Privacy Policy
How we handle, protect and process your personal data.
Last updated: July 2026
1. Data Controller
FluoTest is owned and operated by FluoSite (Dominik Sikora), registered in the Netherlands (KVK 95614397, BTW NL005164401B51). FluoSite is the Data Controller under GDPR.
2. Data We Collect
We collect: email addresses submitted via sign-up forms; quiz answers including yes/no responses, open text, slider values, star ratings and number inputs submitted by respondents; partial quiz submission data (answers and progress saved temporarily during an active session, deleted automatically when a quiz is completed or after 30 days of inactivity); a randomly generated session ID used to track quiz progress and drop-off analytics (not linked to any personal identity); early-access sign-up data; and non-identifiable analytics data. For Pro subscribers we store billing identifiers (such as a Stripe customer ID and subscription ID) and plan status; full payment card details are handled directly by Stripe and are never stored on our servers. When a quiz owner connects a third-party integration, we store that connection's credentials — an API key (e.g. Brevo or Airtable) or the OAuth access and refresh tokens returned by the provider (e.g. Google Sheets, Slack, HubSpot, Mailchimp or Notion) — encrypted using Supabase Vault, never in plain text. If a quiz owner invites collaborators to a team workspace, we store the invited email addresses to manage those invitations. We also record showcase consent and logo consent as boolean values reflecting the quiz owner's preferences. For team workspaces we keep an activity log of workspace actions (such as edits, publishing and membership changes) performed by members. If you create API keys or authorize an application or AI assistant via OAuth, we store the key (in hashed form) or the OAuth grant so we can authenticate requests made on your behalf.
3. How We Use Data
We use your data to provide and improve FluoTest, process payments and manage Pro subscriptions, send early-access or product updates, send transactional emails (such as account notifications and the quiz results emails that quiz owners configure for their respondents), analyze feature usage, ensure security and comply with legal obligations.
4. GDPR Legal Basis
We process data under the following legal bases: consent (email sign-ups and optional integrations), legitimate interest (analytics and service improvement), and contractual necessity (providing access to the service and processing Pro subscription payments). Quiz owners based in the EU are the data controllers for data collected through their quizzes; FluoTest acts as a data processor in that relationship. A data processing agreement is available on request at [email protected]. Respondents may request deletion of their submission data by contacting the quiz owner directly or by writing to [email protected].
5. Data Retention
Email data is kept until you unsubscribe or request deletion. Quiz responses are stored as long as necessary to provide the service or until you delete them. Partial quiz submissions are deleted automatically when a quiz is completed; abandoned partial submissions are deleted after 30 days. Quiz drop-off analytics are derived from anonymous session IDs and section indices — no personal data is stored in drop-off analytics. Integration delivery logs (records of webhook and integration attempts, which may include submission data) are retained for troubleshooting and pruned automatically. Billing records are retained for as long as required by applicable tax and accounting law. Analytics data is kept only in aggregated form. Showcase and logo consent records are stored indefinitely until the quiz owner requests deletion. Team workspace activity logs are retained for as long as the workspace exists.
6. Data Sharing
We only share data with trusted processors such as Stripe (payment processing for Pro subscriptions), Resend (delivery of transactional emails such as notifications and quiz results emails), Brevo (marketing and product-update emails), DataFast (privacy-friendly website analytics), Formspree (form submissions) and CookieHub (cookie settings). Where a quiz owner uses team workspaces, their quiz and submission data is also accessible to the collaborators they invite to that workspace. If you authorize an application or AI assistant via our API or MCP server, it accesses your data on your behalf under the permissions you grant. All partners comply with GDPR and data-processing agreements.
7. Payments & Billing
FluoTest offers paid Pro subscriptions. Payments are processed by Stripe, our payment processor; FluoTest never receives or stores your full card number. We store the billing identifiers needed to manage your plan (such as your Stripe customer and subscription IDs) and your subscription status. Stripe processes your payment data as an independent controller under its own privacy policy. The first 100 users remain grandfathered into Pro at no charge.
8. Third-Party Integrations
FluoTest allows quiz owners to connect third-party tools. When these integrations are enabled by the quiz owner, the respondent data the owner selects may be shared with the connected service. Free integrations include Brevo (email and contact lists), Webhooks (Zapier, Make, n8n and custom endpoints), Meta Pixel and Google Tag Manager. Pro integrations include Google Sheets, Slack, HubSpot, Mailchimp, Notion and Airtable. Depending on the integration, the data sent can include the respondent's name, email, score, score percentage, result tier or outcome, and individual answers. Brevo and Airtable are connected with an API key; Google Sheets, Slack, HubSpot, Mailchimp and Notion are connected via OAuth, with the access and refresh tokens stored encrypted in Supabase Vault. Meta Pixel and Google Tag Manager run client-side in the respondent's browser on quiz completion; the quiz owner is responsible for the tags they fire. FluoTest acts as a data processor for quiz owners who enable these integrations, and quiz owners are the data controllers for respondent data sent to third parties. We do not use connected accounts for any purpose other than delivering the quiz owner's configured integration. If you connect an AI assistant or other application to your account via our API or MCP server, that application can read and manage your quizzes and submissions on your behalf under the permissions you grant; you can revoke its access at any time from your account settings.
9. Cookies & Tracking
FluoTest uses essential cookies, analytics cookies and cookies required by CookieHub. We also use DataFast, a privacy-friendly analytics tool, to measure website traffic and signup attribution in aggregate. You can adjust your cookie preferences at any time using the Cookie Settings panel.
10. Security
We protect your data using encryption (HTTPS), secure hosting, access controls and monitoring. No system can guarantee perfect security, but we take reasonable measures to protect your information.
11. Your Rights
Under GDPR, you may request access, correction, deletion, limitation of processing, objection, or export of your data at any time. You can withdraw consent whenever you like. You can also export your account data and permanently delete your account yourself at any time from the Privacy tab in your dashboard settings.
12. International Transfers
If data is processed outside the EU, we ensure GDPR-compliant safeguards such as Standard Contractual Clauses (SCCs).
13. Contact
For privacy requests, contact [email protected]. We respond within 30 days as required by GDPR.