Privacy Policy
Last updated: 13 August 2026
This Privacy Policy explains how we handle personal data on the Questionful website at questionful.org and in the Questionful application at my.questionful.org. It covers the data we hold about you as a visitor or account holder.
It does not decide how the answers your respondents give to your forms are used. For that data you are the controller and we act as your processor. See “Data you collect through your forms” below.
Who is responsible for your data
The controller for this website and for your Questionful account is:
Alex Tselegidis
Sole proprietor (Einzelunternehmer), trading as “AT Software Agency”
Löwenstr. 34
63067 Offenbach
Germany
VAT identification number (§ 27a UStG): DE305794612
Email: info@questionful.org
For full statutory provider details, see our Imprint.
1. What we collect, why, and on what legal basis
| When | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| You visit the website or the app | Standard server log data: IP address, browser type, referring page, timestamps | Operate and secure the service | Legitimate interests (Art. 6(1)(f)) |
| You create an account | Email address, name, password (stored hashed), account preferences, and, if you use Google sign-in, the profile data Google returns | Provide the account and confirm it belongs to you | Contract (Art. 6(1)(b)) |
| You build forms and collect responses | The forms, questions, contact lists, responses, and uploaded files in your account | Provide the product | Contract (Art. 6(1)(b)): and see section 3 |
| You subscribe to a paid plan | Billing name and address, VAT number, subscription and invoice records. Card details are processed by Stripe and never reach us | Take payment, issue invoices, meet tax obligations | Contract / legal obligation (Art. 6(1)(b)/(c)) |
| You use AI form generation | The prompt you write, sent to our AI provider to generate a draft form | Produce the form you asked for | Contract (Art. 6(1)(b)) |
| You or your respondents submit a public form | Technical signals processed by Cloudflare Turnstile to confirm a human is submitting | Prevent automated abuse of public forms | Legitimate interests (Art. 6(1)(f)) |
| You contact us | Your email address and the content of your message | Answer your enquiry | Steps before a contract / legitimate interests (Art. 6(1)(b)/(f)) |
| You allow analytics cookies | Aggregate usage data about how the site is used | Understand traffic and improve the product | Consent (Art. 6(1)(a)) |
2. What we do not do
We do not sell your personal data. We do not use the content of your forms or responses for advertising, and we do not use it to train AI models.
3. Data you collect through your forms
When someone fills in a form you built, you decide what is asked and why. In GDPR terms you are the controller of those responses and we are your processor: we process them only to run the service for you, and on your instructions.
That means it is your responsibility to:
- Have a lawful basis for asking what you ask.
- Tell your respondents who you are and how you will use their answers.
- Handle your respondents' data subject requests.
A data processing agreement is available on request at info@questionful.org.
4. Service providers we share data with
Each of these processes data only for the purpose named, on our instructions and under appropriate safeguards:
- Stripe (payments, subscriptions, invoices, and VAT handling.
- Cloudflare (Turnstile)) bot and spam protection on public forms and sign-in pages.
- OpenAI, AI form generation, when you use it. Only the prompt you write is sent.
- Google (sign-in with Google, and the Google Drive integration if you connect it to a form.
- Amazon Web Services) storage of files uploaded to your forms.
- Our hosting and email providers, to run the service and send transactional email.
Integrations you connect yourself, Zapier, Make, Google Drive, or your own webhook endpoint. Send response data to those services because you configured them to. What happens to it there is governed by your agreement with that provider.
5. Where data is processed
The application and its database are hosted in the European Union. Some of the providers above may process data outside the EU, including in the United States. Where that happens, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.
6. How long we keep data
- Account, form, and response data, for as long as your account is active. You can delete forms and responses yourself at any time.
- After account deletion (removed from the live systems immediately, and from encrypted backups within 30 days.
- Activity log) kept for the retention period configured on the account, 30 days by default.
- Invoices and order records (kept for the statutory retention period, which in Germany is up to 10 years (§ 147 AO, § 257 HGB).
- Enquiry correspondence) for as long as needed to handle your request and a reasonable period afterwards.
7. Security
Connections run over HTTPS. Passwords are stored hashed. Files uploaded to your forms are never served from a public URL. Reading one requires a session with access to the form or a signed link that expires. Accounts can enable two-factor authentication, and every change to a form is recorded in an activity log. No system is perfectly secure, but these are the measures we take and we will tell you if they fail.
8. Minimum age
You must be at least 16 years old to hold a Questionful account, in line with Art. 8 GDPR. We do not knowingly collect account data from anyone younger.
9. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Correct or update inaccurate data.
- Request deletion of your data. See our data deletion page.
- Object to or restrict certain processing.
- Receive your data in a portable format.
- Withdraw consent at any time, without affecting processing already carried out.
- Lodge a complaint with a data protection supervisory authority.
The supervisory authority responsible for us is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (the Hessian Commissioner for Data Protection and Freedom of Information). You may also lodge a complaint with the supervisory authority in your own country of residence.
10. Cookies
We use a small number of cookies, described in our Cookie Policy.
11. Changes to this policy
We may update this policy from time to time. The “Last updated” date above shows when it last changed, and significant changes will be highlighted on this page.
12. Contact
Questions about this policy? Email us at info@questionful.org, or contact support at support@questionful.org.