Privacy Policy

1. Information we collect

1.1 Information you give us

• Account details: first name, surname and e-mail address.
• A password, which we store only as a one-way hash. We never hold your password in a readable form.
• If you sign in with Google: your name, e-mail address and Google account identifier.
• Billing details you enter when subscribing to a paid plan.
• The surveys, questions and content you create.
• Support requests and anything else you write to us.

1.2 Information we collect automatically

• Log data: IP address, browser type, pages requested and timestamps, recorded so we can operate and secure the service.
• A device identifier, stored as a hash, so we can recognise the devices you sign in from and e-mail you when a new one appears.
• Security audit records of significant account actions, such as password changes and new device confirmations.
• Cookies, as described in section 11.

1.3 Respondent data

When you run a survey, the people answering it (“respondents”) provide answers that may contain personal data. We hold that data on your behalf. Section 10 sets out what that means for both of us.

2. How we use information

• To run the Platform and the surveys you build with it.
• To create your account, sign you in and keep it secure.
• To take payment and manage your subscription.
• To send transactional messages such as verification codes and invitations.
• To answer your support requests.
• To detect and prevent abuse, fraud and security incidents.
• To understand which features are used, so we can improve them.
• To meet our legal obligations.

We do not sell personal data, and we do not use your survey content or your respondents’ answers to train our own models.

3. AI processing

InterBeYou is built on artificial intelligence, so this deserves stating plainly rather than burying in a list.

• We use Google’s Gemini models to write interview questions, to read and interpret respondents’ answers, and to summarise results.
• This means the questions in your survey and the answers your respondents write are sent to Google for processing.
• Answers are processed to work out what was actually said, so that a conversational reply can be turned into structured data.
• Automated interpretation can be wrong. Nothing in the Platform makes a legal or similarly significant decision about a person automatically.

If you collect special category data, or anything you would not want processed by a third-party AI provider, do not put it into a survey.

4. Legal bases for processing

Where the GDPR applies, we rely on the following grounds. The same data may rest on more than one ground depending on why we are using it.

• Performance of a contract: to give you the service you signed up for, including hosting your surveys and taking payment.
• Legitimate interests: to secure the Platform, prevent abuse and improve the product, weighed against your rights and freedoms.
• Legal obligation: to keep accounting records and respond to lawful requests.
• Consent: where we ask for it, such as optional marketing e-mail. You may withdraw consent at any time.

5. Sharing and sub-processors

We do not sell your information. We share it only with the providers below, who process it on our instructions and under contract, and in the limited circumstances described underneath.

We may also disclose information:

• To other people, where you deliberately share it, such as a public survey link.
• To professional advisers, or to authorities in response to a lawful request, or where we need to prevent harm.
• To a buyer, if all or part of our business is sold, so far as the law allows and subject to this policy.

6. International transfers

Our application runs on Google Cloud in Belgium (europe-west1). Other providers listed above, including MongoDB Atlas, Stripe, Amazon Web Services and Google’s AI services, may store or process data in other countries. Where data leaves the European Economic Area we rely on the transfer mechanisms those providers offer, such as the European Commission’s Standard Contractual Clauses.

7. Your rights

Depending on where you live, you may ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything inaccurate.
• Delete your data, subject to obligations that require us to keep some of it.
• Restrict or object to how we process it.
• Provide it in a portable, machine-readable format.
• Withdraw consent where consent was the basis for processing.

You can export your data and delete your account from your profile settings at any time. For anything else, write to hello@interbeyou.com. You also have the right to complain to your local data protection authority.

If you are a respondent rather than an account holder, your request goes to the organisation that ran the survey, not to us. See section 10.

8. Security

• Traffic is encrypted in transit.
• Passwords are stored as one-way hashes, never in readable form.
• Uploaded files are held in private storage and served through short-lived signed links, never public URLs.
• Signing in from an unrecognised device triggers an e-mail confirmation before access is granted.
• Significant account actions are recorded in an audit log.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulator where the law requires it.

9. Retention and deletion

• Account data is kept while your account is open.
• Deleting a survey response also deletes any files uploaded with it from our file storage.
• When you delete your account we remove your personal data, except where we must keep records for legal, accounting or dispute-resolution reasons. Billing records are generally kept for the period tax law requires.
• Backups are overwritten on a rolling basis.

10. Respondent data

When you run a survey you decide what to ask and why, so in GDPR terms you are the controller of the answers you gather and InterBeYou is your processor. We handle those answers to provide the Platform and for no purpose of our own.

As the controller, you are responsible for:

• Telling respondents who you are and what you will do with their answers.
• Having a lawful basis, and obtaining consent where one is needed.
• Telling respondents that answers are processed by AI, since that is how the Platform works.
• Handling requests from respondents about their own data.
• Not collecting more than you need.

11. Cookies

We use a small number of cookies and similar technologies for:

• Keeping you signed in and protecting your session.
• Remembering your preferences.
• Understanding aggregate usage so we can improve the product.

You can clear or block cookies in your browser. Blocking the ones we use for sign-in will stop the Platform working.

12. Children

The Platform is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will remove it. If your survey is aimed at minors, that is your responsibility as controller and additional rules will apply to you.

13. Changes to this policy

We may update this policy. If a change materially affects how we handle your data we will tell you before it takes effect, by e-mail or in the Platform, so you can decide whether to carry on using it. The effective date at the top always reflects the current version.

14. Contact