Data Security & Privacy
How empiri handles personal data: who is responsible, what is processed and why, who receives it, how long it is kept and how to exercise your rights. This page is a draft pending legal review.
Draft — pending legal review
Controller & contact
The operator of empiri is [OPERATOR_LEGAL_NAME], [STREET_ADDRESS], [POSTAL_CODE_CITY], [COUNTRY].
Privacy contact for all requests: [PRIVACY_CONTACT_EMAIL].
EU representative (GDPR Art. 27): [EU_REPRESENTATIVE]
Data-protection advisor (nDSG Art. 10): [DATA_PROTECTION_ADVISOR]
Who is responsible for what
empiri is the controller for account holders, billing, this website, its own analytics and security logs.
empiri is a processor for everything an organization collects through its surveys: responses, participant lists, uploads and respondent metadata. There the organization is the controller, and empiri processes the data on its instruction under a data-processing agreement.
If you answered a survey, please read that organization’s own privacy notice for survey-specific questions, and address requests about your answers to the organization.
Data categories & purposes
Each processing activity below has its own legal basis under the GDPR (Art. 6(1)) and the Swiss nDSG (processing principles in Art. 6, transparency in Art. 19). The list matches the operator’s record of processing activities.
| Activity | Data | Legal basis |
|---|---|---|
| Accounts and sign-in | Name, email, password hash, two-factor secrets, passkey public keys, sessions (token, IP address, browser), language | Contract (Art. 6(1)(b)) |
| Account emails (verification, password reset, invitations) | Email address, name, message content, delivery events | Contract (Art. 6(1)(b)) |
| Billing and tax | Billing email and address, VAT ID, Stripe customer and subscription identifiers, status | Contract (Art. 6(1)(b)); legal obligation for invoice retention (Art. 6(1)(c)) |
| Security and abuse prevention | Keyed hash of the IP address for rate limits | Legitimate interest (Art. 6(1)(f)) |
| Server logs | IP address, URL, browser, time — never on survey pages | Legitimate interest (Art. 6(1)(f)) |
| Analytics of this website and the admin app | Sanitised page path, referrer origin, browser, OS and device class, screen size, language, country | Legitimate interest with a right to object (Art. 6(1)(f)); switch it off in Privacy settings |
| Support and correspondence | Email content, contact data, records of data-subject requests | Contract, legitimate interest or legal obligation (Art. 6(1)(b), (f), (c)) |
| Operator business metrics | Daily aggregate counts only; no personal data | Legitimate interest (Art. 6(1)(f)) |
| Encrypted backups | The data above, encrypted | Legitimate interest and security (Art. 6(1)(f), Art. 32) |
How data is protected
All respondent data, meaning answers and participant contact details, is encrypted in the database with application-level AES-256-GCM envelope encryption: a master key wraps a separate data key for each survey. The database and its dumps never see plaintext respondent content.
Capturing IP address, browser and device for respondents is opt-in per survey and individually configurable. A survey can run fully anonymous, in which case the application captures no such metadata anywhere. When enabled, it is encrypted with the survey’s key.
Deleting a survey destroys its key, which cryptographically shreds its responses. Deleting a single response is a physical delete, not a key destruction, because the response shares its survey’s key. In both cases the erased data remains in the encrypted backups for up to 30 days.
Backups are encrypted with a key stored separately from the dumps, so a backup is useless without that key. The application is hosted in Germany by Hetzner Online GmbH; the operator is based in Switzerland.
Recipients & sub-processors
empiri uses the sub-processors listed on the public page linked below. Participant invitation and reminder emails, including the recipient address and the message content, are sent through Resend (United States).
| Provider | Purpose | Data | Applies to | Location | Transfer mechanism |
|---|---|---|---|---|---|
| HetznerHetzner Online GmbH | Hosting of the application, database and uploads. | All data the service processes (hosting) | Both | Germany (entity and data centres) | Adequacy decision (no restricted transfer) Switzerland and the EU/EEA recognise each other’s data-protection level. |
| ResendResend, Inc. | Transactional email, including participant invitations and reminders. | Recipient address, message content, delivery status | Both | United States (entity) | Data Privacy Framework or Standard Contractual Clauses with Swiss addendum [VERIFY: Resend transfer mechanism] |
| StripeStripe Payments Europe, Ltd. / Stripe, Inc. | Subscription billing and payments. | Billing contact and address, VAT ID, subscription status; never respondent data | empiri as controller | Ireland (EU entity) and United States | Data Privacy Framework or Standard Contractual Clauses with Swiss addendum [VERIFY: Stripe transfer mechanism] |
| MetanetMetanet AG | Hosting of empiri’s self-hosted Umami analytics instance (stats.godstone.ch). | Website and admin-app visit statistics (cleaned page path, browser, device class, country); never survey or response data | empiri as controller | Switzerland | Adequacy decision (no restricted transfer) Switzerland is an adequacy country under the EU GDPR and the processing is domestic under the Swiss FADP, so no restricted transfer and no Standard Contractual Clauses are involved. |
| CloudflareCloudflare, Inc. | Authoritative DNS (not proxied, so no content traffic) and R2 storage for encrypted off-site backups. | DNS queries for empiri.ch hostnames; Age-encrypted backups (ciphertext only) | Both | DNS: global network. R2 backups: EU jurisdiction. Entity: United States. | Data Privacy Framework or Standard Contractual Clauses with Swiss addendum [VERIFY: Cloudflare transfer mechanism] |
See the full sub-processor list
Organizations can also configure integrations that send data on their own instruction. These are the organization’s recipients, not empiri sub-processors:
- DeepL — Machine translation, only when the organization enables it with its own key. Only authored survey text is sent, never responses. (Germany)
- Anthropic — Machine translation, only when the organization enables it with its own key. Only authored survey text is sent, never responses. (United States)
- Webhooks — Outbound notifications to endpoints the organization configures. Event data as configured by the organization, sent to the URL it chooses.
- API / MCP — Clients the organization authorizes with an API key, including MCP clients. Data the organization’s key is permitted to read or write.
International transfers
Switzerland and the EU/EEA recognise each other’s data-protection level, so hosting in Germany is not a restricted transfer.
Some sub-processors are based in the United States. Transfers rely on the EU–US and Swiss–US Data Privacy Framework where the recipient is certified, and otherwise on Standard Contractual Clauses with the Swiss addendum. The mechanism per recipient is shown in the sub-processor table above; entries marked for verification are still being confirmed by the operator.
Cloudflare stores only encrypted backups (ciphertext) in the EU jurisdiction.
Retention
These periods are the ones the platform enforces; the numbers below come from the same configuration the retention worker uses. Where an organization controls retention, it decides, and it can delete responses, surveys or the whole organization at any time.
| Data | Retention |
|---|---|
| Survey content (drafts, versions, logic, translations) | Decided by the organization: kept until it deletes the survey, or the organization is deleted. Deleting a survey destroys its encryption key (crypto-shred). |
| Responses, optional respondent metadata, edit revisions and uploaded files | Decided by the organization: kept until the response or the survey is deleted, or the organization is deleted. Deleting a single response is a physical delete; it shares its survey’s key. |
| Participant lists, reminder log and email outbox rows | Decided by the organization: kept until a participant is removed, the survey is deleted or the organization is deleted. |
| Uploads belonging to responses that were never submitted | Deleted 90 days after creation. |
| Sign-in sessions | Valid for 7 days, renewed on activity; deleted within 24 hours after expiry. IP address and browser details are removed from any session older than 30 days. |
| Email-verification, password-reset and account-deletion tokens | Deleted 24 hours after they expire. |
| Organization invitations (invitee email) | Expire 48 hours after creation; deleted 30 days after expiry, whatever their status. |
| User accounts | Until the account holder deletes the account (or the operator does). Account deletion takes effect immediately after you confirm by email; there is no grace period. |
| Organizations | After deletion is requested: a 30-day reversible grace period, then permanent deletion within 24 hours. Ending or cancelling a subscription does not delete the organization or take it offline; it only changes the plan. Deletion happens only when an Owner requests it (or the operator does). |
| Rate-limit counters (keyed hash of the IP address) | Deleted after 24 hours. |
| API idempotency keys | Deleted after 24 hours. |
| Webhook delivery records | Deleted 30 days after delivery or final failure. |
| Billing records (subscription status and billing events) | For the lifetime of the organization. Stripe keeps its invoices under its own legal duty, and the operator keeps an accounting copy for 10 years (Swiss Code of Obligations, Art. 958f). |
| Builder presence (who is currently editing a survey) | At most 10 minutes. |
| API keys (revoked keys stay as an audit record without secret), webhook endpoints and deletion records | For the lifetime of the organization. |
| Platform usage counts | Kept indefinitely: platform-wide counts only, no personal data. |
| Encrypted backups (local and off-host) | Rolling 30 days. Erased data, including a deleted survey’s wrapped key, remains in the encrypted backups for up to 30 days. |
| Server logs | Size-limited rotation; retention period [LOG_RETENTION]. Logs never contain answers or participant identities. Respondent IP addresses stay out of the logs only while the reverse proxy’s access log is suppressed [OPERATOR_VERIFY_TRAEFIK_ACCESS_LOG]. |
Your rights & how to exercise them
You can ask for access (GDPR Art. 15, nDSG Art. 25), rectification, erasure, restriction, data portability (GDPR Art. 20, nDSG Art. 28) and you can object to processing based on legitimate interest, including analytics, or withdraw consent at any time.
Email the privacy contact. We check your identity in proportion to the request and answer within 30 days.
If your request concerns answers you gave in a survey, the organization is the controller. empiri forwards such requests it receives to the organization without undue delay.
Right to complain
In Switzerland you can complain to the Federal Data Protection and Information Commissioner (FDPIC), Bern: edoeb.admin.ch
If you live in the EU/EEA you can also complain to the supervisory authority of your habitual residence: EDPB list of supervisory authorities
Analytics
empiri uses a self-hosted Umami instance to count visits to this website and the admin app. It measures the page path (cleaned of identifiers), the referrer’s origin, browser, operating system and device class, screen size, language and the country, which Umami derives from the IP address without storing it.
It uses no cookies and no cross-site identifiers. The data it sends carries no user, organization or survey identifiers (the page path is reduced to a template), and it never runs on survey pages or the survey preview.
Like any request your browser makes, loading the tracker and sending a visit shows the analytics host the browser’s standard Origin header; for the admin app that is the organization’s subdomain. empiri does not store it or add it to any analytics data, and nothing in the data we receive links it to a person. No referrer is sent.
Mode: analytics is on unless you switch it off (opt-out). It is based on our legitimate interest. You can object at any time in Privacy settings, and a Do Not Track or Global Privacy Control signal from your browser keeps it off.
The analytics host is stats.godstone.ch, an operator-run, self-hosted Umami on a separate domain from empiri.ch.
It is hosted by Metanet in Switzerland. Raw events are kept for up to 1 year.
To change your choice, use “Privacy settings” in the footer of any page.
Changes to this notice
This notice applies from [EFFECTIVE_DATE].
We announce material changes to account holders by email.