis of their responses;
- to manage your account, support requests, and (if applicable) billing;
- to detect, prevent, and investigate abuse or fraud.
Legal bases (GDPR)
Where the GDPR applies, we rely on: performance of a contract (operating your account and the service), our legitimate interests (securing the platform and preventing abuse), consent where you give it, and legal obligation where the law requires it. As a respondent, the legal basis for processing your answers is determined by the survey owner (the controller).
Service providers (sub-processors)
- Supabase — authentication, database, and file storage.
- Stripe — payment processing. Billing is currently inactive; when enabled, card data is handled by Stripe and never stored on our servers.
- MaxMind GeoLite2 — an offline database used to derive an approximate country/city from an IP address. No respondent data is sent to MaxMind.
- Google Gemini — the AI model behind the survey builder assistant. It receives your AI requests and any document text you upload to generate questions; uploaded documents are not retained.
- Cloudflare Turnstile— used only when a survey includes a human verification step. To confirm a respondent is not a bot, Turnstile receives challenge interaction data and the respondent’s IP address; we receive only a pass or fail result.
- Google Firebase Cloud Messaging — delivers push notifications to the Samplesay Field app. It processes the device notification token and the message we send; it is not used for analytics or advertising.
- Vercel — hosting and delivery of the Samplesay web application.
Data retention
We keep account and survey data for as long as your account is active. Survey responses are retained until you delete them or close your account. When you delete data or close your account, we remove it from active systems within a reasonable period, subject to backups and any legal retention requirements.
International transfers
Our providers may process data outside your country. Where data leaves the European Economic Area, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
Your rights
Subject to applicable law, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing. You can also lodge a complaint with your local data protection authority. If you are a survey respondent, contact the survey owner first; if you cannot reach them, contact us and we will help route your request.
To exercise a right, email office@samplesay.com. Field operators can ask their workspace administrator, who can delete their account and the responses they collected.
Because we are established in Romania, our lead supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP), Bucharest, Romania — dataprotection.ro. You may also complain to the authority where you live or work.
Security
We use encryption in transit, scoped access controls, and reputable infrastructure providers. No system is perfectly secure, but we work to protect data against unauthorised access, loss, and misuse.
Children
The platform is not directed at children, and you should not collect data from children through it without a valid legal basis and any required parental consent.
Changes
We may update this policy. Material changes will be reflected by the “last updated” date above, and where appropriate we will notify you.
Contact
Questions about privacy? Email office@samplesay.com.