Privacy by design
GDPR-compliant surveys, built in rather than bolted on
Consent notices, lawful-basis controls, automatic retention, data-subject export and erasure, EU hosting and the option to keep everything on your own servers.
A complete export of everything tied to an account, in a structured, machine-readable form.
- surveys.json
- responses.json
- drafts.json
- files/
- collaborators.json
- notification-settings.json
How does Jackpoll minimise the personal data a survey collects?
Jackpoll minimises personal data by making name capture optional per survey, so a pulse check or a class poll can gather nothing that identifies anyone, and by using access codes to decide who may respond without attaching a name to the response. The cheapest way to protect personal data is not to collect it.
When a survey does need identifying information, consent banners and privacy notices are part of the product. You record the lawful basis you are relying on, and respondents see what they are agreeing to before they answer rather than in a policy nobody opens.
Ask for a name
Off by default — a pulse check does not need one.
Ask for an email
Only needed if you send a receipt.
Require an access code
Limits who can respond — without identifying them.
Stored per response
{
"answers": [ … ],
"submittedAt": "2026-07-28"
}The access code decides who may answer. It is not stored on the response.
Optional identification
Ask for a name only when you actually need one.
Consent notices built in
Banners and privacy text without writing your own.
Lawful-basis controls
Record why you are allowed to process the answers.
How does Jackpoll enforce GDPR storage limitation?
Jackpoll enforces storage limitation with a per-survey retention window: a scheduled job purges or anonymises responses older than it every day, without anyone having to remember. Article 5(1)(e) says personal data should not be kept longer than necessary, and in practice this is where most organisations quietly fail — not out of bad intent, but because nobody remembers a survey from three years ago.
Anonymising rather than deleting is often the right answer for research and long-running feedback programmes: the statistics survive, the individuals do not remain identifiable, and the obligation is met.
Most organisations fail this quietly — not out of bad intent, but because nobody remembers a survey from three years ago. A daily job does.
Responses older than this are removed automatically by a daily job. Leave empty to keep them indefinitely.
Anonymise instead of delete
Keeps the statistics, drops anything identifying.
After 90 days, responses stay as anonymous statistics.
How does Jackpoll handle GDPR access, erasure and portability?
Jackpoll implements access, erasure and portability rather than describing them: an account's data exports in a structured, machine-readable form covering surveys, responses, drafts, files, collaborators and notification settings, and erasure removes the account across every table, including the identity provider.
For respondents, private edit links let someone reopen and correct their own submission without you creating an account for them, which is often the quickest route to satisfying a rectification request.
Art. 15 & 20 export
Complete, structured, machine-readable account export.
Art. 17 erasure
Removed across every table and the identity provider.
Art. 5 retention
Daily job deletes or anonymises past the window.
Where is Jackpoll data hosted, and who can read the code?
Jackpoll's hosted version runs exclusively on servers in Germany, and the entire application is open source, so both where the data sits and what the code does with it can be checked. Uploaded files are virus-scanned on arrival, and word cloud submissions pass a profanity filter before they can appear on a shared screen — a small thing, but the kind of small thing that matters when the screen is in front of a class.
If EU hosting is still not enough, the entire application is open source and runs on your own infrastructure with Docker. That also means a data protection officer can read what happens to a response instead of relying on a vendor's description of it — the strongest form of assurance a survey tool can offer.
A DPO can read the code instead of trusting a description of it
The retention job, the erasure path and the upload scanner are all public. That is the strongest assurance a survey tool can offer — and it is the reason open source matters here specifically.
Frequently asked questions
- Is Jackpoll GDPR-compliant?
- It is built for GDPR compliance: consent banners, lawful-basis records, storage-limitation retention rules, and data-subject export and erasure. Compliance always also depends on how you use it — what you ask, why, and how long you keep it.
- Where is the data processed?
- The hosted version is EU-hosted. Self-hosting puts processing entirely on infrastructure you control.
- Can responses be deleted automatically?
- Yes. Each survey can carry a retention window; a daily job then deletes or anonymises responses older than it.
- Can I run an anonymous survey?
- Yes. Name capture is optional, and access codes can restrict who responds without linking an identity to the answer.
Keep reading
Related pages on the same topic.
Start building your survey today
Free, open source, and privacy-first. No credit card, no lock-in — create your first survey or quiz in minutes.
New versions land in TestFlight first, ahead of the stores.