Data Retention Policy

This Data Retention Policy explains what personal data Survtapp collects, why, how long we keep it, and how it is archived and deleted. Survtapp is built and hosted in Canada; we handle personal data in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Québec's Law 25, and — where they apply — the EU/UK GDPR.

What We Collect

When a response is collected through the web or the mobile app, we may store:

• Public IP address — the network address the response was submitted from (web and mobile), used for security, fraud prevention, and abuse rate-limiting.
• Device make and model — general device information reported by the mobile operating system.
• An app-generated device identifier — a random UUID created by our app to distinguish devices for sync and device-locking. This is not a hardware serial number, IMEI, or advertising identifier.
• Location — precise GPS coordinates (with consent, where required) and a human-readable place (city, region, country) that we derive from those coordinates. The fix is taken when the form is opened, before any answer is given, not when the response is submitted. It is a single foreground reading at that moment; the app does not follow a device's location in the background. An organisation can configure its account so that a response cannot be submitted without a location fix, in which case the app asks again before allowing submission.
• Respondent contact fields and answers — the information a respondent provides in a survey, checklist, or waiver, including any photographs, documents or signatures they supply.
• Camera and microphone capture — where a form includes a photo, barcode, business-card or voice-note question, our mobile app uses the device camera to take the photograph or read the code, and the microphone to make the recording. Capture happens only while the question is being answered; nothing is recorded in the background. The photograph or audio file is stored as part of the response and kept for the same period as the rest of it. Voice notes are stored as recordings and are not transcribed.
• Business card images and the details read from them — where an organisation’s staff use the Business Card Scanner, the photograph of the card and the contact details taken from it are kept for the same period as the response they belong to, and are removed when it is deleted. The details are read on the device and the image is not sent anywhere to be read. Card images are held in private storage and are not reachable from a public web address.
• Timestamps — when a response was submitted (the true on-device completion time), collected, and synced to our servers.

Collected outside a response — signing in

Not everything above is tied to a response. Every sign-in stores the IP address it came from and the user-agent string the browser or app sends. Signing in to the mobile app, or registering it, also stores the device's make and model, its operating-system version, the app version and the app-generated device identifier against the user. We keep these for security — so that an unexpected sign-in can be investigated — and so that an account administrator can see and manage the devices signed in to their account. This is recorded whether or not a response is ever collected on that device.

Mobile app diagnostics — separate from response data

Separately from the response data above, our mobile app reports crash diagnostics and app-usage measurement to Google LLC (Firebase Crashlytics and Firebase Analytics). This concerns the app installation and the staff device it runs on — device model and manufacturer, operating-system and app version, device state such as free memory and storage, whether the device is rooted or jailbroken, screens viewed and session activity, an approximate country or region, and identifiers those services generate for the installation. It does not include survey answers, respondent contact details, signatures, uploaded files or waiver content, and it is a separate matter from the consent a respondent gives inside a survey. It is on by default and can be switched off from the app's Settings screen. These diagnostics are held by Google under the retention settings configured for our Firebase project; we do not keep a separate copy. Full detail is in our Privacy Policy.

How Long We Keep It

Response and respondent data is kept for a period set by the account's plan, measured from when the response is collected:

• Free plan — 30 days
• Solo — 12 months
• Business — 3 years
• Business Plus — 7 years

At the end of that period a response is marked for deletion, and is permanently deleted a short time afterwards (currently seven days). Moving to a plan with a longer window before that point extends the period. Where an account is in Vault mode — collection paused, existing data retained — the clock is paused for as long as Vault mode is active, and resumes when it ends.

Free accounts, and accounts whose free trial has expired, are additionally subject to an archive-then-delete backstop: a response that has not already been deleted is archived 90 days after it is collected and deleted 30 days after that.

Other categories:

• Billing and tax records: retained for 7 years regardless of account status, as required by law.
• Audit logs: retained for 12 months.
• Cookie-consent records: kept for as long as we may need them to demonstrate that consent was validly obtained.
• Support tickets and correspondence: kept while the account is open and for a reasonable period afterwards, so that we can evidence what was asked and what we did.

The periods above are the maximum retention periods we apply. Automated enforcement of them is being rolled out progressively; until it is fully switched on, data may still be present after its period has ended. That does not change your rights. Account administrators can delete responses from the dashboard at any time — and those deletions are recorded in the account's audit log — and you can ask us to delete data at any time using the contact details below. The specific day counts may be adjusted; the current values are shown above.

Archiving and Deletion

Archiving marks a response as no longer current while leaving the record in place, so that a change of plan before the deletion step can still be honoured. Deletion removes the response and its answers from our active systems permanently, and is not reversible.

Files uploaded with a response — photographs, signed waivers, documents — are removed from our file storage when the account they belong to is deleted. If you need a particular file removed sooner than that, ask us and we will action it.

Database backups are taken daily and retained for 30 days. Our production database additionally supports point-in-time recovery to any moment within a rolling 30-day window. Backups exist for disaster recovery only and are not used for any other purpose; a record deleted from our active systems may therefore persist in a backup for up to 30 days before it is rotated out.

Legal Basis

We process this data to provide the service you have engaged us for (performance of a contract), with your consent where consent is the appropriate basis (for example, capturing precise location), and to meet our legal obligations (such as retaining billing records).

Your Rights & How to Exercise Them

Subject to applicable law, you may request access to, correction of, export of, or deletion of your personal data. Account administrators can export and delete response data from within the dashboard (Settings → Privacy/GDPR). To make a data-subject request, or if you are a respondent who wishes to reach the organization that collected your data, contact us at support@survtapp.com and we will route the request appropriately.

If you are closing your account, export what you need first. Deleting an account removes its forms, responses, contacts and uploaded files permanently, and we cannot recover them afterwards. Contact us before you close it and we will confirm exactly what will be removed.

Where Your Data Lives & the Service Providers We Use

Survtapp's database and file storage are hosted in Canada, and your survey data — responses, signatures and uploaded files — is stored only in Canada. Some processing does involve providers outside Canada; each is listed below with what it receives and why. This is the complete list, and it is kept here rather than repeated on the other legal pages so that they cannot fall out of step. We integrate with each of these providers and use them on their own published terms and privacy commitments; we have not negotiated separate data-protection agreements with them. The geolocation lookup and the map tile servers are public endpoints, used without an account at all.

Always in use

• Amazon Web Services (Canada, ca-central-1) — the database and file storage that hold everything described above.
• Email delivery provider — sends transactional and notification email (account, form and support messages) on our behalf.
• Reverse-geocoding provider (OpenStreetMap / Nominatim, or an equivalent) — converts submitted GPS coordinates into a readable place name. Only coordinates rounded to roughly 100 metres are sent, and results are cached to minimise lookups.
• OpenStreetMap tile servers — when a member of your team views responses on a map inside the application, their browser loads the map images from these servers. That reveals the map area being viewed and the browser's IP address; no response data is sent.
• Geolocation provider — on our public pricing and sign-up pages, where our hosting layer cannot already tell us your country, we look it up so we can show the right currency. The provider receives your IP address. No cookie is involved and we do not retain the address for this purpose.
• Microsoft 365 — hosts our support mailbox, so email you send to support, and anything attached to it, is stored there as well as in our own ticket system.

Used for a specific purpose

• Stripe — payment processing. Receives the billing name, email and address held against the account; we never store full card numbers.
• OpenAI, L.L.C. (United States) — powers two optional features, and only when someone asks for them. An AI summary of results sends the form title, your question wording, aggregated answer counts and the most common answer labels, and where a report breaks results down that way, place names derived from submission locations and the name or email of the staff member who collected the responses; signatures, uploaded files and full individual responses are never sent. The help assistant sends the question you type, the recent messages in that conversation, and the Help Centre articles used to answer it. The same provider also generates the mathematical representations of our Help Centre articles that let the assistant find the right one.
• Google LLC — the services listed below. None of them receives survey, response, contact or waiver content, and we do not use any of them for advertising or remarketing. All are processed by Google outside Canada.
  • Firebase Cloud Messaging — delivers push notifications to our mobile app. It receives the device's push token and the short notification text, for example a form name or the subject line of a support message. Tokens are deleted when a device is retired or when Google reports the token as no longer valid.
  • Firebase Crashlytics and Firebase Analytics — crash reports and app-usage measurement from our mobile app, used to diagnose faults and improve it. On by default; it can be switched off from the app's Settings screen.
  • Google Analytics 4 — website analytics on our public marketing pages and the sign-in page. It is not loaded on the application's own screens, so it sees no survey, response, contact or waiver data. It can appear in our Help centre, which is part of the public website and which the mobile app displays inside the app; there it behaves as it does in a browser, and loads only if analytics cookies have been accepted. IP addresses are anonymised and Google Signals (cross-device advertising) is disabled, and it runs only with your consent; see our Cookie Policy, where you can decline analytics cookies.

Only if an account administrator connects them

• Mailing and CRM tools — Mailchimp, SendGrid, HubSpot, Constant Contact, GoHighLevel. If an administrator connects one of these to their account, we send contact records (name, email, phone) to it on their instruction. Nothing is sent unless the integration is switched on, and it can be disconnected at any time.

Sale of Data

We do not sell personal information to data brokers or share personally identifiable information with third parties for their own commercial purposes.

Contact Us

If you have questions about our data-retention practices or would like to request deletion of your data, please contact us at support@survtapp.com.