Skip to main content
Sign up

Privacy Policy

Last updated:
Version:
2026.11.08.1

Information Collection

You may view some areas of our site for free and register for a free account. We collect information such as your name, email address and the details you choose to put in your profile. We use this information to operate your account and to contact you about the services on our site in which you have expressed interest.

When you create an account, Thisys records how you found it: the campaign tags in the link you arrived by (such as utm_source and utm_campaign), the page of the site you first opened in that browser tab, and the name of the website that sent you (never the full address of the page you came from). It is recorded once, by Thisys itself, with no cookies or advertising tags, so that we can understand which advertisements and pages bring customers; we look at it as counts, not person by person, and it is deleted with your account.

If you subscribe to a paid plan, the payment itself is taken by our payment processor on its own hosted checkout page. Your card number, expiry date and security code are entered there and go straight to the processor: they never reach Thisys and we never store them. What we receive back and keep is the billing name and email address, the country, the card's brand and last four digits, and the record of what was charged — enough to show you an invoice and answer a billing question.

When you register for Thisys, you will receive a welcome activation email. If you ask for product updates — by ticking "I'd like to receive email from Thisys" when you sign up, or by turning on Product updates & tips on the Notifications tab of your account — you will receive occasional emails about new features, survey tips and product news. If you are a paid subscriber, you will receive emails regarding your account status and billing.

When you create an account we send up to three setup emails over your first week about your own surveys; each has a one-click link to stop them.

Survey responses belong to the account that collected them. We process them only to provide the service to that account — storing them, showing them in reports and exports, and running the optional AI analysis features when the account holder chooses to use them. We do not sell survey responses, share them with third parties for their own purposes, or use them to train AI models. Any other material you provide us (including images and email addresses) is held in the same confidence.

Apart from the technical records described under Log Files below, such as the IP address a request came from, and the record of how you found Thisys described above, we collect personal information about you only when you provide it: for example when you create an account, contact us or answer a survey. We will make every effort to ensure that whatever information you provide will be maintained in a secure environment.

When you create an account, and each time you sign in, we record the IP address and the approximate location worked out from it by Cloudflare (the country, and the region and city where known). We keep the location of your sign-up and of your most recent sign-in, to protect your account from misuse and to understand where our customers are; each IP address is removed after 90 days.

Log Files

Our servers log each request — the IP address, the browser's user agent, the page asked for and the time — to run the service, keep it secure and investigate faults. These logs are kept for up to 30 days for security and operations, then deleted. Our network and security provider (Cloudflare) also sees each request as it passes through and keeps its own logs under its own policy. When something goes wrong on our servers we also keep a record of the error (where it happened and a short description, with personal details, addresses and secrets removed) for 30 days, so we can find and fix the cause. We group those records into incidents (a short title with the same details removed, how often and when it happened, our AI's explanation of it and the steps our staff took), kept for 90 days after the error was last seen; the explanation is written from the error record alone, never from your content.

When someone answers a survey, their response records the IP address and browser details it was sent from, and the approximate location worked out from that IP address (the country, and the region and city where known), unless the survey owner collects anonymously or switches location recording off for the link; with location recording off, the response keeps the browser details but not the IP address or the location. The location comes from our network provider, Cloudflare, as the request passes through it; no other service is asked, and no precise location (such as GPS) is ever requested. This is part of the response: the survey owner uses it to spot duplicate or fraudulent responses and to see where responses came from, and it is deleted with the response, or when the respondent withdraws. The IP address itself is removed from a response that records a location 90 days after the response was started; the location stays with the response. An IP address stored with a response collected before location recording began is kept for as long as that response is. When a survey link is opened with campaign tags or advertising click identifiers in its address (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid or msclkid), the response keeps those values too, unless the link is anonymous, so the survey owner can count responses by where they came from; the survey page names them under the questions. Nothing is added to survey pages to collect them: no advertising tags, pixels or cookies. To limit repeated sign-in attempts and scripted survey submissions, the application also keeps a short-lived abuse-protection record of the IP address a request came from (on a survey page, together with the survey link's identifier), including on anonymous links; it is held apart from the response and deleted after 48 hours.

When someone presses Report this survey, the report we keep holds the boxes they ticked, anything they wrote, whether they say they were targeted, the contact details they chose to give (optional) and a one-way hash of the IP address it came from, which is used to limit repeat reports; the address itself is not stored with the report. The Report a survey form collects anonymously, so the response a report arrives as keeps no IP address, location or browser details either. Thisys staff read reports to decide what to do about the survey, and the reporter's contact details are shown only to them, never to the survey's owner. We also keep the safety check's findings about a survey link and what our staff decided.

To protect the service from misuse, a background check we call the abuse watch re-reads the wording of live surveys and looks for patterns in the IP addresses of sign-ups, responses and answers made mostly of links (many from one address in a short time). A pattern is only a finding listed for our staff to review: nothing is blocked automatically. When a staff member confirms that an address is being used to abuse the service, they can block it; a blocked address is refused when it tries to register, create or publish a survey, or send an answer or a file through a survey link, and the refusal does not say why. A finding about an address is kept for 90 days from when the address was last seen and then removed. An IP address that staff confirm as abusive is kept on a block list for up to 90 days and then removed. Our staff, never a survey's owner, can see them.

Cookies

"Cookies" are small text files stored by your browser. Thisys sets its own cookies only. We do NOT use advertising cookies or cross-site tracking services. The cookies Thisys sets are:

  • Sign-in and security (essential): the authentication session cookie that keeps you signed in, and the CSRF and callback cookies the sign-in system sets when a page loads. The application cannot function without these. When you connect Google or Microsoft to your account, "thisys.link-intent" holds a signed note of that request for up to 10 minutes, so the answer from Google or Microsoft is joined to your account and no other. If you tick "Remember this device" when entering your two-factor code, "thisys.trusted-device" holds a random token for 30 days (7 days for an administrator account) so that browser is not asked for the code again while it keeps being used; it is set only when you tick the box, and ends when you change your password, turn two-factor off, use a recovery code to sign in, or choose Forget under Remembered devices on the Login & security tab.
  • Answering a survey (essential): "sfr_<survey link>", set when you open the survey page and it can be answered, tells Thisys which response in a survey belongs to this browser, for 30 days, so one browser is not counted twice. On a link that is not anonymous it is also how a respondent returns to where they left off, in any tab on that device; on an anonymous link their place is kept only in the tab they started in, unless the survey's owner switches resuming on. A password-protected survey also sets "sfu_<survey link>" for 30 days to remember the password was entered (a signed record, not the password; changing the survey's password ends it). Neither holds answers or personal details.
  • Opening a shared report (essential): when a shared report is protected by a password, "rpw_<report link>" holds a signed record that you entered the right password (never the password itself) for one hour, so it is not asked for on every visit; changing the report's password ends it. After a wrong password, "rpw_wrong_<report link>" is set for 30 seconds to say so, and after too many attempts "rpw_wait_<report link>" records when you may try again, for as long as that wait lasts. Each applies to that one report only.
  • Appearance (convenience): "thisys.uitheme" and "thisys.uiaccent" remember your chosen light/dark theme and accent colour so the app renders correctly without a flash of the wrong theme.
  • Time zone (convenience): "tz" records your browser's time zone for one year, so figures counted by day — such as responses this week — use your midnight rather than UTC's. It is set on every page except survey and other respondent pages, and holds only the zone's name, such as "Australia/Melbourne". When you are signed in, the same zone is kept on your account, so emails and certificates give times in it.
  • Workspace preferences (convenience, signed-in pages only): "thisys.project" remembers the project you are working in and "thisys.workspace" whether signing in opens the AI page or the full workspace, each for one year; "thisys.navcollapsed" remembers whether the side menu is collapsed, for one year; "sv_active_team" remembers which team you last managed, for 90 days; and "thisys_bfm_dismissed" remembers which demo offers you closed, until you close the browser. None of them holds personal details.
  • Referral attribution: if you arrive through a referral link, Thisys sets "thisys_ref" for 90 days so the referrer can be credited if you later create an account. It holds only the referral code — no personal data.

Where bot protection (Cloudflare Turnstile) is switched on for sign-up, contact and survey pages, it runs in the background with no box on screen: Cloudflare checks the visitor's browser and connection to tell people from automated programs, and may set the cookies its check needs. That check is also governed by Cloudflare's Turnstile Privacy Addendum (https://www.cloudflare.com/en-gb/turnstile-privacy-policy/).

Most browsers let you refuse or delete cookies, but the sign-in and security cookies are required to use your account, and the survey cookies to answer a survey. Thisys does not sell cookie data or share it with advertisers.

Some things are kept in your browser's own storage rather than in a cookie. Display choices: the language and theme a respondent picked for a survey; the preview device and whether the preview's logic trace is open; the page of a survey you were editing in the builder, kept in that browser tab; whether you hid the chat button; the sort order, page size and filter of My Surveys, the layout you chose for it on a phone, and whether you belong to a team, so My Surveys can hold the place of its team filter while it loads; the sort order you chose on each Analyse and Assess list; whether you ticked "Always do it for me" on the AI page; the last 8 requests you asked on the AI page (never its answers), to ask again; whether you chose to see monthly or yearly prices; the chart type you chose for a question's results; and whether you opened the demo from your account. A survey brief or template you chose before signing up, kept until the builder uses it. Text you have typed but not yet saved or sent: answers typed into a survey but not yet saved, which stay in that browser tab until they are saved and are cleared when the tab closes (with a short marker that stops a reload being greeted as a return visit, and whether you accepted the survey's consent notice); an invitation message you are writing for a link; a translation of a survey you have not yet saved; and a rule drafted by AI that you have not yet saved; a survey the AI builder drafted for you that you have not yet created (kept for up to 7 days, then dropped); and your conversation on the AI page with its proposed changes, kept in that browser tab for up to a day so a reload does not lose them (never the respondents' answers a change showed). Notes handed from one page to the next in the same tab: the reasons an AI draft changed a survey, and a preview of survey changes you have not yet saved. The last AI digest of a team you generated, so you can read it again without paying for it twice (kept for up to 7 days, or until you regenerate it). Notices you dismissed: the banners across the top of the page, and the answer-key warning on a quiz. The email address typed on the home page, handed to the sign-up page in the same tab and cleared once you register. Where you came from when you first opened a page of the site in that tab (the link's campaign tags, the page you landed on and the name of the website that sent you), kept only in that tab and sent with your sign-up if you create an account. And, for a survey embedded in another website where the browser blocks its cookie, the same respondent reference the "sfr_" and "sfu_" cookies would otherwise hold.

Information Use

Thisys does not use advertising or cross-site tracking services. To count visits to its public pages and the signed-in app, it uses Plausible Analytics (Plausible Insights OÜ, hosted in the European Union), which sets no cookies, keeps no personal data about visitors and reports only aggregate page-view and event counts (for example, that a demo was opened, an account was created, a plan was bought or a survey was created), with no personal data; it is not used on survey pages, so people answering a survey are not counted. From its own records, Thisys counts activity, such as sign-ins, surveys created and responses collected, per account and per day: to apply plan limits, to show you your own usage, and to see which parts of the product are used. These counts are not sold or shared.

Thisys uses IP addresses to run and secure the service — for example to limit repeated sign-in attempts, to stop scripted survey responses and to refuse sign-ups and responses from an address our staff have confirmed is abusing the service — and, with the approximate location worked out from them, on your account (as described under Information Collection above) and on a survey response (as described under Log Files above).

Communications from the Site

Service-related Announcements

We will send you strictly service-related announcements on rare occasions when it is necessary to do so. For instance, if our service is temporarily suspended for maintenance, we might send you an email.

Generally, you may not opt-out of these communications, which are not promotional in nature. If you do not wish to receive them, you have the option to close your account.

Customer Service

When you register, we send an activation email so you can confirm your address and choose your password. We will also communicate with you in response to your inquiries via email, to provide the services you request, and to manage your account. Questions you type into the in-product assistant are stored, and may be read by Thisys staff to improve its answers and to give support.

Product Updates

If you ask for product updates, we will use your name and email address to send them to you. Out of respect for your privacy, every one of them carries a way to unsubscribe. Please see the Opting out section.

Sending Emails on User's Behalf

We also send survey invitation emails on behalf of our customers. The customer's email list is stored on our system, but is not used by Thisys in any other way. The emails sent on our customer's behalf come from a Thisys sending address in the customer's name ("<Name> via Thisys"), and replies go to the customer.

Testimonials

We may publish testimonials in future. None is published without the person's permission, given beforehand.

Sharing Information

Service Providers

We share personal information only with the service providers that run parts of the service for us, and only what each needs: our hosting provider, the network and security service that sits in front of the site (Cloudflare), our email delivery service, our payment processor, the sign-in providers you choose to use (Google or Microsoft), our AI provider, Anthropic, and our website analytics provider, Plausible (page-view and event counts only, no cookies). For the move of SurveyFace accounts in October 2026 we also used an email-address verification service, MillionVerifier, once, on email addresses alone. They are listed, with what each processes and where, under Service Providers (Sub-processors) below and on our Security page.

Our payment processor, for example, receives your billing name and email address so that it can bill you; your card details are given to it directly on its own checkout page and are never shared by us, because we never hold them.

These third parties are prohibited from using your personally identifiable information for any other purpose including their own marketing purposes.

Opting Out

You can stop product updates at any time, in any of three ways: turn off Product updates & tips on the Notifications tab of your account, follow the unsubscribe link included in every product update we send you, or ask us through our Help Centre or the Contact Us page.

Links to Other Sites

This Web site contains links to other sites that are not owned or controlled by Thisys. Please be aware that we, Thisys, are not responsible for the privacy practices of such other sites.

We encourage you to be aware when you leave our site and to read the privacy statements of each and every Web site that collects personally identifiable information.

This privacy statement applies only to information collected by this Web site.

Access to Personally Identifiable Information

If your personally identifiable information changes, or if you no longer desire our service, you may correct or update it, or close your account, on our My Account page, or by reaching our Customer Support through Contact Us. We respond to any request to access, correct or delete your personal information within 30 days.

Legal Disclaimer

We reserve the right to disclose your personally identifiable information as required by law and when we believe that disclosure is necessary to protect our rights and/or to comply with a judicial proceeding, court order, or legal process served on our Web site.

General Security Policy

Thisys is aware of your privacy concerns and strives to collect only as much data as is required to make your Thisys experience as efficient and satisfying as possible, in the most unobtrusive manner as possible.

The security of your personal information is important to us. Everything you send us — your sign-in details, your surveys and your respondents' answers — travels over an encrypted TLS connection, and plain HTTP requests are redirected to HTTPS. We do not ask for card numbers or government identity numbers anywhere on this site.

We follow generally accepted industry standards to protect the personal information submitted to us, both during transmission and once we receive it. No method of transmission over the Internet, or method of electronic storage, is 100% secure, however. Therefore, while we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

If you have any questions about security on our Web site, you can reach us through Contact Us.

Our Roles: Controller and Processor

Thisys is operated by Thisys Technologies Pty Ltd (ABN 23 701 527 040, ACN 701 527 040) ("Thisys", "we"). For the account information you give us (your name, email address, sign-in details, billing details and how you use the service) we decide why and how it is processed: we are the "controller" under the EU and UK General Data Protection Regulation (GDPR) and the "APP entity" holding that information under the Australian Privacy Act 1988.

For the surveys you create, the responses your respondents give, the contact lists you upload and the reports you generate ("Customer Data"), you decide what is collected and why. You are the controller of Customer Data and Thisys is your "processor": we process it only on your instructions. If your organisation needs written data-processing terms, contact us at [email protected]. Your respondents should direct questions about a survey to you, its author; we will pass on any request we receive.

We do not sell Customer Data, use it for advertising, or use it to train artificial-intelligence models.

Survey creators are responsible for their own surveys. We do not decide what a survey asks, who it is sent to or what its author does with the responses afterwards, and we do not approve surveys before they go live. We do check the wording of each new survey link automatically, for requests such as passwords, PINs, card numbers or bank logins, and a person at Thisys reads the wording (never the responses) of a survey that check holds or that someone reports. The same check reads the emails a survey creator sends to other people through Thisys (invitations, reminders, messages and replies to a respondent), and a person at Thisys reads the subject and message of one it holds before it goes. Each survey creator is responsible for complying with the privacy, consent and spam laws that apply to the data they collect, and we are not responsible for how they use it. If you answered a survey and have a concern, contact the survey's author first. If you think a survey is being misused, write to [email protected]: we may look into it, remove the survey or suspend the account. None of this changes our own responsibilities for the data we hold on a creator's behalf.

Thisys is established in Australia. It has not appointed a representative in the European Union or the United Kingdom, or a Data Protection Officer. Privacy questions, requests and complaints from anywhere, including from individuals in the EU and UK, go to [email protected], which reaches us directly. If a representative or a Data Protection Officer is appointed, this policy will name them.

Why We Use Personal Information (Lawful Basis)

Where the GDPR or the UK GDPR applies to you, this is the lawful basis we rely on for each purpose. Under the Australian Privacy Principles the same purposes are the ones we collect the information for (APPs 3 and 6).

  • Running your account and the service you asked for (signing in, your surveys and reports, the AI features you use, support): contract. We need it to provide the service under our Terms of Service.
  • Billing, invoices, and tax and accounting records: contract, and legal obligation for the records the law requires us to keep.
  • Keeping the service secure and working (log files, the short-lived abuse-protection records, bot protection, the security and activity audit trail, the safety check of new survey links and of the emails customers send through Thisys, the abuse watch and the IP addresses staff block, the reports people make about a survey, finding and fixing faults): legitimate interests, our own and our customers', in a secure and reliable service.
  • Recording the IP address and approximate location of sign-ups, sign-ins and survey responses: legitimate interests, in keeping accounts and surveys free of fraud and misuse and in knowing where the service is used. For survey responses Thisys acts for the survey owner, who decides whether their links record it.
  • Service emails (the activation email, password resets, billing and plan notices, and announcements about the service): contract for the messages the service needs in order to work, and legitimate interests in telling account holders about their account and the service.
  • The setup emails in your first week: legitimate interests, in helping a new account get started. Each has a one-click link to stop them.
  • Product updates & tips: consent, which you give by ticking the box at sign-up or turning on Product updates & tips on the Notifications tab of your account, and can withdraw at any time in the same place or with the unsubscribe link in every one of them.
  • Counting how the service is used (the activity counts per account, Plausible Analytics, and how you found Thisys): legitimate interests, in knowing which parts of the product are used and which advertisements and pages bring customers. We use counts, not a profile of each person.
  • The referral programme: contract. It is a term of the programme you join.
  • Answering your questions, requests and complaints: legitimate interests, and legal obligation where a law requires an answer, such as a privacy request.
  • Telling former SurveyFace account holders that their account has moved, and keeping the do-not-mail list that stops us writing to an address again: legitimate interests, in continuing a relationship you already had with SurveyFace and in honouring every opt-out. We write only to people who had chosen to receive email from SurveyFace, and each message has an unsubscribe link.
  • Disclosing information when the law requires it, and establishing or defending a legal claim: legal obligation, and legitimate interests.
  • Customer Data (survey definitions, responses and contact lists): we process it as the customer's processor, on their instructions (see Our Roles above). The lawful basis for collecting it is the survey creator's to establish; Thisys uses it for no purpose of its own.

Australian Privacy Principles and Notifiable Data Breaches

We handle personal information in accordance with the Australian Privacy Principles (APPs) in Schedule 1 of the Privacy Act 1988 (Cth). In particular we collect only what we need to provide the service (APP 3), tell you how we use it in this statement (APP 5), use it only for that purpose or a related purpose you would reasonably expect (APP 6), keep it accurate and let you correct it (APPs 10 and 13), protect it with the measures described on our Security page (APP 11), and destroy or de-identify it when it is no longer needed.

Thisys takes part in the Notifiable Data Breaches (NDB) scheme. If personal information we hold is lost, or accessed or disclosed without authorisation, and a reasonable person would conclude that this is likely to result in serious harm to anyone it relates to, we will notify the affected individuals (or, for Customer Data, the customer who owns it) and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and describe what happened, what information was involved and what to do about it.

You may complain about our handling of your personal information by contacting us; we will acknowledge the complaint within 7 days and respond within 30. If you are not satisfied with our response you may complain to the OAIC at www.oaic.gov.au.

Where Data Is Stored and International Transfers

Thisys is hosted in Sydney, Australia, and your account information and Customer Data are stored there. Some of the service providers listed below process limited data outside Australia: transactional email, payments, the optional Google and Microsoft sign-in, and the AI features are handled in the United States, page-view counts are handled by Plausible Analytics in the European Union, the one-off email-address check for the SurveyFace move was run by its provider outside Australia, and requests to the site pass through our network and security provider's global network on their way to our servers. Where information leaves Australia we take reasonable steps under APP 8 to ensure the recipient handles it in a way consistent with the APPs, and for individuals in the EU and UK we rely on standard contractual clauses or an adequacy decision as required by the GDPR.

AI features send only what is needed for the task to our AI provider, Anthropic, over an encrypted connection, under commercial terms that prohibit training on it: usually text and figures worked out from survey answers (counts, averages and scores), and on the AI page a picture you attach (sent as the image itself) or the text of a file you attach, of which only the name is kept in your AI log. Analysis of survey responses by AI is off until the survey owner turns it on. The safety check of a new survey link sends the survey's own wording (its title, questions, options and messages) to the same provider, never its responses.

Dictation (the mic) uses your browser's own speech recognition: your browser's maker (for example Google in Chrome, Microsoft in Edge) may process the audio. Thisys receives only the text.

SurveyFace Accounts Moved to Thisys

Thisys is operated by the company that operated SurveyFace from 2012. In October 2026 the SurveyFace accounts were moved to Thisys under the same email address: each account's details, surveys, responses, address books (contact lists), files and logos were copied across, and the old SurveyFace servers were shut down. The account holder stays the controller of the surveys, responses and contact lists, and Thisys their processor, as described under Our Roles above. Old survey links on surveyface.com are forwarded to the same survey on Thisys, so a person who answers one is answering it on Thisys.

From 13 October 2026 we are writing to the email address on a SurveyFace account to tell its holder the account has moved, but only where the holder had chosen to receive email from SurveyFace. The messages go out in batches, not all at once. Each message has an unsubscribe link, and an address that has unsubscribed, bounced or reported an email as spam is not written to again.

Many of those addresses were years old, so before writing we ran them once through an email-address verification service, MillionVerifier, to find the ones that cannot receive mail. It was given email addresses only (no names, surveys or answers) and used once, in October 2026. An address it found undeliverable, or could not vouch for, was put on our do-not-mail list.

As a safeguard for the move, and so that we can restore a file or logo for an account holder who asks, an encrypted copy of the former SurveyFace data (the final database export, the uploaded files and the files respondents uploaded) is kept in separate off-site storage. Nothing else uses it. It is kept for up to 12 months from the move and then deleted as a whole.

Your Rights

You can access and correct your account information at any time in your account settings, and you can export every survey and its responses in CSV, Excel, SPSS or PDF, with an R analyst bundle and PowerPoint and Word reports. You can delete surveys, responses and contacts yourself (a survey you delete can be restored from Deleted surveys for 30 days before it is deleted for good), and you can close your account, after which your data is deleted from our live systems and, within 30 days, from backups — except the records listed under How Long We Keep Information, which are kept for the periods stated there.

Individuals in the EU, UK and other jurisdictions with similar laws also have the right to restrict or object to processing, to data portability, and to lodge a complaint with a supervisory authority. To exercise any right, contact us through the Contact Us page; we respond within 30 days, which is inside the one month the GDPR allows. If you are a respondent to a survey, your request is best directed to the organisation that ran the survey, as they control that data, and we will help them fulfil it.

How Long We Keep Information

  • Your account information: for as long as your account is open, then deleted as described under Your Rights.
  • Surveys, responses, contact lists and files (Customer Data): until you delete them, a survey's retention window deletes them, or you close your account. A survey you delete waits in Deleted surveys for 30 days, where you can restore it, and is then deleted for good with its responses; pages and questions you delete inside a survey wait in its trash for 14 days. Copies in our backups age out within 30 days. A new survey starts with a 24-month retention window, after which its older responses are deleted automatically; a survey that has no window (including a survey moved from SurveyFace) keeps its responses until you delete them.
  • IP addresses kept with an account's sign-up or most recent sign-in, or with a survey response that records a location: 90 days, then removed. An IP address stored with a response collected before location recording began stays for as long as that response.
  • The approximate location (the country, and the region and city where known): as long as the response, or the account, it belongs to.
  • Abuse-watch findings about an IP address: 90 days from when the address was last seen, then removed. An IP address that staff confirm as abusive is kept on a block list for up to 90 days and then removed.
  • Reports about a survey and the safety check's findings about it: kept with the reported survey and deleted with it. The answers to the Report a survey form are kept for 24 months, like any new survey's responses.
  • Emails we send (the outbox, including invitations and alerts): 90 days.
  • The security and activity audit trail (sign-ins, changes to settings and data): 365 days. It records who did what, so it is kept for that period even after the account it describes is closed, with the person's email address as it was at the time.
  • Conversations with the in-product assistant: 180 days. Requests made on the AI page or through the actions API, and the changes made for them (your AI log), are kept in full for 7 days on Free, 30 on Pro, 90 on Business and 365 on Enterprise; after that only which actions ran, whether they worked and the credits they used are kept, for 13 months. You can delete your AI log at any time. The AI page's conversation itself is kept for 7 days.
  • Billing: usage lines (what AI credits and answers were used) 365 days; purchases, invoices and payments for as long as tax and accounting law requires.
  • Records of AI work: each call we make to our AI provider, Anthropic (the time, which feature, the size of the request and what it cost us, not its content) and each finished AI job: 12 months. The questions and answers saved in a survey's Ask history, and a report you approve and keep, are part of the survey and last as long as the survey does.
  • Email delivery events (delivered, bounced, reported as spam, unsubscribed): 12 months.
  • Short-lived working records: the record of each alert we sent about AI spending, the record that a respondent declined a survey's consent notice (the survey, the time and an anonymous browser code, never answers) and the details of a "Build this for me" request: 90 days.
  • Webhook deliveries (the copy of each event sent to a webhook address, once it has been delivered or given up on): 7 days.
  • Webhook delivery log (each attempt with the event as it was sent, shown to the survey's owner with a Redeliver button): 30 days.
  • In-app notices (the bell): 90 days, read or not.
  • Support tickets and their conversation: for as long as the ticket is open, and for 2 years after its last update once it is resolved. Support tickets marked as spam are deleted after 2 years too, like resolved tickets.
  • Do-not-mail records: an email address that unsubscribed, bounced or reported our email as spam stays on our do-not-mail list, so that we do not write to it again, for as long as that protection is needed.
  • The encrypted archive of the former SurveyFace data (see SurveyFace Accounts Moved to Thisys): up to 12 months from the move, then deleted as a whole.

Children

Thisys accounts are for organisations and adults; we do not knowingly open an account for a child. Surveys run by our customers — for example schools — may be answered by children. For those answers the customer is the controller, and is responsible for any consent the law requires before a child takes part, such as a parent's or guardian's. If you believe a child has given us personal information directly, contact us and we will delete it.

Service Providers (Sub-processors)

We use a small number of third parties to run the service: our hosting provider in Australia, a network and security service (Cloudflare) that every request to the site passes through, an email delivery service for account and survey emails, a payment processor for paid plans (we never see or store your card number), the Google and Microsoft sign-in services for accounts that choose them, our AI provider, Anthropic, for the AI features, Plausible Analytics for cookie-free page-view and event counts, and MillionVerifier, which checked email addresses once for the SurveyFace move (October 2026). The current list, with what each one processes and where, is published on our Security page and is kept up to date.

Changes in this Privacy Statement

If we decide to change our privacy policy, we will post those changes to this privacy statement, the home page, and other places we deem appropriate so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it.

We reserve the right to modify this privacy statement at any time, so please review it frequently. If we make material changes to this policy, we will notify you here, by email, or by means of a prominent notice on our home page.

Contact Us

Thisys is Thisys Technologies Pty Ltd (ABN 23 701 527 040, ACN 701 527 040). For privacy questions, requests and complaints — including those under the Australian Privacy Principles and the GDPR — contact us at:

Privacy email: [email protected]

Contact form: Contact Us

Online Support: Online Help Centre

See also the Terms of Service.