Privacy by design
GDPR-compliant surveys, built in rather than bolted on
Consent notices, lawful-basis controls, automatic retention, data-subject export and erasure, EU hosting and the option to keep everything on your own servers.
A complete export of everything tied to an account, in a structured, machine-readable form.
- surveys.json
- responses.json
- drafts.json
- files/
- collaborators.json
- notification-settings.json
Collecting less in the first place
The cheapest way to protect personal data is not to collect it. Name capture is optional per survey, so a pulse check or a class poll can gather nothing that identifies anyone. Where you need to control participation without identifying people, access codes decide who may respond without attaching a name to the response.
When a survey does need identifying information, consent banners and privacy notices are part of the product. You record the lawful basis you are relying on, and respondents see what they are agreeing to before they answer rather than in a policy nobody opens.
Ask for a name
Off by default — a pulse check does not need one.
Ask for an email
Only needed if you send a receipt.
Require an access code
Limits who can respond — without identifying them.
Stored per response
{
"answers": [ … ],
"submittedAt": "2026-07-28"
}The access code decides who may answer. It is not stored on the response.
Optional identification
Ask for a name only when you actually need one.
Consent notices built in
Banners and privacy text without writing your own.
Lawful-basis controls
Record why you are allowed to process the answers.
Storage limitation, enforced by the system
Article 5(1)(e) says personal data should not be kept longer than necessary, and in practice this is where most organisations quietly fail — not out of bad intent, but because nobody remembers a survey from three years ago. Each survey can carry a retention window, and a scheduled job purges or anonymises responses older than it, every day, without anyone having to remember.
Anonymising rather than deleting is often the right answer for research and long-running feedback programmes: the statistics survive, the individuals do not remain identifiable, and the obligation is met.
Most organisations fail this quietly — not out of bad intent, but because nobody remembers a survey from three years ago. A daily job does.
Responses older than this are removed automatically by a daily job. Leave empty to keep them indefinitely.
Anonymise instead of delete
Keeps the statistics, drops anything identifying.
After 90 days, responses stay as anonymous statistics.
Data-subject rights that actually run
Access, erasure and portability are implemented rather than described. An account's data exports in a structured, machine-readable form covering surveys, responses, drafts, files, collaborators and notification settings; erasure removes the account across every table, including the identity provider.
For respondents, private edit links let someone reopen and correct their own submission without you creating an account for them, which is often the quickest route to satisfying a rectification request.
Art. 15 & 20 export
Complete, structured, machine-readable account export.
Art. 17 erasure
Removed across every table and the identity provider.
Art. 5 retention
Daily job deletes or anonymises past the window.
Where the data is, and who can read the code
The hosted version runs in the EU. Uploaded files are virus-scanned on arrival, and word cloud submissions pass a profanity filter before they can appear on a shared screen — a small thing, but the kind of small thing that matters when the screen is in front of a class.
If EU hosting is still not enough, the entire application is open source and runs on your own infrastructure with Docker. That also means a data protection officer can read what happens to a response instead of relying on a vendor's description of it — the strongest form of assurance a survey tool can offer.
A DPO can read the code instead of trusting a description of it
The retention job, the erasure path and the upload scanner are all public. That is the strongest assurance a survey tool can offer — and it is the reason open source matters here specifically.
Frequently asked questions
- Is Jackpoll GDPR-compliant?
- It is built for GDPR compliance: consent banners, lawful-basis records, storage-limitation retention rules, and data-subject export and erasure. Compliance always also depends on how you use it — what you ask, why, and how long you keep it.
- Where is the data processed?
- The hosted version is EU-hosted. Self-hosting puts processing entirely on infrastructure you control.
- Can responses be deleted automatically?
- Yes. Each survey can carry a retention window; a daily job then deletes or anonymises responses older than it.
- Can I run an anonymous survey?
- Yes. Name capture is optional, and access codes can restrict who responds without linking an identity to the answer.
Keep reading
Related pages on the same topic.
Start building your survey today
Free, open source, and privacy-first. No credit card, no lock-in — create your first survey or quiz in minutes.