NUVOPOLL PRIVACY POLICY

Last updated: October 4, 2026
Effective date: October 4, 2026

1. PROTECTING YOUR PRIVACY AND PURPOSE OF THIS POLICY

Seamlexly OÜ (“Seamlexly”, “Nuvopoll”, “Company”, “we”, “us”, or “our”), a company established in Estonia operating the Nuvopoll research platform, is committed to processing personal data lawfully, fairly, transparently, and securely.

This Privacy Policy (“Policy”) explains how personal data is collected, used, stored, disclosed, and protected across Nuvopoll websites, web and mobile applications, research and survey management software, support channels, and associated services (“Services”). It also outlines your rights regarding your personal data and how you can exercise them.

As an entity incorporated in the European Union, Seamlexly OÜ is subject to the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Estonian data protection legislation. Where applicable to specific processing activities, mandatory statutory provisions of other jurisdictions, including the Turkish Personal Data Protection Law No. 6698 (“KVKK”), are fully observed.

Publishing this Policy, your review of it, or your continued use of our Services does not in itself constitute consent for processing operations requiring valid consent. Where consent is legally required, an affirmative, freely given, specific, and separate consent mechanism is employed.

2. WHO WE ARE

Nuvopoll is a software-as-a-service (“SaaS”) platform that enables researchers, academic institutions, market research agencies, non-governmental organizations, public bodies, and corporate enterprises to design, configure, publish, distribute, and administer surveys, collect participant responses, analyze findings, and generate interactive live reports.

Service Provider Identification:

Corporate Name: Seamlexly OÜ
Country of Incorporation: Estonia
Commercial Registry Code: 17021816
VAT Identification Number: EE102783597
Registered Address: Harju maakond, Tallinn, Kesklinna linnaosa, Sakala tn 7-2, 10141, Estonia
Email: contact@nuvopoll.com
Official Website: https://www.nuvopoll.com

3. KEY DEFINITIONS

For the purposes of this Policy:

Personal data: Any information relating to an identified or identifiable natural person. A person does not need to be named directly; identifiers such as identification numbers, account IDs, online identifiers, or technical metadata can constitute personal data.
Processing: Any operation performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, restriction, erasure, or destruction.
Data controller: The natural or legal person that determines the purposes and means of processing personal data.
Data processor: The natural or legal person that processes personal data on behalf of and under the documented instructions of the data controller.
Data subject: The natural person whose personal data is processed, including website visitors, registered account holders, authorized organizational team members, and survey respondents.
Customer: The legal or natural person maintaining an active Nuvopoll subscription or workspace to conduct research, surveys, or data collection.
Authorized user: An administrator, researcher, analyst, or team member authorized by the Customer to access its workspace or account.
Customer personal data: Personal data processed by Nuvopoll on behalf of a Customer in connection with the Customer’s surveys and research projects.
Sub-processor: Any third-party service provider engaged by Nuvopoll to assist in processing Customer personal data.
Pseudonymized data: Data that can no longer be attributed to a specific data subject without the use of additional information kept separately under technical safeguards.
Anonymous data: Data rendered irrevocably non-identifiable by any reasonable means. Simply removing names or aggregating figures does not automatically render data legally anonymous.
Special categories of personal data (Sensitive Data): Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.

4. OUR ROLES IN DATA PROCESSING

4.1. Data Processor Role for Survey and Research Data

When a Customer conducts research or distributes a survey through Nuvopoll, the Customer acts as the Data Controller, and Seamlexly acts as the Data Processor on its behalf.

The Customer independently determines the research purpose, question design, respondent selection, legal basis, privacy notice, retention schedule, and recipient disclosures.
Seamlexly processes this data exclusively to deliver the platform service in accordance with the Customer’s documented instructions and the governing Data Processing Addendum (“DPA”). We never monetize, sell, or use Customer research data for independent marketing or advertising purposes.
If you participate in a survey hosted on Nuvopoll, you must refer to the privacy notice of the organization administering the survey for study-specific inquiries.

4.2. Data Controller Role for Our Direct Operations

Seamlexly acts as an independent Data Controller with respect to user account registration, identity authentication, subscription management, payment and billing, direct customer support, website security, fraud prevention, and compliance with our own legal and tax obligations.

5. PERSONAL DATA WE PROCESS AS A CONTROLLER

Depending on your interactions and relationship with us, we may process:

Account and User Identity Data: First and last name, job title, institutional or company affiliation, email address, unique user ID (UID), hashed passwords, role assignments, and workspace permissions.
Contact Details: Email address, business telephone number, billing address, and correspondence records.
Authentication and Security Records: Login logs, session tokens, IP addresses, timestamp records, multi-factor authentication statuses, and security audit logs.
Subscription and Billing Data: Invoicing name, company tax identification numbers, physical billing address, selected subscription tier, payment status, transaction reference numbers, and Stripe payment receipts. (Full credit card credentials are never stored on Nuvopoll servers; payments are processed securely by Stripe under PCI-DSS Level 1 certification).
Support and Inquiry Data: Support tickets, inquiries, screen captures, diagnostic feedback, and customer communication history.
Technical and Usage Data: Browser type and version, operating system, locale preference (NEXT_LOCALE), referring URLs, visited pages, interaction telemetry, and application error logs.
Marketing and Consent Preferences: Cookie consent parameters (Google Consent Mode v2 signals), newsletter subscriptions, and opt-out preferences.

6. DATA WE PROCESS ON BEHALF OF CUSTOMERS (AS PROCESSOR)

Depending on the Customer’s survey configuration, Customer personal data may include:

Respondent identifying information (name, email address, telephone number, or external panel identifiers).
Demographic information (age, gender, educational background, occupation, geography).
Survey responses, scale ratings, multiple-choice selections, and open-ended narrative answers.
Special categories of personal data explicitly incorporated into the study by the Customer.
Audio recordings and automated text transcriptions when the Customer activates voice responses.
Response timestamps, completion duration, hashed IP references, and technical telemetry.
Cryptographic consent logs, including SHA-256 hashes of the displayed privacy notice and timestamped consent acceptance.

7. SPECIAL CATEGORIES OF PERSONAL DATA

Customers may configure research projects that collect sensitive personal data (e.g., political views, religious beliefs, or health indicators).

In such cases, the Customer is solely responsible for establishing an appropriate legal basis under GDPR Article 9 (such as explicit consent) or applicable local laws, providing transparent notices, and instituting required ethics or regulatory safeguards.
Seamlexly processes these sensitive datasets strictly under the Customer’s instructions. Built-in compliance alerts and template generators on our platform do not substitute the Customer’s independent legal obligations.
Users must refrain from disclosing unnecessary sensitive data in direct technical support correspondence.

8. HOW WE COLLECT PERSONAL DATA

We collect personal data through:

Direct Interactions: When you register an account, subscribe to a plan, contact customer support, or submit forms on our website.
Workspace Invitations: When an employer, client, or workspace administrator invites you to join an organizational account.
Survey Participation: When you participate in and complete a survey administered on our platform.
Automated Technologies: Technical log files, server diagnostics, and authorized cookies or analytics tags during website visits.
Integrated Third-Party Services: Through our payment processor Stripe, authentication services, and transactional email infrastructure.

9. PURPOSES AND LEGAL BASES OF PROCESSING

Processing Purpose	Categories of Personal Data	Legal Basis under GDPR / Statutory Grounds
Account provisioning and service delivery	Name, email, password hash, account and organization data	Performance of contract (GDPR Art. 6(1)(b))
Billing and subscription management	Invoicing address, tax ID, transaction and payment records	Performance of contract and statutory tax/accounting compliance (GDPR Art. 6(1)(b), (c))
Customer support and issue resolution	Contact details, correspondence, diagnostic logs	Performance of contract and legitimate interests (GDPR Art. 6(1)(b), (f))
Platform security and fraud prevention	IP address, login and security audit trails, device telemetry	Compliance with legal obligations and legitimate interests (GDPR Art. 6(1)(c), (f))
Transactional and service email delivery	Email address, name, verification and alert tokens	Performance of contract and operational legitimate interests (GDPR Art. 6(1)(b), (f))
Website analytics and ad conversion tracking	Cookie identifiers, interaction metrics, device profiles	Explicit consent via Google Consent Mode v2 (GDPR Art. 6(1)(a))
Legal claims and compliance audits	Transaction records, cryptographic audit trails, consent proofs	Legal compliance and establishment, exercise, or defense of legal claims (GDPR Art. 6(1)(c), (f))

10. CONSEQUENCES OF WITHHOLDING DATA

Providing essential account, authentication, and billing information is a contractual requirement for accessing paid features and workspace administration. Without this data, account creation cannot proceed.

Refusing non-essential analytics or advertising cookies does not affect core platform functionality or survey participation.

11. RECIPIENTS OF PERSONAL DATA

We disclose personal data strictly to the extent necessary to the following categories of recipients:

Authorized Internal Personnel: Employees and authorized engineers bound by strict confidentiality covenants.
Customers and Workspace Administrators: When you submit a survey response, your data becomes accessible to the Customer managing that study.
Cloud Infrastructure and Hosting Providers: Google Cloud Platform and Firebase (servers, databases, cloud storage, authentication).
Payment Processor: Stripe Inc. / Stripe Payments Europe, Ltd. for secure subscription billing.
Email Delivery Providers: Google Workspace / Enterprise SMTP (Nodemailer) for transactional alerts; and Customer-configured Custom SMTP servers where enabled.
Analytics and Advertising Partners: Google Ireland Limited (Google Analytics and Google Ads), subject to prior cookie consent.
Competent Public Authorities: Where required under mandatory law or binding judicial order.

12. INFRASTRUCTURE AND CORE SUB-PROCESSORS

Nuvopoll’s primary production infrastructure is hosted on Google Cloud Platform within the europe-west1 (Belgium, European Union) region.

Database, Hosting, and Auth: Google Cloud and Firebase (Firestore, Cloud Functions v2, Cloud Storage, Firebase Auth). All core databases reside inside the EU.
AI Processing: Google Cloud Genkit and Google Gemini API (gemini-2.0-flash-001).
Payment Processing: Stripe Payments Europe, Ltd. (Ireland / EU).
Email Delivery: Google Workspace / Secure SMTP infrastructure for system notifications.
Current Sub-processor Directory: Available in our Data Processing Addendum (DPA).

13. INTERNATIONAL DATA TRANSFERS

All primary data storage and processing activities are conducted within the European Union (EU) / European Economic Area (EEA).

Transfers to Third Countries: Where technical support, cloud infrastructure, or sub-processor activities require transferring or accessing personal data from outside the EEA, such transfers are carried out strictly in compliance with Chapter V of the GDPR. We ensure appropriate safeguards are implemented, including European Commission adequacy decisions (such as the EU-U.S. Data Privacy Framework) or executed Standard Contractual Clauses (SCCs) accompanied by transfer impact assessments and supplementary technical protections.

14. VOICE RESPONSES AND TRANSCRIPTION

When a Customer activates audio responses in a survey, participants’ voice recordings and text transcripts are processed on behalf of the Customer:

No Biometric Identification: Voice inputs are never utilized for biometric voiceprinting, identity recognition, or behavioral profiling.
Signed URL Expiration: Signed access URLs for playback or audio file retrieval expire automatically after 15 minutes.
Transcription Engine: Automated transcription utilizes Google Cloud Speech-to-Text V2 (model chirp_3, recognizer chirp-3-generic-v1) processed transiently through the eu multi-region endpoint (eu-speech.googleapis.com). Voice data is never retained for training third-party foundation models.
Written text alternatives are always available to respondents who decline voice submission.

15. AI-ASSISTED CAPABILITIES

Nuvopoll offers AI-assisted functionality for questionnaire drafting, question optimization, translation, and multilingual privacy notice drafting.

Provider and Architecture: Powered by Google Cloud Genkit and the Google Gemini API (gemini-2.0-flash-001).
Zero Model Training on Customer Data: Under our enterprise API terms, questions, drafts, instructions, and prompt payloads are never used to train Google foundation models and are excluded from human review.
Participant Data Isolation: Individual survey responses and respondent personal datasets are never transmitted to AI drafting services.

16. COOKIES AND SIMILAR TECHNOLOGIES

We deploy cookies and local storage tokens to deliver our Services securely and evaluate user experience.

16.1. Essential Cookies

Required for authentication, CSRF security, language preference preservation (NEXT_LOCALE), and recording consent selections. These cannot be disabled.

16.2. Analytics and Advertising Cookies (Google Analytics & Google Ads)

We utilize Google Analytics 4 (Measurement ID: G-3FK0Y87MYC) and Google Ads conversion tags (gtag.js) to assess site traffic and optimize outreach campaigns.
Google Consent Mode v2: Our site operates with full Google Consent Mode v2 support. Tags for analytics_storage, ad_storage, ad_user_data, and ad_personalization remain blocked or restricted until affirmative consent is granted.
Managing Preferences: You can review or adjust your cookie preferences at any time via the cookie banner or our Cookie Preferences.

17. SERVICE COMMUNICATIONS AND EMAIL INFRASTRUCTURE

Transactional and Operational Emails: Critical service notices—such as email verifications, password resets, multi-factor codes, billing confirmations, and data retention alerts—are dispatched via Google Workspace / Enterprise SMTP (Nodemailer). Because these are integral to contract execution, they are not subject to commercial opt-out mechanisms.
Custom Enterprise SMTP: Enterprise Customers may integrate their own corporate mail servers (Custom SMTP) to dispatch survey invitations under their proprietary domain. In such scenarios, delivery is managed through the Customer's designated mail servers.
Promotional Communications: Where you have explicitly opted in, we may send periodic product announcements. You can unsubscribe at any time using the opt-out link in each email.

18. DATA RETENTION SCHEDULES

Personal data is retained only for the duration required to accomplish the legitimate purpose for which it was collected or to satisfy statutory retention obligations.

18.1. Account and Operational Data

Account Records: Stored for the duration of the active subscription, and up to 3 years following account closure for legal claim defense.
Export Packages (ZIP Files): Generated survey export packages are permanently and automatically deleted by daily system routines after 7 days.
Session Tokens: Active login session tokens expire after 30 days.
Financial and Accounting Documents: Retained for statutory periods prescribed by applicable commercial and tax law (7 to 10 years).
Support Records: Retained for up to 3 years following ticket resolution.

18.2. Customer Research Datasets

Research data collected on behalf of Customers is governed by Customer-configured retention schedules:

Nuvopoll sends automated notifications to the Customer 30 days, 7 days, and 1 day prior to the designated retention expiration date.
Upon expiration or upon Customer deletion command, study responses are permanently removed from the active workspace.

18.3. Compliance Evidence and Immutable WORM Archive

Pursuant to GDPR Article 5(2) (Accountability) and Article 7(1) (Proof of Consent):

Participant consent logs (timestamp, notice revision identifier, hashed IP/UserAgent credentials), deletion/purge audit logs, and SHA-256 signed audit trails are archived separately in a locked Write-Once-Read-Many (WORM) storage bucket (gs://global-poll-jqkgs-compliance-logs) for 10 years.
Respondent survey answers and audio recordings are never placed into this compliance archive; it is strictly reserved for verifiable compliance documentation.

19. DATA SECURITY SAFEGUARDS

We apply robust technical and organizational security controls:

Cryptographic Protection: All data in transit is encrypted using TLS 1.3/1.2; data at rest is encrypted with AES-256.
Access Governance: Multi-Factor Authentication (MFA), role-based access control (RBAC), and least-privilege principles are enforced for all engineering access.
Multi-Tenant Separation: Customer workspaces and database partitions are logically segregated to prevent cross-account exposure.
Incident Response: In the event of a confirmed personal data breach affecting Customer personal data, Nuvopoll will notify affected Customers without undue delay. For matters where Seamlexly acts as a Controller, regulatory notifications will be made within statutory 72-hour deadlines.

20. THIRD-PARTY INTEGRATIONS AND AD NETWORKS

Customers may connect external advertising networks (Meta Ads, LinkedIn Ads, X Ads, TikTok Ads) to distribute survey campaigns.

These integrations operate strictly under the Customer’s credentials and authorization.
Audience data synchronized with third-party networks falls under the Customer’s direct controller responsibility and the respective platform terms.

21. CHILDREN’S PRIVACY

Nuvopoll accounts may only be registered by individuals aged 18 years or older.

Where a Customer designs research involving minors, the Customer is solely responsible for obtaining verified parental/guardian consent, providing age-appropriate disclosures, and ensuring full compliance with child data protection laws.

22. AUTOMATED DECISION-MAKING AND PROFILING

Seamlexly does not engage in automated decision-making or profiling producing legal effects or similarly significant impacts on data subjects pursuant to GDPR Article 22.

23. YOUR DATA SUBJECT RIGHTS

Under the GDPR, KVKK, and applicable data privacy laws, you possess the right to:

Access: Confirm whether your personal data is processed and request copies of processed records.
Rectification: Request correction of inaccurate or incomplete data.
Erasure (“Right to be Forgotten”): Request deletion where data is no longer necessary or processing is unlawful.
Restriction of Processing: Request temporary limitation of processing under statutory circumstances.
Data Portability: Receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON, CSV).
Object: Object to processing grounded on legitimate interests or conducted for direct marketing purposes.
Withdraw Consent: Revoke previously granted consent at any time without retroactive invalidation.
Lodge a Complaint: Submit a formal complaint to a competent supervisory authority.

24. HOW TO EXERCISE YOUR RIGHTS

24.1. For Processing Where Seamlexly is Data Controller

Submit your request regarding account, billing, or platform operations to contact@nuvopoll.com.

Requests will be answered without undue delay and at the latest within 30 days free of charge.
We may request proportional identification verification to protect your data against unauthorized disclosure.

24.2. For Survey and Respondent Inquiries

If your request pertains to answers provided in an online survey, you must contact the Customer (organization administering the survey) directly. Requests directed to us will be forwarded to the respective Customer promptly.

25. SUPERVISORY AUTHORITIES AND COMPLAINTS

If you have unresolved concerns regarding our data processing, you have the right to lodge a complaint with the competent supervisory body:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon):
Tatari 39, 10134 Tallinn, Estonia
Web: https://www.aki.ee/en | Email: info@aki.ee
For Residents in Turkey: Personal Data Protection Authority (KVKK) - https://www.kvkk.gov.tr
You may also contact the supervisory authority located in your EU Member State of habitual residence, place of work, or alleged infringement.

26. THIRD-PARTY WEBSITES

Our Services may contain links to external websites. We do not control and cannot be responsible for the privacy practices or content of third-party domains.

27. AMENDMENTS TO THIS POLICY

We may update this Privacy Policy from time to time. When significant updates occur, we will provide prominent notice on our website or deliver an email notification to registered account holders.

28. CONTACT US

For questions, requests, or notices regarding this Privacy Policy, please contact:

Seamlexly OÜ
Harju maakond, Tallinn, Kesklinna linnaosa, Sakala tn 7-2, 10141, Estonia
Registry Code: 17021816 | VAT: EE102783597
Email: contact@nuvopoll.com
Website: https://www.nuvopoll.com