Plain-language privacy.

Last updated September 29, 2026.

Plumeform is a survey platform. Two kinds of people use it: creators (account holders who build surveys) and respondents (people who answer them). This policy explains how we handle data for both.

If you have a Plumeform account

We store your email address, a hash of your password (or magic-link tokens), your workspace name and plan, the surveys you build, and the responses they collect. If you sign in with Google or Microsoft, they send us your email address, your name where they share it, and an identifier for your account with them; we never see that account's password, and signing in gives us no access to your mail, files or contacts. If you upgrade, payment is handled by Stripe — card numbers never touch our servers; we store only Stripe's customer and subscription identifiers. We use your email to send the account emails you'd expect (sign-in links, response notifications you turn on, weekly exports you schedule). We don't sell data or send marketing email you didn't ask for.

If you're answering a survey

Respondents never need an account, and we designed collection to be minimal:

We do not store your IP address with your response, and we set no advertising or cross-site trackers on survey pages.
A response contains your answers plus limited context: device class (mobile or desktop), a country code derived from network headers (never the address itself), the domain of the site that linked you to the survey, how long questions took, and — if the survey link carried them — identifiers like a Prolific ID that the researcher uses for payment and duplicate prevention.
If the creator turns on bot protection, the survey page also counts key presses, pointer activity, pastes and tab switches to flag automated responses. These are counts only, never what was typed or pasted.
A small browser-storage flag may remember that you finished, when the creator enables “one response per browser.”
On surveys that shuffle questions or assign experiment groups, a cookie keeps your question order and group the same if you reload the page. It holds no identifier and expires after 30 days.
Identity (name, email) is collected only if the survey explicitly asks you for it as a question.

For survey content and answers, the survey's creator decides what is asked and how results are used — for questions about a specific survey, the creator is the right contact. Partial answers you abandon are deleted automatically after 30 days.

Who processes data on our behalf

Plumeform runs on a short list of infrastructure providers, each processing data only to provide the service: Supabase (database and authentication, hosted on AWS in the United States), Netlify (hosting and delivery), Stripe (payments), Resend (transactional email), and Anthropic (only when a creator uses an AI feature like survey drafting, translation, or open-text summaries — the relevant text is sent for that request and not used to train models). If a creator connects Google Sheets, responses to that survey are also written to their spreadsheet under their Google account. Google Analytics runs on our marketing pages and inside the signed-in app (never on survey pages, draft previews or shared results): it measures page views and named actions in aggregate, receives no email address, survey content or answer, and is never joined to survey responses.

Retention and deletion

Creators can delete any survey (responses included) or their whole account from Account & team. Account deletion permanently removes owned workspaces, surveys, responses, uploaded files, and the login, and cancels their subscriptions immediately. Cleanup failures are retried automatically. Workspaces owned by other people are preserved. Responses live until the survey's creator deletes them. Abandoned partial responses purge after 30 days. If you responded anonymously, be aware we usually cannot identify your individual response afterwards.

Deletion removes application data from our active database and file storage. Infrastructure backups and security logs follow provider retention policies, and Stripe retains transaction records. Copies you have exported or sent to another service are not removed by deleting your Plumeform account.

Your rights

Wherever you are, we honor access, correction, export, and deletion requests for data we control: creators can self-serve most of this from the dashboard (CSV/XLSX export, delete buttons), and anyone can email for the rest. For respondent data inside a survey, we'll route you to the survey's creator, who controls it.

Changes

If this policy changes materially, we'll note it here with a new date, and email account holders about anything that reduces their protections. Questions: . See also our terms of service.