1. Who is the data controller
ProdForm is operated by ProdForm AS, organisation number 938 601 887, registered in the Norwegian Register of Business Enterprises (Ortugrenden 9, 5143 Fyllingsdalen, Norway). ProdForm AS is the data controller for personal data about customers (organisations using the platform) and visitors to prodform.com. For participant data collected through a test, the customer is the controller and ProdForm acts as processor. The relationship is governed by a Data Processing Agreement (DPA) which forms part of the Terms.
2. Personal data we collect
Account data: name, email, organisation, role. Enquiries: name, email and company when you request a demo or contact us. Usage data: tests you create, settings, login timestamps, and which pages and features you use, counted per day and linked to your account. Technical data: IP address, browser type, device type, cookie consent state. Participant data (stored on behalf of the customer): test answers, optional demographic fields, participant code or email if the test requires identification, and location if the customer has turned on location collection. We never collect special categories (health, biometrics, religion, political views) unless the customer explicitly configures it and obtains separate consent.
3. Purpose and legal basis
Account data is processed to deliver the service (contract, GDPR Art. 6(1)(b)). Enquiries are processed to respond to your request (legitimate interest, Art. 6(1)(f)). Usage and technical data is processed to operate, secure and improve the platform (legitimate interest, Art. 6(1)(f)); this includes error tracking and visit statistics without cookies. Analytics cookies and recording of clicks and scrolling are used only with your consent (Art. 6(1)(a)), which you can withdraw at any time. Participant data is processed on behalf of the customer – the legal basis is set by the customer, typically consent from the participant before the test starts.
4. Who processes the data (sub-processors)
ProdForm uses the following processors: Supabase (database, auth, file storage – EU region), Vercel (hosting, CDN and visit statistics without cookies), Resend (email), Sentry (error logging), Anthropic (AI features – only when you explicitly use AI tools). All have signed data processing agreements. If you have consented to analytics, Microsoft Clarity is also used to record clicks and scrolling; Microsoft is itself the controller for that data. An up-to-date list of sub-processors is available at prodform.com/subprocessors. Customers are notified at least 30 days before we onboard new sub-processors that handle personal data.
5. Transfers outside the EEA
Primary data is stored in the EU, including error logging with Sentry (Germany). Three vendors process data in the US: Anthropic when you use the AI features, Resend, which stores email metadata and logs there, and Microsoft Clarity if you have consented to analytics. The transfer to Anthropic relies on the EU Commission's Standard Contractual Clauses (SCC) supplemented by one technical safeguard: participant identifiers are not sent, and the data is not used for model training. The transfer to Resend relies on the EU–US Data Privacy Framework and the Standard Contractual Clauses, and the transfer to Microsoft on the Data Privacy Framework. We assess transfers continuously against current case law.
6. How long we retain data
Active tests: data is stored as long as the test runs. Closed tests: participant responses tied to identifiers are kept for 24 months after closure, then anonymised – the link between response and person is permanently removed. Anonymised aggregate data may be kept indefinitely. User and organisation accounts are kept while active and deleted within 30 days after termination (backups are overwritten in line with the provider's fixed rotation). Usage data about which pages and features you use, and the account activity log, are kept for 12 months. Other logs and technical data are kept for up to 90 days.
7. Your rights
You have the right to access, rectify, erase ("the right to be forgotten"), restrict, port and object to processing. You can withdraw any consent you have given at any time. Participants with an account have self-service tools for access and erasure on the participant page when logged in. For account data and enquiries: send a request to contact@prodform.com – we respond within 30 days. You can lodge a complaint with the Norwegian Data Protection Authority (datatilsynet.no) or your local supervisory authority if you believe we process your data in breach of GDPR.
8. Security
We use encryption in transit (TLS 1.2 or later) and at rest (AES-256 on database files, indexes and write-ahead logs). Internal access to personal data is role-based, and changes made by administrators are logged with user, timestamp and action. Isolation between customers is enforced in the application layer, with Row Level Security in the database as an additional layer on queries made directly from the browser. Access to customer data is limited to ProdForm's owners, who are bound by confidentiality. Should anyone else be given such access — employee, contractor or sub-processor — it is granted only after a written confidentiality undertaking. Breaches of personal data security that affect a customer's data are reported to the customer without undue delay and at the latest within 24 hours, as set out in the data processing agreement.
9. Minors and age limit
ProdForm is not intended for persons under 16. Test organisation accounts require the user to be at least 18. Participants must be at least 16 to give valid consent without parental approval. Tests aimed at participants under 16 require a separate agreement with ProdForm.
10. Changes to this policy
We may update this policy when the service or applicable law changes. Material changes are notified by email to registered users at least 30 days before they take effect. The date at the top shows when the policy was last changed. Earlier versions are available on request.