Privacy Policy

How we handle, protect and process your personal data.

Last updated: 29 October 2026

1. Data Controller

FluoTest is owned and operated by FluoSite (Dominik Sikora), registered in the Netherlands (KVK 95614397, BTW NL005164401B51). FluoSite is the Data Controller under GDPR.

2. Data We Collect

We collect: email addresses submitted via sign-up forms; quiz answers including yes/no responses, open text, slider values, star ratings and number inputs submitted by respondents; partial quiz submission data (answers and progress saved during an active session, deleted automatically when a quiz is completed; for abandoned sessions the answers are anonymized after 30 days and the record is deleted after 12 months); a randomly generated session ID used to track quiz progress and drop-off analytics (not linked to any personal identity); early-access sign-up data; and non-identifiable analytics data. For Pro subscribers we store billing identifiers (such as a Stripe customer ID and subscription ID) and plan status; full payment card details are handled directly by Stripe and are never stored on our servers. When a quiz owner connects a third-party integration, we store that connection's credentials: an API key (e.g. Brevo or Airtable) or the OAuth access and refresh tokens returned by the provider (e.g. Google Sheets, Slack, HubSpot, Mailchimp or Notion), encrypted using Supabase Vault, never in plain text. If a quiz owner invites collaborators to a team workspace, we store the invited email addresses to manage those invitations. We also record showcase consent and logo consent as boolean values reflecting the quiz owner's preferences. For team workspaces we keep an activity log of workspace actions (such as edits, publishing and membership changes) performed by members. If you create API keys or authorize an application or AI assistant via OAuth, we store the key (in hashed form) or the OAuth grant so we can authenticate requests made on your behalf. We also store: files that respondents upload through file upload questions; for each response, the scores and result rules that decided the result, so the quiz owner can see why a result was shown; when a result video is used, the rendered video file and simple viewing events (such as views, plays and button clicks); the notes, tasks, pipeline stages and custom fields a quiz owner adds to contacts; and the email addresses of people who unsubscribe from a quiz owner's follow-up emails, so they are not emailed again.

3. How We Use Data

We use your data to provide and improve FluoTest, process payments and manage Pro subscriptions, send account holders occasional product updates and tips about FluoTest (you can unsubscribe at any time in Settings or from any email), send transactional emails (such as account notifications and the quiz results emails that quiz owners configure for their respondents), analyze feature usage, ensure security and comply with legal obligations. On behalf of quiz owners, we also send emails to their respondents that the quiz owner sets up, such as results emails, follow-up and abandoned-quiz emails, and a link to a result video, and we notify quiz owners and the teammates they choose about new and hot leads. When a quiz owner starts a drip campaign, we copy the email address and name of each contact in that campaign's saved segment who gave marketing consent and has not unsubscribed into an audience list in FluoTest's account with our email provider Resend, to deliver and manage that workspace's email campaigns. Starting the campaign is the quiz owner's instruction to do this. We keep the list in sync with the saved segment, normally within a day: new contacts are added only while a campaign on that segment is active, and a contact is removed when they unsubscribe, no longer have marketing consent, are deleted from FluoTest or no longer match the segment. When the quiz owner deletes the segment, its workspace or their account, the list is deleted. A contact's record at Resend is deleted once no such list includes them. We use these lists only to deliver that quiz owner's campaigns. A small number of authorized FluoSite staff can view account data when needed for support, security or billing; each such access is logged.

4. GDPR Legal Basis

We process data under the following legal bases: consent (email sign-ups and optional integrations), legitimate interest (analytics, service improvement, and product updates and tips about FluoTest sent to account holders, as allowed for existing customers under Article 11.7(3) of the Dutch Telecommunications Act; you can unsubscribe at any time in Settings or from any email), and contractual necessity (providing access to the service and processing Pro subscription payments). Quiz owners based in the EU are the data controllers for data collected through their quizzes; FluoTest acts as a data processor in that relationship. Our Data Processing Agreement, available at fluotest.com/dpa, sets out how we process that data for quiz owners. Respondents may request deletion of their submission data by contacting the quiz owner directly or by writing to info@fluosite.com.

5. Data Retention

Email data is kept until you unsubscribe or request deletion. Quiz responses are stored as long as necessary to provide the service or until you delete them. Partial quiz submissions are deleted automatically when a quiz is completed. For abandoned partial submissions the answers are anonymized after 30 days (only which questions were reached is kept, for drop-off statistics) and the record is deleted after 12 months. Quiz drop-off analytics are derived from anonymous session IDs and section indices; no personal data is stored in drop-off analytics. Integration delivery logs (records of webhook and integration attempts, which may include submission data) are retained for troubleshooting and pruned automatically. Billing records are retained for as long as required by applicable tax and accounting law. Analytics data is kept only in aggregated form. Showcase and logo consent records are stored indefinitely until the quiz owner requests deletion. Team workspace activity logs are retained for as long as the workspace exists. Result video files are stored privately and are deleted when the submission is permanently deleted or the account is deleted. Unsubscribe records are kept so we can keep honouring the request. Drip campaign audience lists at Resend are kept while the saved segment exists and are deleted with it; contacts leave a list as described in section 3. Records of staff access to account data are kept for security auditing.

6. Data Sharing

We only share data with trusted processors such as Stripe (payment processing for Pro subscriptions), Resend (delivery of transactional emails such as notifications and quiz results emails and of quiz owners' campaign emails, and storage of the audience lists for quiz owners' drip campaigns), Brevo (marketing and product-update emails), DataFast (privacy-friendly website analytics), and CookieHub (cookie settings). The full list of sub-processors is below. Our processing on behalf of quiz owners is governed by our Data Processing Agreement at fluotest.com/dpa. Where a quiz owner uses team workspaces, their quiz and submission data is also accessible to the collaborators they invite to that workspace. If you authorize an application or AI assistant via our API or MCP server, it accesses your data on your behalf under the permissions you grant. All partners comply with GDPR and data-processing agreements. We never sell your personal data or your respondents' data.

7. Payments & Billing

FluoTest offers paid Pro subscriptions. Payments are processed by Stripe, our payment processor; FluoTest never receives or stores your full card number. We store the billing identifiers needed to manage your plan (such as your Stripe customer and subscription IDs) and your subscription status. Stripe processes your payment data as an independent controller under its own privacy policy. The first 100 users remain grandfathered into Pro at no charge.

8. Third-Party Integrations

FluoTest allows quiz owners to connect third-party tools. When these integrations are enabled by the quiz owner, the respondent data the owner selects may be shared with the connected service. Free integrations include Brevo (email and contact lists), Webhooks (Zapier, Make, n8n and custom endpoints), Meta Pixel and Google Tag Manager. Pro integrations include Google Sheets, Slack, HubSpot, Mailchimp, Notion and Airtable. Depending on the integration, the data sent can include the respondent's name, email, score, score percentage, result tier or outcome, and individual answers. Brevo and Airtable are connected with an API key; Google Sheets, Slack, HubSpot, Mailchimp and Notion are connected via OAuth, with the access and refresh tokens stored encrypted in Supabase Vault. Meta Pixel and Google Tag Manager run client-side in the respondent's browser on quiz completion; the quiz owner is responsible for the tags they fire. FluoTest acts as a data processor for quiz owners who enable these integrations, and quiz owners are the data controllers for respondent data sent to third parties. We do not use connected accounts for any purpose other than delivering the quiz owner's configured integration. If you connect an AI assistant or other application to your account via our API or MCP server, that application can read and manage your quizzes and submissions on your behalf under the permissions you grant; you can revoke its access at any time from your account settings. Quiz owners can import existing forms from Typeform or Google Forms. These imports use read-only access to the forms you choose, held only in a short-lived session cookie and not stored on our servers. FluoTest's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements; we use it only to import the form you selected and do not use it for advertising or share it with others.

9. Cookies & Tracking

FluoTest uses essential cookies, analytics cookies and cookies required by CookieHub. Analytics and marketing tools (DataFast, Microsoft Clarity and Google Tag Manager) load only after you accept the matching cookie category, and never on quizzes served on a quiz owner's own domain. You can adjust your cookie preferences at any time using the Cookie Settings panel. When you open a FluoTest page from a link that carries campaign tags (such as the Powered by FluoTest badge on a quiz) or a referral code, we store those tags or that code in our own cookie (ft_utm or ft_ref). It contains no identifier and is not shared with anyone. We only read it if you create an account, to record where the account came from, and it expires after 30 days. Published quizzes can separately show a cookie consent banner to respondents before a quiz owner's tracking tags, such as Meta Pixel or Google Tag Manager, fire. This banner is shown automatically to visitors in regulated jurisdictions when the quiz owner has an active tracking integration, and the quiz owner can manually override it to always or never show from the Integrations panel. Quiz owners are responsible for configuring this setting in line with their own obligations under applicable law; FluoTest does not provide legal advice.

10. Security

We protect your data using encryption (HTTPS), secure hosting, access controls and monitoring. No system can guarantee perfect security, but we take reasonable measures to protect your information.

11. Your Rights

Under GDPR, you may request access, correction, deletion, limitation of processing, objection, or export of your data at any time. You can withdraw consent whenever you like. You can also export your account data and permanently delete your account yourself at any time from the Privacy tab in your dashboard settings.

12. International Transfers

If data is processed outside the EU, we ensure GDPR-compliant safeguards such as Standard Contractual Clauses (SCCs).

13. Contact

For privacy requests, contact info@fluosite.com. We respond within 30 days as required by GDPR.

Sub-processors

These companies process personal data on our behalf. Our database, sign-in, file storage and hosting (Supabase and Vercel) run in the EU. Where a provider processes data outside the EU, the transfer relies on the EU-US Data Privacy Framework or Standard Contractual Clauses.

ProviderPurpose
SupabaseDatabase, sign-in and file storage (EU)
VercelWebsite and app hosting, result video rendering (EU)
StripePayments for paid plans
ResendEmail delivery (transactional emails, notifications, quiz results emails and quiz owners' campaign emails) and storage of the audience lists for quiz owners' drip campaigns
BrevoProduct updates and tips for account holders (unsubscribe anytime)
CookieHubCookie consent management
SentryError monitoring
DataFastWebsite analytics, only after analytics consent
Microsoft ClaritySession analytics, only after analytics consent
Google Tag ManagerWebsite measurement tags, only after consent
GoogleOptional Sign in with Google; Google Analytics 4 website measurement, loaded through Google Tag Manager only after consent
Services you connectGoogle Sheets, Slack, HubSpot, Mailchimp, Notion, Airtable, Brevo, webhooks, and Typeform or Google Forms imports, only when a quiz owner connects them