This policy explains what information Hearsay collects, why, who we share it with, and the choices you have. It covers people who use our app ("customers") and people who answer surveys built with it ("respondents"). Hearsay is provided by Brinus Tech Ltd, a company registered in the United Kingdom (registered office 46 Elliotts Way, Caversham, Reading RG4 8BF, England) ("we", "us"). We are the controller of customer account data.
1.Information we collect
- Account information
- When you sign in with Google we receive your name, email address, profile photo, and Google account ID. When you sign up with an email address, we receive your name and email address, and Firebase Authentication keeps a hash of your password (never the password itself).
- Content you create
- Surveys, questions, branching rules, branding palettes, coupon codes you upload, business context you give the AI builder, and files you upload.
- Survey responses
- Answers respondents submit, plus details captured at submission: the device type (from the browser user agent), language, time zone, the sharing channel the link came from, any values the survey owner chose to pass in the survey link (such as an order number or email address), and how long the survey took. The IP address is used briefly in memory to limit abusive submissions and is not stored with the response.
- Survey opens
- When a survey link is opened we count it, by survey and channel, so we can report open and completion rates. Opens are counted in aggregate, not recorded per visitor.
- Bot check
- On surveys that give rewards, Google reCAPTCHA (through Firebase App Check) checks that the browser is not an automated script before a coupon is issued.
- Plan and usage
- Your plan, trial dates, billing currency, coupon credits, and monthly usage counts (coupons issued, responses, AI drafts) used to apply plan limits.
- Product analytics
- Google Analytics for Firebase collects device, browser, and interaction data about how the app is used.
- Connected AI apps
- When you connect an AI assistant we record the workspace, the permissions you chose, the app’s name and client ID, and when it was connected, last used and disconnected. For each call we log the tool used, how long it took and whether it worked, never what was asked or answered.
2.How we use information
To provide and secure the Service: authenticate you, store and display your surveys and responses, apply plan limits, prevent duplicate or abusive submissions, and distribute rewards you configure.
To improve the Service: understand which features are used and fix problems.
To communicate with you about your account, billing, and important changes.
We never sell survey responses or other personal information. Responses belong to the business that ran the survey, and we don’t use respondents’ answers to advertise to them.
3.Survey respondents
The customer who created a survey decides what it asks and how answers are used, and is the controller of that data; we process it on their behalf. If you answered a survey and have questions about your data, contact the survey’s owner first — we’ll help them respond.
If the survey’s owner uses Hearsay from an AI assistant, your answers may be shown to that assistant’s provider. Your contact details are shown only if the owner has turned that on (see AI assistants below).
4.AI assistants
Customers can connect Hearsay to an AI assistant such as Claude (Anthropic), ChatGPT (OpenAI) or GitHub Copilot in VS Code. When they do, the survey content, results, summaries and quotes from answers they ask for are sent to that assistant’s provider. This happens by the customer’s choice and under the provider’s own terms and privacy policy; the provider is not our service provider.
Respondents’ contact details (names, emails, phone numbers, companies and job titles from contact questions), link fields marked personal and links to uploaded files never leave Hearsay this way unless an owner or admin of the workspace turns on “Share respondent contact details with AI assistants”. Even then they are sent only when someone asks about that question. Street addresses and IP addresses are never sent.
Sign-in for AI assistants runs through WorkOS (see Service providers). A customer can disconnect an assistant at any time in Integrations → Connected apps; it stops working on its next request.
6.Cookies and local storage
Google Analytics for Firebase sets cookies to measure app usage. Firebase Authentication stores a sign-in token in your browser.
We store small preferences in your browser’s local storage, such as your theme, sidebar state, the plan you picked on our pricing page, and a security token that protects form submissions. These aren’t used for advertising.
7.Retention
We keep account information and Your Content while your account is active. When you delete a survey or your account, we delete the related data from our active systems within 30 days, and from backups on their normal rotation, unless we must keep it longer by law.
8.Security
Data is encrypted in transit and stored with our cloud provider, which encrypts it at rest. Access is restricted by authentication and database security rules. No system is perfectly secure, so we can’t guarantee absolute security.
9.Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can edit your profile in the app, export responses from Analytics, and contact us for anything else. We’ll respond within 30 days.
If you’re in the EU, UK, or a region with similar laws, you can also complain to your local data protection authority; in the UK that is the Information Commissioner’s Office (ICO).
10.International transfers
We are based in the United Kingdom and store survey data in Google Cloud in the United States (nam5 multi-region). WorkOS is based in the United States. Brevo is based in France and processes data in the EU. For data about people in the UK and the EU we rely on the UK International Data Transfer Addendum and the EU standard contractual clauses in Google Cloud's, OpenAI's and WorkOS's data processing terms.
Business customers can ask us for a data processing agreement.
11.Children
The Service isn’t directed to children under 16, and we don’t knowingly collect their personal information. Customers must not use it to survey children without verifiable parental consent where the law requires it.
12.Changes to this policy
We’ll post updates here and change the date above. For material changes we’ll notify customers by email or in the app.
13.Contact
Privacy questions or requests: email support@hearsay.co.in. Brinus Tech Ltd is the data controller for customer accounts.