Privacy Policy

Information Collection

You may view some areas of our site for free and register for a free account. We collect information such as your name, email address and the details you choose to put in your profile. We use this information to operate your account and to contact you about the services on our site in which you have expressed interest.

If you subscribe to a paid plan, the payment itself is taken by our payment processor on its own hosted checkout page. Your card number, expiry date and security code are entered there and go straight to the processor: they never reach Thisys and we never store them. What we receive back and keep is the billing name and email address, the country, the card's brand and last four digits, and the record of what was charged — enough to show you an invoice and answer a billing question.

When you register for Thisys, you will receive a welcome activation email. If you ask for product updates — by ticking "I'd like to receive email from Thisys" when you sign up, or by turning on Product updates & tips on the Notifications tab of your account — you will receive occasional emails about new features, survey tips and product news. If you are a paid subscriber, you will receive emails regarding your account status and billing.

Survey responses belong to the account that collected them. We process them only to provide the service to that account — storing them, showing them in reports and exports, and running the optional AI analysis features when the account holder chooses to use them. We do not sell survey responses, share them with third parties for their own purposes, or use them to train AI models. Any other material you provide us (including images and email addresses) is held in the same confidence.

Apart from the technical records described under Log Files below, such as the IP address a request came from, we collect personal information about you only when you provide it: for example when you create an account, contact us or answer a survey. We will make every effort to ensure that whatever information you provide will be maintained in a secure environment.

Log Files

Our servers log each request — the IP address, the browser's user agent, the page asked for and the time — to run the service, keep it secure and investigate faults. These logs are kept for up to 30 days for security and operations, then deleted. Our network and security provider (Cloudflare) also sees each request as it passes through and keeps its own logs under its own policy.

When someone answers a survey, their response records the IP address and browser details it was sent from, unless the survey owner collects anonymously. This is part of the response: the survey owner uses it to spot duplicate or fraudulent responses, and it is deleted with the response, or when the respondent withdraws. To limit repeated sign-in attempts and scripted survey submissions, the application also keeps a short-lived abuse-protection record of the IP address a request came from (on a survey page, together with the survey link's identifier), including on anonymous links; it is held apart from the response and deleted after 48 hours.

Cookies

"Cookies" are small text files stored by your browser. Thisys sets its own cookies only. We do NOT use advertising cookies or cross-site tracking services. The cookies Thisys sets are:

· Sign-in and security (essential): the authentication session cookie that keeps you signed in, and the CSRF and callback cookies the sign-in system sets when a page loads. The application cannot function without these. When you connect Google or Microsoft to your account, "thisys.link-intent" holds a signed note of that request for up to 10 minutes, so the answer from Google or Microsoft is joined to your account and no other.

· Answering a survey (essential): "sfr_<survey link>" remembers a respondent's place in a survey so they can resume, and so one browser is not counted twice, for 30 days. A password-protected survey also sets "sfu_<survey link>" for 30 days to remember the password was entered (a signed record, not the password; changing the survey's password ends it). Neither holds answers or personal details.

· Opening a shared report (essential): when a shared report is protected by a password, "rpw_<report link>" holds a signed record that you entered the right password (never the password itself) for one hour, so it is not asked for on every visit; changing the report's password ends it. After a wrong password, "rpw_wrong_<report link>" is set for 30 seconds to say so, and after too many attempts "rpw_wait_<report link>" records when you may try again, for as long as that wait lasts. Each applies to that one report only.

· Appearance (convenience): "thisys.uitheme" and "thisys.uiaccent" remember your chosen light/dark theme and accent colour so the app renders correctly without a flash of the wrong theme.

· Time zone (convenience): "tz" records your browser's time zone for one year, so figures counted by day — such as responses this week — use your midnight rather than UTC's. It is set on every page except survey and other respondent pages, and holds only the zone's name, such as "Australia/Melbourne". When you are signed in, the same zone is kept on your account, so emails and certificates give times in it.

· Workspace preferences (convenience, signed-in pages only): "thisys.project" remembers the project you are working in and "thisys.workspace" whether signing in opens the AI page or the full workspace, each for one year; "thisys.navcollapsed" remembers whether the side menu is collapsed, for one year; "sv_active_team" remembers which team you last managed, for 90 days; and "thisys_bfm_dismissed" remembers which demo offers you closed, until you close the browser. None of them holds personal details.

· Referral attribution: if you arrive through a referral link, Thisys sets "thisys_ref" for 90 days so the referrer can be credited if you later create an account. It holds only the referral code — no personal data.

Where bot protection (Cloudflare Turnstile) is switched on for sign-up or survey pages, it runs in the background with no box on screen: Cloudflare checks the visitor's browser and connection to tell people from automated programs, and may set the cookies its check needs. That check is also governed by Cloudflare's Turnstile Privacy Addendum (https://www.cloudflare.com/en-gb/turnstile-privacy-policy/).

Most browsers let you refuse or delete cookies, but the sign-in and security cookies are required to use your account, and the survey cookies to answer a survey. Thisys does not sell cookie data or share it with advertisers.

Some things are kept in your browser's own storage rather than in a cookie. Display choices: the language and theme a respondent picked for a survey; the preview device and whether the preview's logic trace is open; whether you hid the chat button; the sort order, page size and filter of My Surveys, and the layout you chose for it on a phone; the chart type you chose for a question's results; and whether you opened the demo from your account. A survey brief or template you chose before signing up, kept until the builder uses it. Text you have typed but not yet saved or sent: answers typed into a survey but not yet saved, which stay in that browser tab until they are saved and are cleared when the tab closes (with a short marker that stops a reload being greeted as a return visit, and whether you accepted the survey's consent notice); an invitation message you are writing for a link; a translation of a survey you have not yet saved; and a rule drafted by AI that you have not yet saved. Notes handed from one page to the next in the same tab: the reasons an AI draft changed a survey, and a preview of survey changes you have not yet saved. Notices you dismissed: the low-credit notice, and the answer-key warning on a quiz. The email address typed on the home page, handed to the sign-up page in the same tab and cleared once you register. And, for a survey embedded in another website where the browser blocks its cookie, the same respondent reference the "sfr_" and "sfu_" cookies would otherwise hold.

Information Use

Thisys does not use third-party analytics, advertising or tracking services. From its own records, Thisys counts activity, such as sign-ins, surveys created and responses collected, per account and per day: to apply plan limits, to show you your own usage, and to see which parts of the product are used. These counts are not sold or shared.

Thisys uses IP addresses to run and secure the service — for example to limit repeated sign-in attempts and to stop scripted survey responses — and, on a survey response, as described under Log Files above.

Communications from the Site

Service-related Announcements

We will send you strictly service-related announcements on rare occasions when it is necessary to do so. For instance, if our service is temporarily suspended for maintenance, we might send you an email.

Generally, you may not opt-out of these communications, which are not promotional in nature. If you do not wish to receive them, you have the option to close your account.

Customer Service

When you register, we send an activation email so you can confirm your address and choose your password. We will also communicate with you in response to your inquiries via email, to provide the services you request, and to manage your account. Questions you type into the in-product assistant are stored, and may be read by Thisys staff to improve its answers and to give support.

Product Updates

If you ask for product updates, we will use your name and email address to send them to you. Out of respect for your privacy, every one of them carries a way to unsubscribe. Please see the Opting out section.

Sending Emails on User's Behalf

We also send survey invitation emails on behalf of our customers. The customer's email list is stored on our system, but is not used by Thisys in any other way. The emails sent on our customer's behalf come from a Thisys sending address in the customer's name ("<Name> via Thisys"), and replies go to the customer.

Testimonials

We post testimonials from time to time. We always receive permission to post prior to posting.

Sharing Information

Service Providers

We share personal information only with the service providers that run parts of the service for us, and only what each needs: our hosting provider, the network and security service that sits in front of the site (Cloudflare), our email delivery service, our payment processor, the sign-in providers you choose to use (Google or Microsoft), and our AI provider, Anthropic. They are listed, with what each processes and where, under Service Providers (Sub-processors) below and on our Security page.

Our payment processor, for example, receives your billing name and email address so that it can bill you; your card details are given to it directly on its own checkout page and are never shared by us, because we never hold them.

These third parties are prohibited from using your personally identifiable information for any other purpose including their own marketing purposes.

Opting Out

You can stop product updates at any time, in any of three ways: turn off Product updates & tips on the Notifications tab of your account, follow the unsubscribe link included in every product update we send you, or ask us through our Help Centre or the Contact Us page.

Links to Other Sites

This Web site contains links to other sites that are not owned or controlled by Thisys. Please be aware that we, Thisys, are not responsible for the privacy practices of such other sites.

We encourage you to be aware when you leave our site and to read the privacy statements of each and every Web site that collects personally identifiable information.

This privacy statement applies only to information collected by this Web site.

Access to Personally Identifiable Information

If your personally identifiable information changes, or if you no longer desire our service, you may correct or update it, or close your account, on our My Account page, or by reaching our Customer Support through Contact Us. We respond to any request to access, correct or delete your personal information within 30 days.

Legal Disclaimer

We reserve the right to disclose your personally identifiable information as required by law and when we believe that disclosure is necessary to protect our rights and/or to comply with a judicial proceeding, court order, or legal process served on our Web site.

General Security Policy

Thisys is aware of your privacy concerns and strives to collect only as much data as is required to make your Thisys experience as efficient and satisfying as possible, in the most unobtrusive manner as possible.

The security of your personal information is important to us. Everything you send us — your sign-in details, your surveys and your respondents' answers — travels over an encrypted TLS connection, and plain HTTP requests are redirected to HTTPS. We do not ask for card numbers or government identity numbers anywhere on this site.

We follow generally accepted industry standards to protect the personal information submitted to us, both during transmission and once we receive it. No method of transmission over the Internet, or method of electronic storage, is 100% secure, however. Therefore, while we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

If you have any questions about security on our Web site, you can reach us through Contact Us.

Our Roles: Controller and Processor

Thisys is operated by Thisys Technologies Pty Ltd (ABN 23 701 527 040, ACN 701 527 040) ("Thisys", "we"). For the account information you give us (your name, email address, sign-in details, billing details and how you use the service) we decide why and how it is processed: we are the "controller" under the EU and UK General Data Protection Regulation (GDPR) and the "APP entity" holding that information under the Australian Privacy Act 1988.

For the surveys you create, the responses your respondents give, the contact lists you upload and the reports you generate ("Customer Data"), you decide what is collected and why. You are the controller of Customer Data and Thisys is your "processor": we process it only on your instructions. If your organisation needs written data-processing terms, contact us at [email protected]. Your respondents should direct questions about a survey to you, its author; we will pass on any request we receive.

We do not sell Customer Data, use it for advertising, or use it to train artificial-intelligence models.

Survey creators are responsible for their own surveys. We do not decide what a survey asks, who it is sent to or what its author does with the responses afterwards, and we do not review surveys before they go live. Each survey creator is responsible for complying with the privacy, consent and spam laws that apply to the data they collect, and we are not responsible for how they use it. If you answered a survey and have a concern, contact the survey's author first. If you think a survey is being misused, write to [email protected]: we may look into it, remove the survey or suspend the account. None of this changes our own responsibilities for the data we hold on a creator's behalf.

Australian Privacy Principles and Notifiable Data Breaches

We handle personal information in accordance with the Australian Privacy Principles (APPs) in Schedule 1 of the Privacy Act 1988 (Cth). In particular we collect only what we need to provide the service (APP 3), tell you how we use it in this statement (APP 5), use it only for that purpose or a related purpose you would reasonably expect (APP 6), keep it accurate and let you correct it (APPs 10 and 13), protect it with the measures described on our Security page (APP 11), and destroy or de-identify it when it is no longer needed.

Thisys takes part in the Notifiable Data Breaches (NDB) scheme. If personal information we hold is lost, or accessed or disclosed without authorisation, and a reasonable person would conclude that this is likely to result in serious harm to anyone it relates to, we will notify the affected individuals (or, for Customer Data, the customer who owns it) and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and describe what happened, what information was involved and what to do about it.

You may complain about our handling of your personal information by contacting us; we will acknowledge the complaint within 7 days and respond within 30. If you are not satisfied with our response you may complain to the OAIC at www.oaic.gov.au.

Where Data Is Stored and International Transfers

Thisys is hosted in Sydney, Australia, and your account information and Customer Data are stored there. Some of the service providers listed below process limited data outside Australia: transactional email, payments, the optional Google and Microsoft sign-in, and the AI features are handled in the United States, and requests to the site pass through our network and security provider's global network on their way to our servers. Where information leaves Australia we take reasonable steps under APP 8 to ensure the recipient handles it in a way consistent with the APPs, and for individuals in the EU and UK we rely on standard contractual clauses or an adequacy decision as required by the GDPR.

AI features send only the text needed for the task to our AI provider, Anthropic, over an encrypted connection, under commercial terms that prohibit training on it. Analysis of survey responses by AI is off until the survey owner turns it on.

Your Rights

You can access and correct your account information at any time in your account settings, and you can export every survey and its responses in CSV, Excel or PDF. You can delete surveys, responses and contacts yourself (a survey you delete can be restored from Deleted surveys for 30 days before it is deleted for good), and you can close your account, after which your data is deleted from our live systems and, within 30 days, from backups — except the records listed under How Long We Keep Information, which are kept for the periods stated there.

Individuals in the EU, UK and other jurisdictions with similar laws also have the right to restrict or object to processing, to data portability, and to lodge a complaint with a supervisory authority. To exercise any right, contact us through the Contact Us page; we respond within 30 days, which is inside the one month the GDPR allows. If you are a respondent to a survey, your request is best directed to the organisation that ran the survey, as they control that data, and we will help them fulfil it.

How Long We Keep Information

· Your account information: for as long as your account is open, then deleted as described under Your Rights.

· Surveys, responses, contact lists and files (Customer Data): until you delete them, a survey's retention window deletes them, or you close your account. A survey you delete waits in Deleted surveys for 30 days, where you can restore it, and is then deleted for good with its responses; pages and questions you delete inside a survey wait in its trash for 14 days. Copies in our backups age out within 30 days.

· Emails we send (the outbox, including invitations and alerts): 90 days.

· The security and activity audit trail (sign-ins, changes to settings and data): 365 days. It records who did what, so it is kept for that period even after the account it describes is closed, with the person's email address as it was at the time.

· Conversations with the in-product assistant: 180 days.

· Billing: usage lines (what AI credits and answers were used) 365 days; purchases, invoices and payments for as long as tax and accounting law requires.

Children

Thisys accounts are for organisations and adults; we do not knowingly open an account for a child. Surveys run by our customers — for example schools — may be answered by children. For those answers the customer is the controller, and is responsible for any consent the law requires before a child takes part, such as a parent's or guardian's. If you believe a child has given us personal information directly, contact us and we will delete it.

Service Providers (Sub-processors)

We use a small number of third parties to run the service: our hosting provider in Australia, a network and security service (Cloudflare) that every request to the site passes through, an email delivery service for account and survey emails, a payment processor for paid plans (we never see or store your card number), the Google and Microsoft sign-in services for accounts that choose them, and our AI provider, Anthropic, for the AI features. The current list, with what each one processes and where, is published on our Security page and is kept up to date.

Changes in this Privacy Statement

If we decide to change our privacy policy, we will post those changes to this privacy statement, the home page, and other places we deem appropriate so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it.

We reserve the right to modify this privacy statement at any time, so please review it frequently. If we make material changes to this policy, we will notify you here, by email, or by means of a prominent notice on our home page.

Contact Us

Thisys is Thisys Technologies Pty Ltd (ABN 23 701 527 040, ACN 701 527 040). For privacy questions, requests and complaints — including those under the Australian Privacy Principles and the GDPR — contact us at:

Privacy email: [email protected]

Contact form: Contact Us

Online Support: Online Help Centre