Privacy Policy

1. Scope

SierraTec Secure LLC operates SierraTec Survey. This Privacy Policy explains how SierraTec collects, uses, discloses, retains, and protects personal information when people visit our websites, create or use accounts, administer workspaces, purchase subscriptions, contact support, participate in student verification, use integrations or AI features, or otherwise interact with SierraTec Survey.

This policy also explains SierraTec's role when customers use SierraTec Survey to collect survey responses. In many cases the customer decides why survey-response information is collected and SierraTec processes that information on the customer's behalf.

2. Our Privacy Roles

For account administration, billing, security, fraud prevention, marketing, support, product operations, and legal compliance, SierraTec may act as a controller, business, or equivalent responsible party under applicable privacy law.

For Customer survey-response data, the Customer generally determines the purposes and essential means of processing and SierraTec generally acts as a processor or service provider under the Customer's documented instructions. The actual role depends on the processing activity.

3. Information We Collect

• Account and profile information, such as name, email address, organization, role, and authentication information.
• Workspace and subscription information, such as plan, membership, billing status, entitlements, and administrative settings.
• Survey and respondent information submitted or collected through Customer use of the Service.
• Billing and transaction information, generally processed with payment providers.
• Student-verification information, such as institution, enrollment status, academic email, expected graduation date, and verification documentation.
• Support and communications information, including messages and customer-service records.
• Device, log, security, and usage information, including IP address, browser, operating system, timestamps, identifiers, and activity logs.
• Cookie and similar technology information as described in the Cookie Policy.
• Integration information received when a Customer connects a third-party service.
• AI prompts, inputs, outputs, and related usage information when AI features are used.

4. Survey Responses and Customer Content

Customers control the surveys they create and the information they request from respondents. Survey responses may contain personal information selected by the Customer or voluntarily supplied by respondents.

SierraTec processes Customer Content as necessary to provide, secure, maintain, troubleshoot, support, and operate the Service and as otherwise permitted by the applicable agreement.

5. How We Use Personal Information

• Provide and operate SierraTec Survey.
• Authenticate users and administer accounts and workspaces.
• Process subscriptions, billing, refunds, and plan entitlements.
• Provide support and respond to requests.
• Verify Student Research eligibility.
• Secure the Service, prevent fraud and abuse, and investigate incidents.
• Provide requested AI, analytics, research, export, integration, and collaboration functionality.
• Maintain, troubleshoot, and improve the Service consistent with applicable law and contractual commitments.
• Communicate service, billing, security, product, and policy information.
• Comply with law and enforce agreements.

6. Legal Bases Where Applicable

Where GDPR, UK GDPR, or another law requires a legal basis, SierraTec may rely on performance of a contract, legitimate interests, consent, compliance with legal obligations, or another legally available basis depending on the processing activity.

Customers are responsible for identifying an appropriate lawful basis for personal data they choose to collect through their surveys.

7. AI Processing

SierraTec may process prompts, survey content, and response information through AI features when a Customer elects to use those features. AI outputs may be inaccurate and should be reviewed by a person before important decisions are made.

Customers must not submit PHI, education records, or other highly sensitive regulated information to AI features unless SierraTec has expressly approved the relevant AI configuration for that use.

8. Student Verification

SierraTec may collect academic email addresses, institution information, enrollment evidence, expected graduation dates, and related information to administer the Student Research program and prevent fraud.

Unless longer retention is reasonably necessary for fraud prevention, dispute resolution, or legal obligations, SierraTec generally aims to delete uploaded student-verification documents within 90 days after the verification decision. A limited verification record may be retained while the subscription is active and for up to 24 months afterward.

9. Cookies and Similar Technologies

SierraTec may use cookies, local storage, pixels, scripts, tags, and similar technologies for essential functionality, security, preferences, analytics, and, if used, advertising or marketing.

Where applicable law requires consent for non-essential technologies, SierraTec will request the required consent before using them. Additional information is available in the SierraTec Survey Cookie Policy.

10. How We Share Information

• Service providers and subprocessors that provide hosting, storage, authentication, communications, customer support, analytics, AI, payment, security, and other infrastructure.
• Third-party services a Customer chooses to connect to SierraTec Survey.
• Workspace Owners and Administrators where information forms part of a managed workspace.
• Professional advisers, auditors, insurers, or financing parties where reasonably necessary.
• Authorities or other parties where disclosure is required or permitted by law or reasonably necessary to protect rights, security, users, or the public.
• A buyer, successor, or other relevant party in connection with a merger, financing, acquisition, reorganization, or sale of assets.

11. No Sale of Survey Responses

SierraTec does not sell Customer survey responses as a standalone data product. SierraTec should separately disclose any activity that constitutes a "sale," "sharing," or targeted advertising under an applicable U.S. state privacy law if such activity is introduced.

12. Third-Party Integrations

When a Customer enables an integration, SierraTec may send information to or receive information from that third party according to the Customer's configuration. Third-party services are governed by their own privacy practices.

13. Payment Information

Payments may be processed by third-party payment providers. SierraTec may receive transaction status, billing identifiers, payment method metadata, and related records but should avoid storing complete payment-card credentials unless necessary and appropriately secured.

14. Data Retention

SierraTec retains personal information only for as long as reasonably necessary for the purpose for which it was collected and for legitimate operational, security, contractual, tax, accounting, dispute-resolution, and legal requirements.

Retention periods may vary by data category, plan, workspace setting, contract, and applicable law. Deleted information may remain temporarily in backups or security records before deletion in accordance with SierraTec's retention practices.

15. Security

SierraTec uses administrative, technical, and organizational safeguards designed to protect personal information. No online system can guarantee absolute security. Additional information appears in the SierraTec Survey Security Policy.

16. International Data Transfers

SierraTec Secure LLC is based in the United States. Personal data may be processed in the United States and other countries where SierraTec or its authorized providers operate.

Where applicable law restricts international transfers, SierraTec will use an appropriate legally recognized transfer mechanism and supplementary safeguards where required.

17. GDPR and UK GDPR Rights

Subject to applicable law, individuals may have rights of access, correction, erasure, restriction, portability, objection, withdrawal of consent, and rights relating to certain automated decision-making.

If SierraTec processes survey-response information solely on behalf of a Customer, SierraTec may refer the request to that Customer or assist the Customer in responding.

18. U.S. State Privacy Rights

Where an applicable U.S. state privacy law applies to SierraTec, eligible residents may have rights to access, correct, delete, or obtain a portable copy of personal information and to opt out of certain processing such as a sale, targeted advertising, or profiling that produces legal or similarly significant effects.

SierraTec will provide one or more reasonably accessible methods for submitting eligible privacy requests and, where required, an appeal method. SierraTec may verify the identity or authority of the requester before acting on a request.

SierraTec does not sell Customer survey responses as a standalone data product. If SierraTec engages in an activity that constitutes a sale or sharing of personal information or targeted advertising under an applicable state law, SierraTec will provide the disclosures and opt-out mechanisms required by that law.

18A. Virginia Privacy Rights

Where the Virginia Consumer Data Protection Act applies, SierraTec will provide a reasonably accessible, clear, and meaningful privacy notice describing categories of personal data processed, processing purposes, consumer-rights procedures and appeals, categories of personal data shared with third parties, and categories of third parties that receive personal data.

Where required, SierraTec will obtain consent before processing sensitive personal data and will maintain reasonable administrative, technical, and physical security practices appropriate to the nature and volume of personal data processed.

18B. California Privacy Rights

Where the California Consumer Privacy Act, as amended, applies to SierraTec, California residents may have rights to know or access, correct, delete, and obtain information about certain disclosures, as well as rights to opt out of sale or sharing and to limit certain uses of sensitive personal information where those rights apply.

SierraTec will provide a notice at or before applicable collection points when required. That notice will identify the categories of personal information collected and the purposes for which they are used and will link to this Privacy Policy.

19. Children and Minors

SierraTec Survey is a general-audience business and research service and is not directed to children under 13 as account holders.

If SierraTec has actual knowledge that it is collecting personal information online directly from a child under 13 in circumstances covered by COPPA, SierraTec will apply applicable parental-notice, verifiable-consent, access, deletion, security, and data-minimization requirements. Customers that use SierraTec Survey to collect information from children remain responsible for determining and satisfying their own COPPA, educational, consent, and privacy obligations.

20. HIPAA and FERPA Data

SierraTec Survey is not automatically authorized for PHI under HIPAA. PHI must not be processed unless SierraTec has approved the applicable configuration and a required BAA is in place.

Educational institutions remain responsible for determining when FERPA applies. Where SierraTec processes education-record information on behalf of an institution, the applicable agreement and authorized educational purpose will govern that processing.

21. Marketing Communications

Users may opt out of promotional email where provided. SierraTec may still send transactional, security, billing, or service communications that are necessary to administer an account or subscription.

22. Privacy Requests and Appeals

Privacy requests may be submitted to info@sierratecsecure.com or through another privacy-request channel SierraTec publishes. SierraTec may verify identity or authority before completing a request.

Where applicable law provides an appeal right after denial of a privacy request, SierraTec will provide an appropriate appeal process.

23. Changes to This Policy

SierraTec may update this Privacy Policy as its services, vendors, technology, or legal obligations change. Material changes may be communicated through the Service, email, website notice, or another reasonable method.

24. Contact

Questions or privacy requests may be directed to SierraTec Secure LLC, SierraTec Survey, at info@sierratecsecure.com. SierraTec should confirm and publish its complete legal mailing address before launch.