Privacy Policy

Last updated: November 2026

Opinzo.app is a service for collecting feedback through links, QR codes and a button on websites. It is operated by SimplyPulse AB. This policy explains what personal data is processed, why, how long it is kept and what rights you have.

In short: we only collect what the service needs, everything is stored in the EU, the feedback forms set no cookies, we never sell personal data and we don’t use it for marketing.

1. Who is responsible

SimplyPulse AB
Registration number: 559513-3561
Göteborgsvägen 46, 431 37 Mölndal, Sweden
Email: hello@opinzo.app

• We are the controller for accounts of admins, for visitors to our website and for our contact with customers.
• The organization that asks for your feedback is the controller for what you send it. It decides what it asks and how long the answers are kept, and we process them on its behalf under our Data Processing Agreement.

2. If you are an admin

• Your account – name, email address and language. We use the address to send login codes, invitations and the notifications you have chosen.
• The organization – name, country, time zone and contact email.
• Logged-in devices – a short description such as “Firefox on Windows”, and when the device logged in and was last active. You can see these and log them out under My account.
• A log of important events – such as logins, invitations, exports and deletions, with who did it and a short device description. It contains no feedback.
• What you create – channels, their questions and settings, logos, internal notes and the replies you send.

There are no passwords. Login codes are stored only as one-way hashes and stop working after 10 minutes.

3. If you give feedback

You don’t need an account, and the form sets no cookies. What is stored is what you send:

• Your answers – text, ratings and a category, with the time and the language of the form.
• Your name and email address, but only if the form asks for them and you choose to fill them in. They are always optional. Without them, your feedback is anonymous to the organization.

Only the organization’s admins see your feedback. If you gave your email address, the organization can reply to you. The reply comes from Opinzo on the organization’s behalf, and your answer goes to the organization. We send you no other emails, and never marketing.

If you have questions about your feedback, or want it changed or removed, contact the organization that asked for it. If you contact us, we will pass your request on to them.

4. The feedback button on other websites

An organization can add our feedback button to its own website. The button is loaded from opinzo.app and opens the form in a frame on that page. It sets no cookies, stores nothing in your browser and does not follow you across websites. Like any web request, loading it reaches our servers with your IP address (see section 7).

5. Payments

Payment is handled by Paddle.com Market Ltd (“Paddle”), which is the seller and merchant of record. Paddle collects your payment details and is an independent controller of them, and it may transfer payment data outside the EU. See Paddle’s privacy policy. We never see your card details. We only store Paddle’s customer and subscription references, your plan and the dates of the paid period.

6. Cookies

The feedback forms and the feedback button set no cookies at all. In the app and on our website we only use cookies that the service needs in order to work, which is why we don’t ask for consent. There are no analytics, advertising or tracking cookies.

When you pay, Paddle’s checkout opens on our subscription page. Paddle may set its own cookies for the payment.

7. Technical information and statistics

To protect the service against abuse – for example, someone sending a form hundreds of times – we limit how many attempts can be made from the same IP address. We don’t store the IP address for this – only a one-way hash whose key changes every day. It can’t be traced back to an address or linked across days, and it is deleted after two days. Feedback is never stored with an IP address.

As with any web service, our hosting provider keeps technical logs that may include IP addresses. They are used to run and secure the service. Our own error logs are deleted after 30 days.

On our public website – the start page, features, pricing, support and these policies – we use Umami Analytics to count visits. Umami sets no cookies, stores nothing in your browser, does not keep IP addresses in its statistics and does not follow visitors across other websites. It is not used in the app, on the feedback forms or in the feedback button.

8. Why we process the data

• To provide the service to the organization and its admins. Legal basis: contract (Article 6(1)(b) GDPR).
• To protect the service – limit abuse, keep it secure and log important events. Legal basis: legitimate interest (Article 6(1)(f)).
• To improve the service – anonymous visitor statistics on the website. Legal basis: legitimate interest (Article 6(1)(f)).
• To fulfil legal obligations, such as bookkeeping. Legal basis: legal obligation (Article 6(1)(c)).

For feedback, the organization decides the purposes and has its own legal basis, usually legitimate interest in learning what people think, or your consent when you choose to leave your name or email address. Service emails about your account are not marketing.

9. How long we keep the data

• Accounts – until you delete your account under My account, which takes effect at once.
• Organizations – until the owner deletes the organization. It can be restored for 30 days and is then deleted for good, with its channels, feedback, notes, logos and event log.
• Feedback – until the organization deletes it, or deletes the channel it came through. On the Free plan, an archived channel is deleted with its feedback 24 months after it was archived, after a warning to the organization’s admins.
• Sessions and login codes – deleted once they have expired.

Deleted data is removed from the database at the time stated. Our hosting provider’s backups may still contain it for a short while, until they are overwritten. We keep information about payments for as long as bookkeeping rules require.

10. Who has access to the data

We never sell personal data. The data is stored with our hosting provider in Sweden, which also delivers our emails. It processes the data on our behalf under a data processing agreement, and it is named in the Data Processing Agreement. We may have to disclose data to public authorities where the law requires it.

11. Where the data is stored

Accounts, channels and feedback are stored on servers in Sweden, within the EU, and are not transferred outside the EU/EEA.

The visitor statistics (section 7) are processed by Umami Software, Inc., a US company, under a data processing agreement. Its service may process this data in the United States as well as in the EU. The statistics contain no names, email addresses or feedback. Paddle’s processing is described in section 5.

12. Security

All traffic is encrypted with TLS (https). There are no passwords that could leak, and login codes are only stored as one-way hashes. Each organization’s data is kept separate, the app’s forms are protected against forged requests, and the number of attempts is limited.

13. Your rights

Under the GDPR you have the right to:

• access the data held about you,
• have inaccurate data corrected,
• have data erased,
• receive your data in a machine-readable format,
• object to processing based on legitimate interest,
• lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se, or the authority where you live.

Admins can do much of this themselves under My account and Settings → Data. Respondents should contact the organization that asked for their feedback (see section 3). For anything else, email hello@opinzo.app. We reply as soon as we can, and within one month at the latest.

14. Children

Admin accounts are for adults. Respondents may be children, for example pupils evaluating a course. In that case the organization is responsible for having a legal basis and for informing them and, where needed, their guardians, and should not ask for more than it needs – leaving out the name and email fields, for example.

15. Changes to this policy

We may update this policy. The date of the latest change is always shown at the top. For significant changes we will give notice here on the website, and tell admins by email.