Last Modified: Oct 26, 2026
Last updated: 26 October 2026
QPoint is a web-based tool for creating online forms, collecting responses, and analyzing data. It is developed and operated by Q-Bit d.o.o. ("QPoint", "we", or "us"), the data controller for the information described in this Privacy Policy.
This Privacy Policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the rights you have. It covers both our website (qpointsurvey.com) and our application (app.qpointsurvey.com). It also applies if you are invited as a team member by someone who already uses QPoint.
We will not share personal information about you with third parties without a lawful basis, and we take protecting your data seriously. If anything in this policy is unclear, write to us at support@qpointsurvey.com.
Q-Bit d.o.o.
Ilica 175b, 10 000 Zagreb, Croatia
Email for privacy requests: support@qpointsurvey.com
To create an account, you provide your full name, email address, and a password. Your password is stored using one-way encryption. For paid plans you also provide billing details: country, address, VAT (for companies), and payment method details, which are handled by our payment processor Braintree (a PayPal company).
When you visit our website or use the app we automatically collect technical information: IP address, device type, browser type, operating system, and approximate location. We use this to run the service, keep accounts secure, and improve the product.
We collect information from third parties only when you give them permission to share it with us, or when you have made that information publicly available.
We use the data we collect to:
provide, maintain and improve QPoint;
process payments and manage your subscription;
respond to support requests and troubleshoot issues;
detect, prevent and investigate abuse or unauthorized access (for example, flagging a sign-in from an unexpected IP);
send product updates and occasional marketing emails you can opt out of at any time;
comply with our legal obligations.
We do not sell your personal information.
QPoint runs on infrastructure provided by Hetzner Online GmbH in Falkenstein, Germany - inside the European Union. Payment details are handled by our payment processor Braintree (a PayPal company); we do not store full card numbers on our servers.
You can update most of your account information yourself in Settings. To delete your account or request a full export, email support@qpointsurvey.com. We will respond within 30 days.
Data you collect through your own forms belongs to you. Your forms are private by default - no other QPoint user can see them or the responses. They become reachable only through the link you choose to share. We do not sell or reuse your forms or the data in them.
If you export data from QPoint, what happens to it afterwards is your responsibility. Your form data is kept for as long as you have an account, and you can delete it at any time. If you share a form publicly, remember that search engines may index the page; we cannot remove content from search engines on your behalf.
You can import email addresses into your personal Contact List to invite people to your forms. We do not use those addresses for our own purposes, do not email them ourselves, and do not share them with third parties.
If you are filling in a form built with QPoint, the form creator is the controller for that form and its responses. Questions about why the form is collecting data, how long it is kept, and how it is used should go to the form creator - not to QPoint.
Whether a response is anonymous depends on what the creator asks for. QPoint stores the responses as a processor on their behalf. We also store technical details with each response: the respondent's IP address, basic browser details, and an approximate location derived from the IP address (country, region, city and coordinates). The form creator can limit what is collected per form in their form settings.
Form creators may also add their own tracking to a form - for example, their own Google Tag Manager or Google Analytics ID. Any tracking a creator adds this way is their responsibility and is governed by their own privacy policy, not this one.
QPoint's own analytics and marketing tools (listed below) do not run on forms our customers publish. Respondents are not tracked by Google Analytics, Hotjar, FullStory, Google Ads or Tawk.to when they fill in a customer's form.
For email campaigns sent through QPoint, the form page sets one technical cookie, bic, which stops the same person being counted twice. It stores a scrambled code derived from the respondent's browser and IP address and lasts 7 days. This processing happens on behalf of our customer (the form creator), who is the controller.
By default, only strictly necessary cookies run when you visit our website or app. Everything else - live chat, analytics, marketing - runs only after you accept it in our cookie banner.
The banner has four categories:
Strictly necessary - always on
Live chat
Analytics
Marketing
You can "Accept all", "Reject all", or pick categories individually. Your choice applies to both qpointsurvey.com and app.qpointsurvey.com - you only make it once.
You can change or withdraw your choice at any time via Cookie Settings: a link in the website footer, and inside the user menu in the app. Withdrawing consent for a category deletes that category's cookies.
Your choice is stored for 6 months, after which we ask again. We also ask again whenever we add a new tool.
Legal basis. For every non-essential category, the legal basis is your consent under Article 6(1)(a) of the GDPR, together with the cookie rules in the Croatian Electronic Communications Act. Strictly necessary cookies rely on our legitimate interest in running the service (Article 6(1)(f)).
Strictly necessary
qp_consent (QPoint) - stores your cookie choice. Duration: 6 months.
xqp_auth (QPoint app) - keeps you signed in. Duration: session / until sign-out.
Website visit logging
ent_fm_GUID (QPoint website / CMS) - set by our content platform on your first visit so we can tie visits together. The CMS stores each visit's IP address, browser, referrer and traffic source alongside this identifier. Duration: 180 days. Legal basis: our legitimate interest in understanding how the website is used (Article 6(1)(f) GDPR). You can object to this processing by emailing support@qpointsurvey.com.
Live chat
__tawkuuid, twk, TawkConnectionTime (Tawk.to) - support chat on the website. Duration: up to ~6 months.
Analytics
_ga, _ga_S4G67V4W55 (Google Analytics 4) - usage statistics. Duration: up to 2 years.
_hjSessionUser_816417, _hjSession_816417 (Hotjar) - usage and heatmap analysis on the website. Duration: 1 year / 30 minutes.
fs_uid and other fs_ cookies (FullStory) - session analysis on the website and app. Duration: up to 1 year.
ProfitWell (Paddle) - product and retention analytics in the app. Duration: per vendor.
wootric* (Wootric / InMoment) - in-app feedback and NPS surveys. Duration: per vendor.
Marketing
_gcl_*, IDE, test_cookie (Google Ads) - ad measurement and remarketing on the website. Duration: up to ~13 months.
Durations above are the vendors' standard defaults. For the exact current values, see each provider's documentation.
Analytics tools in the app - Google Analytics, FullStory, ProfitWell and Wootric - run only if you have given consent to the Analytics category in our cookie banner.
There is one exception. When someone creates a new account, our server sends a single event called visitor_signup to Google Analytics so we can count sign-ups. This event:
stores nothing on your device;
sends no name or email - only a random one-off identifier, or your Google Analytics ID if you have already consented to Analytics;
is linked to your Google Analytics visit only if you have consented to Analytics.
The legal basis for this single event is our legitimate interest in knowing how many accounts are created (Article 6(1)(f) GDPR). You can object to it at any time by emailing support@qpointsurvey.com.
To run QPoint we rely on a small number of service providers who process personal data on our behalf:
Hetzner Online GmbH (Germany) - hosting of our production servers.
Braintree, a PayPal company - payment processing.
Mandrill / Mailchimp Transactional (Intuit) - delivery of transactional and account emails sent by the app.
OpenAI - processes the text of your prompt when you use the "Create from AI" feature to generate a form.
Google (Google Analytics 4, Google Ads) - analytics and advertising.
Hotjar - website usage and heatmap analysis.
FullStory - session analysis on the website and app.
Tawk.to - live chat support on the website.
ProfitWell / Paddle - product and retention analytics in the app.
Wootric / InMoment - in-app feedback and NPS surveys.
Our production servers are hosted inside the European Union. Some of the other providers above process data outside the European Economic Area, mainly in the United States. Where a provider is certified under the EU-U.S. Data Privacy Framework, we rely on that certification. Where it is not, we rely on the European Commission's Standard Contractual Clauses (SCCs), together with supplementary measures where appropriate. Each provider's current transfer basis can be verified in their own documentation.
Our website also loads a few resources from third-party content delivery networks - Google Fonts, cdnjs (Cloudflare) and the Bootstrap CDN. These receive your IP address when the page loads so the files can be served. The homepage also loads a SourceForge review badge, which likewise receives your IP address.
We keep your personal data only as long as we need it:
Account data - for as long as your account exists, plus a short period after deletion for backups and legal reasons.
Billing and tax records - for the period required by Croatian law (typically 11 years for invoices).
Form responses - for as long as the form creator keeps them.
Cookies - for the durations listed above.
Google Analytics data - according to the GA4 data-retention setting on our property.
Traffic between your browser and QPoint is encrypted with TLS. Sensitive data such as passwords is stored using strong one-way hashing. We apply generally accepted industry standards to protect personal information in transit and at rest, and we regularly review our security practices.
QPoint is not aimed at children under 13 and we do not knowingly collect personal information from children under 13. If you believe we may have collected data about a child under 13, email support@qpointsurvey.com and we will delete it.
Our website and app may link to third-party websites or embed third-party features (for example, a social share button). Once you leave our site or interact with an embedded feature, that third party's own privacy policy applies. We are not responsible for how those services handle your data.
If the GDPR applies to you, you have the following rights in relation to the personal data we hold about you:
access the data we hold;
have it corrected if it is wrong;
have it deleted (right to be forgotten);
restrict how we process it;
receive a copy in a portable format;
object to processing based on legitimate interest - including the visitor_signup event and website visit logging described above;
withdraw consent at any time, which you can do for cookies via Cookie Settings.
To exercise any of these rights, email support@qpointsurvey.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Croatian supervisory authority, the Personal Data Protection Agency (AZOP, azop.hr), or with the supervisory authority in your EU/EEA country of residence.
We may update this Privacy Policy from time to time. When we make meaningful changes, we will update the date at the top of this page and, where appropriate, let you know by email or an in-app notice before the change takes effect. If you do not agree with the updated policy, you can close your account at any time.
For any question about this policy or how we handle your data:
Q-Bit d.o.o.
Ilica 175b, 10 000 Zagreb, Croatia
support@qpointsurvey.com