1. Who we are
This policy covers the Inqqa websites (inqqa.ai and the Inqqa application) and the Inqqa software-as-a-service product, which lets an organisation import or collect survey responses and produce structured analysis and written reports from them, with the help of large language models.
The company behind Inqqa is Ai Applied VOF, registered in the Netherlands under KvK number 34300425, Dr de Visserlaan 4, 1181 XN Amstelveen. For the information you give us when you visit our websites or create an account, we are the data controller: we decide why and how that information is processed.
Questions about this policy, and any request described in section 11, can go to info@inqqa.ai. The same address reaches us for a data deletion request, a question about who processes your analysis, or a request for a data processing agreement.
2. Two roles: your account, and the people who answer your surveys
When you use Inqqa as a customer, you (or the organisation you work for) are the data controller of the survey responses you collect, and Inqqa is the data processor: we handle that data only to give you the analysis you asked for, on your instructions.
We are not the party that decides why respondents answer your questionnaires, and we are not the contact point for the individuals who fill them in — that is you. Your own privacy notice to your respondents should say that their answers are processed by Inqqa on your behalf.
For business customers who need one, we will sign a data processing agreement covering the processing described in this policy. Ask for it at info@inqqa.ai.
3. What we collect
Account and identity: your name, email address and password (stored as a salted hash, never in plain text), and, if you sign up for a trial, the company name and description of what you want to analyse that you type into the trial form.
Survey content: the files you upload, the surveys you configure, the questions and answers you collect, and any wave or segment labels you add.
Analysis output: the categories, themes, scores, summaries and reports the system generates, plus the settings used to produce them, so you can review and re-run them.
Operational records: the jobs that ran, when, whether they succeeded, and the errors they hit. This is what lets us debug a failed analysis.
Billing: the plan you are on and the invoices and licence records associated with it. Payment card details are handled by Stripe; we store the reference identifiers Stripe gives us, not the card number.
Website usage: on inqqa.ai we run a feedback widget that records page views, clicks, and generic browser and screen information, so that when someone reports a problem we can see what they were doing. We do not run advertising trackers on the site.
4. Why we process it
To provide the product: collecting and storing your survey data, running the analysis, showing you the results and letting you export them.
To operate your account: authentication, email verification, password reset, and the trial reminder emails that tell you your trial is ending.
To bill you: taking payment, issuing invoices and managing licences.
To keep the service working and fix it: job logs and error records, and the website usage information described above, which we use to reproduce reported problems.
Where you have opted in, to send you product news. The trial form has a separate checkbox for this, and marketing email is only sent where that box was ticked.
5. Survey responses and the people who wrote them
Survey answers are the most sensitive thing we hold, and they are yours. We store them so you can analyse them, re-run an analysis with different settings, and export the results.
We treat open-text answers as confidential customer content. We do not sell them, we do not publish them, and we do not use them to train our own models.
Free-text answers can contain personal data about your respondents that neither you nor we anticipated. That is one of the reasons we ask you to tell your respondents what happens to their answers before you collect them.
6. Large language models, and what is sent to them
Inqqa produces its categorisations, themes and written report text by sending text from your survey — the questions and the open-text answers, plus the project context you enter — to a language model, and using what comes back.
We send only the text needed for that analysis. We do not send payment information, and we do not send your login credentials.
Model endpoints are configured by us, not chosen by you, and the application will only talk to endpoints on our approved list. The models we currently use are operated by providers we contract with directly, including EU GPT, rather than by a self-service public API you would have to accept terms for yourself.
We do not use your survey data to train our own models. What a model provider does with the text it receives is governed by that provider's agreement with us, which we select with European data protection in mind; we will tell a customer which provider is handling their analysis if they ask.
Because the text is processed by a model, the output is generated text, not a verified fact. Section 6 of our Terms and Conditions explains what that means for your use of it.
7. Who else is involved
The application runs on infrastructure we operate, using our own PostgreSQL database, Redis queue and Qdrant vector store, and stores uploaded files and generated report artifacts on that infrastructure.
Survey collection uses a self-hosted Formbricks component running on the same infrastructure, with its own database. If you use our survey links, your respondents' answers pass through it.
To build company context for a report, Inqqa can search the public web and fetch public pages. That uses a self-hosted search service and a web crawler; it reads public sources and does not send your survey answers to them.
Payment is processed by Stripe. When you pay, information goes directly to Stripe under their own privacy policy, and we keep only the identifiers and billing records needed to run your account.
Transactional email (verification, password reset, trial notices) is sent through our configured email provider.
The feedback widget on our websites is provided by Betamaxx, which receives the page-view and click information described in section 3. When a visitor reports a problem, their email address is encrypted in their own browser before it is sent, so that we — and Betamaxx — hold it in encrypted form until it is opened.
8. Cookies and local storage
The Inqqa application uses a single session cookie to keep you signed in. Without it, logging in is not possible. It is not used to track you across other websites.
Password reset and email verification work through single-use links sent to your email address.
The feedback widget on inqqa.ai may store a small amount of information in your browser so that a report you are writing is not lost between visits.
We do not set advertising or cross-site profiling cookies.
9. Where your data is held, and transfers outside the EU
Your account, survey data and analysis results are held on infrastructure we operate. We do not move customer data to a third-country processor as part of normal operation.
Where a service we rely on involves processing outside the European Union, we put the appropriate safeguards in place before using it, and we choose providers on that basis rather than accepting whatever default terms are offered.
If you need to know the exact location of the infrastructure holding your data, or which model provider handles a given analysis, ask us at info@inqqa.ai and we will tell you.
10. How long we keep things
Account data and survey data are kept while your account is active, so that you can return to an analysis and re-run it.
A free trial runs for 14 days from the moment you start it. You get a reminder before it ends. After a trial expires we keep the account for a further 30 days, so that you can still get your data out or subscribe, and then the uploaded files and generated report artifacts for that account are deleted from our servers.
When a trial is purged, the record of which projects and analyses existed is retained in outline (names, dates, status) for operational and billing history; the content itself is gone.
Invoices and billing records are kept for as long as tax and company law requires.
You can ask us to delete your account and the data in it at any time by writing to info@inqqa.ai. We confirm when it is done. Some records — for example an issued invoice — are kept because the law requires them.
11. Your rights
You can ask to see the personal data we hold about you, have it corrected, have it deleted, restrict or object to how it is processed, and receive the data you gave us in a usable format.
For survey responses, those rights belong first to your respondents, and you are the one who can act on them: delete a response in the product, or ask us to delete the data behind a project.
We will not refuse a request because you exercised a right. If we cannot act on one, we will tell you why and what we can do instead.
Write to info@inqqa.ai. If you are unhappy with how we handled a request, you can complain to your local data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.
12. Keeping it secure
Access to customer data is limited to the people who need it to run the product and support customers, and administrative actions are logged.
Passwords are stored only as salted hashes. Secrets and credentials are held in the server environment, not in the code, and the application will refuse to send analysis text to a model endpoint that is not on our approved list.
The application is served over HTTPS. Access to the underlying machines is restricted and audited.
No online service can be made perfectly secure. If we become aware of a breach that affects your data, we will tell you without undue delay and work with you on what to do next.
13. Children
Inqqa is a business tool for organisations analysing their own surveys, customer feedback and employee feedback. It is not directed at children, and we do not knowingly collect data from children.
14. Changes to this policy
We update this page when the product changes — when we add a provider, change what is stored, or change how long something is kept. The date at the top of the page is the date of the last change.
If a change materially affects how we use your data, we will tell customers directly rather than only updating this page.