Privacy Policy

1. Who we are

During the current internal closed beta, The Little Ask is used only on websites operated by Nettbureau. The external-customer terms in section 2B and the Data Processing Agreement will apply once outside customers are invited.

The Little Ask is a website feedback service in closed beta, operated by Nettbureau AS (organisation number 997 104 854), Kjølberggata 31, 0653 Oslo, Norway ("Nettbureau", "we").

2. Our two roles

• A — Data controller for information about people who use the The Little Ask dashboard (account, sign-in and administration data). We decide how this is used.
• B — Data processor for survey answers collected on customers' websites. The customer (the website operator) decides to run surveys, chooses the questions and decides how answers are used; we process them on the customer's documented instructions under our Data Processing Agreement.

If you answered a survey on someone else's website, that website's operator is responsible for your answers and is your first point of contact.

3. A. Account information (Nettbureau as controller)

Accounts are created by invitation only. We collect:

• your email address, and a password if you set one (stored hashed by our authentication system — we cannot read it);
• if you sign in with Google: the name, email address and profile picture Google shares with us;
• your workspace membership and role, and content you create (sites, campaigns, review statuses);
• technical sign-in records kept by our authentication system for security.

Why and on what basis: to provide the service you or your organisation signed up for (contract, GDPR Art. 6(1)(b)), and to keep it secure, send invitations and password resets, and administer it (legitimate interests, Art. 6(1)(f)). We do not sell this data or use it for advertising.

4. B. Survey data (Nettbureau as processor)

When a visitor answers a survey, we store for the customer:

• the options chosen and any text typed into the survey;
• the page path (query strings removed; email-like text and long numbers stripped), device type and survey language;
• counts of when a survey was shown or closed, and when the script was last loaded on the site (host and page path).

We do not collect what visitors type into the website's own forms, session recordings, heatmaps or browser fingerprints, and we do not store visitors' IP addresses with answers. To prevent abuse, a one-way hash of the IP address is used as a short-lived rate-limit counter, kept separately from answers. Free-text answers can still contain personal information if a visitor writes it, so responses are not described as anonymous.

5. How data flows

1. A customer adds our script to its website.
2. A visitor's browser downloads the script and the site's published survey settings from our servers. Requests are only accepted from the customer's approved domains.
3. If the visitor sees, closes or answers a survey, that event and answer are sent to our backend.
4. The customer's team reads the answers in the dashboard, and can export them as CSV.

6. Cookies and local storage

We use no analytics, advertising or tracking technologies, and set no tracking cookies.

• On customers' websites: our script keeps a random visitor ID and display counters in local storage so a survey isn't shown too often, and uses session storage to remember for that session that a form was submitted or a preview is active. This record is reset after 12 months. Customers can make the script wait for consent: until consent is given, nothing is stored in the visitor's browser, no survey is shown and no events or answers are sent. Without consent the script only downloads the site's survey settings, which is an ordinary request to our servers.
• On thelittleask.com: your sign-in session is kept in local storage. Fonts are served from our own servers; our pages load nothing from Google unless you choose “Continue with Google”.

7. Service providers and where data is stored

The database, including sign-in data and survey answers, is stored in Ireland (AWS eu-west-1). We use no analytics provider. We use these providers:

International transfers. The database is stored in Ireland, but we do not claim that all data stays in the EU/EEA. Cloudflare may handle requests (including survey answers in transit) in data centres outside the EU/EEA, and Lovable, Supabase, Cloudflare and Google are US-headquartered companies that may access data from outside the EU/EEA, for example for support or security. These transfers rely on the safeguards in each provider's data processing terms — typically the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses [confirm the safeguard for each provider — for legal review — administrator to confirm].

Access to workspace data is restricted to its members, and connections are encrypted in transit. Like most web services, our hosting providers keep short-lived technical request logs, which include IP addresses; we do not copy these into our database.

8. Retention and deletion

• Survey responses: kept for 12 months by default. A workspace owner can choose a shorter period (minimum 30 days), but not a longer one. Every night, responses older than the workspace's period are deleted automatically, together with their answers and the related display and close events. Owners can also delete individual responses at any time. Totals shown in reports and weekly emails are calculated from the stored responses, so they go down when responses are deleted; no separate copy is kept.
• Visitor storage on customers' websites: the random visitor ID and counters in the visitor's browser are discarded and recreated after 12 months.
• Accounts: kept while you have access. During the beta, a workspace owner deletes an account on request — see section 9.
• When a customer leaves, we delete or return its survey data as set out in the Data Processing Agreement.

9. Deletion and privacy requests during the beta

During the closed beta, requests are handled manually by Nettbureau staff:

1. Send your request to [privacy@thelittleask.com — not receiving email yet; until then write to Nettbureau AS, Kjølberggata 31, 0653 Oslo, Norway — administrator to confirm], saying what you want (access, correction, deletion or a copy) and which account or website it concerns.
2. We confirm who you are. For accounts we reply to the account's email address. For survey answers we cannot reliably identify a visitor, so we pass the request to the website operator, and help it find answers by page, time or wording.
3. We act on it — for example deleting the account and its sign-in record, the workspace with its sites, campaigns, responses and invitations, or specific responses.
4. We confirm back to you when done, without undue delay and within one month at most (as the GDPR requires; complex requests may be extended by up to two further months, with notice).

Backups kept by our hosting provider may hold deleted data for a short period before they expire.[confirm backup retention period — administrator to confirm]

10. Your rights

Under the GDPR you can ask for access to, correction or deletion of your personal data, restriction of or objection to its use, and a portable copy. You can complain to the Norwegian Data Protection Authority, Datatilsynet, or your local authority. For survey answers, contact the website operator; we help customers respond.

11. Contact and changes

Nettbureau AS, Kjølberggata 31, 0653 Oslo, Norway. Privacy questions: [privacy@thelittleask.com — not receiving email yet; until then write to Nettbureau AS, Kjølberggata 31, 0653 Oslo, Norway — administrator to confirm].

We may update this policy; we'll change the date above and notify workspace owners of significant changes. See also the Terms of Service.