1. Who We Are (Data Controller)

Intellimark Group LLC, located at Atlanta, GA, USA, is the data controller for personal data processed through the Platform. For questions about this policy or your data, contact us at contact@intellimark.net.

2. What Data We Collect

Anonymous surveys: When a survey is configured as anonymous, we strip all personally identifiable information including IP address, browser info, location, UTM parameters, and referrer. Only device type and source channel are retained for aggregate analytics.

3. Legal Basis for Processing (GDPR Art. 6)

We process personal data under the following legal bases:

• Consent (Art. 6(1)(a)) — Survey responses, location collection, analytics cookies
• Contract performance (Art. 6(1)(b)) — Account management, service delivery
• Legitimate interest (Art. 6(1)(f)) — Security, fraud prevention, platform improvement
• Legal obligation (Art. 6(1)(c)) — Tax records, regulatory compliance

4. How We Use Your Data

• Deliver and operate the Platform and its features
• Process and analyze survey responses for our clients
• Send transactional emails (survey invitations, notifications, GDPR requests)
• Improve the Platform through anonymized usage analytics
• Enforce security measures and prevent abuse
• Comply with legal obligations

We do not sell personal data. We do not share personal data with third parties for marketing purposes.

5. Data Sharing & Subprocessors

We share data only with processors necessary to operate the Platform:

All processors are bound by data processing agreements (DPAs) with appropriate safeguards for international transfers.

6. Data Retention

• Account data: Retained while your account is active; deleted within 30 days of account closure
• Survey responses: Retained for the duration of the survey project; deleted on client request or GDPR erasure
• Analytics data: Aggregated and anonymized after 26 months
• Audit logs: Retained for 7 years (SOC 2 / ISO 27001 compliance); PII anonymized on deletion requests
• Cookies: Session cookies expire on browser close; consent cookie retained for 12 months

7. Your Rights (GDPR Articles 15-22)

If you are in the EU/EEA, you have the right to:

• Access (Art. 15) — Request a copy of your personal data
• Rectification (Art. 16) — Correct inaccurate data
• Erasure (Art. 17) — Request deletion of your data (“right to be forgotten”)
• Restriction (Art. 18) — Restrict processing of your data
• Portability (Art. 20) — Receive your data in a machine-readable format
• Object (Art. 21) — Object to processing based on legitimate interest
• Withdraw consent (Art. 7) — Withdraw consent at any time without affecting prior processing

To exercise these rights, submit a request at hub.intellimark.net/privacy/data-request or email contact@intellimark.net. We respond within 30 days.

8. Cookies & Analytics

We use strictly necessary cookies for authentication and a consent cookie to remember your analytics preference. Analytics cookies (Matomo) are only loaded after you give explicit consent via our cookie banner. Matomo is self-hosted — no data is shared with third parties.

You can change your cookie preference at any time from the Legal & Privacy page.

9. Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Row-level security (RLS) for multi-tenant data isolation
• JWT-based authentication with Clerk (JWKS rotation)
• Rate limiting (tier-based), CSRF protection, security headers
• PII auto-detection and tagging on survey questions
• Immutable audit logs with PII anonymization on deletion
• Regular security reviews aligned with SOC 2 Type II and ISO 27001

10. International Data Transfers

Our primary infrastructure is hosted in the EU (Hetzner, Germany). Where data is processed outside the EU (e.g., Clerk for authentication, Groq for AI analysis), we rely on Standard Contractual Clauses (SCCs) and ensure processors maintain adequate safeguards.

11. Children

The Platform is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at contact@intellimark.net.

12. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act. We do not sell or share personal information as defined by the CCPA. You may request access to or deletion of your data using the same process described in Section 7.

13. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via the Platform or email. The effective date at the top of this page indicates when the policy was last updated.

14. Contact