PollApp pays you for answering surveys and playing games. To do that we need some personal data about you. This policy explains what we collect, why, who we share it with, how long we keep it and what rights you have.
Flow Group AB, a Swedish company with organisation number 559183-6027 (“Flow Group”, “we”, “us”), is the controller responsible for the processing of your personal data in PollApp. Our postal address is Flow Group AB, Söder Mälarstrand 21, 118 20 Stockholm, Sweden. For anything about your personal data, email hello@pollapp.io.
The short version
We use your data to run your account, match you with surveys and games, pay you, and stop fraud.
Survey and game partners get the profile data they need to match you; payout providers get what they need to pay you.
We never sell your data. Profile questions about sensitive topics are optional and need your explicit consent.
You can see, correct or delete your data, and delete your account in the app at any time.
1. What we collect and where it comes from
Most of the data comes from you: when you create an account, fill in your profile, answer profile questions, contact support or choose how to get paid. Some comes from your device and from the services you use to sign in or play.
Account details: name, email address, phone number (if you sign in by SMS or a payout method needs it), date of birth, gender, postal code, country, language and time zone.
Sign-in details: if you sign in with BankID, your Swedish personal identity number (personnummer) and name; with Apple, Google or Facebook, the name and email address they share with us and an account identifier.
Profile answers: your answers to our profile questions, for example about your household, education, work, interests and habits. Some questions touch on sensitive topics such as health or ethnic origin; answering them is optional.
Activity: the surveys you start and complete, game levels you reach, rewards, streaks, badges, competitions, referrals and payouts.
Payout details: what the payout method you pick needs, for example your PayPal email, or your phone number and personal identity number for Swish.
Device and connection data: IP address and the country it belongs to, device model, operating system and app version, device identifiers (such as Apple’s identifier for vendors or Android ID), your advertising identifier where your device settings allow it, and push notification tokens.
Support: your messages to us and any screenshots you attach.
Some data is needed to create an account and pay you (marked “performance of contract” or “legal obligation” below). The rest is up to you, but without it some surveys, games or payout methods may not be available to you.
2. How we use your data
For each purpose: what we do, which data we use, our legal basis under the GDPR and how long we keep the data.
Running your account
What we do
Create your account, let you sign in securely, keep track of your balance and history, and send you messages about your account.
Data
Account and sign-in details, activity, device data.
Legal basis
Performance of contract: we need it to provide PollApp to you.
Ask profile questions and use your answers and account details to match you with surveys you qualify for.
Data
Date of birth, gender, postal code, country, email address, IP address, profile answers, and scrambled (hashed) versions of your email address, phone number and personal identity number so survey partners can recognise you without seeing them.
Legal basis
Legitimate interest in giving you relevant surveys. Answers on sensitive topics: your explicit consent, which you can withdraw at any time by changing the answer to “I prefer not to say” or by contacting us.
How long
Until you delete your account or change the answer. Sensitive answers stop being used as soon as you withdraw your consent.
Surveys
What we do
Show you surveys, send you to them and credit your reward when you finish. The surveys themselves are run by research companies. If you tell a survey who you are, that company may link your answers to you and becomes responsible for that data itself.
Data
The survey matching data above, which surveys you start and finish, and how you take them (for example how long it takes).
Legal basis
Performance of contract (rewards); legitimate interest (providing surveys and checking their quality).
How long
Your survey history is kept until you delete your account.
Survey session recordings
What we do
For a small share of survey sessions, the app may record what happens on the survey’s pages (the questions shown, the options picked, clicks and scrolling) so we can check survey quality and investigate problems and fraud. Text you type is masked by default. Only a small group of our staff can watch recordings.
Data
The survey pages’ content and your interactions with them, linked to your account.
Legal basis
Legitimate interest in quality control and preventing fraud.
How long
Deleted automatically after the retention period we set (30 days by default, never more than one year), and straight away if you delete your account.
Games
What we do
Show you games from our game partners, track the levels you reach in them and pay your rewards.
Data
Your user ID, date of birth, gender, postal code, IP address, platform and advertising identifier, and the game events our partners report back (installs and levels reached). On Android, if you give our game partner adjoe “usage access”, it reads app usage data on your device to measure how long you play the games you started through PollApp.
Legal basis
Performance of contract (rewards); your consent for usage access and, on iPhone, for tracking (App Tracking Transparency). You can withdraw both in your device settings.
How long
Until you delete your account.
Payouts
What we do
Turn your balance into money, gift cards or a donation and send it to you or the charity you choose.
Data
Your user ID, the amount, and what the method needs: PayPal email; phone number and personal identity number for Swish; phone number for Venmo; name and email for Revolut; email or phone number for gift cards, prepaid cards and donations.
Legal basis
Performance of contract; legal obligation for our accounting records.
How long
Payout records are kept for as long as the Swedish Bookkeeping Act requires: until the end of the seventh year after the year the payout was made.
Preventing fraud and keeping PollApp secure
What we do
Check that each member is a real person with one account in their home country, so that rewards go to honest members and survey buyers can trust the answers. Surveys and games are only available in the country you registered in; we work this out from your IP address, never from GPS. Before some payouts we check the email address or phone number with a reputation service. Device checks from Apple and Google help us spot modified apps. Unusual patterns, such as several accounts on one device or very fast answers, put an account on hold for a manual review by our staff; no account is closed by a machine alone.
Data
IP address and country, device and advertising identifiers, device check results, time zone, how fast you complete surveys and games, payout details, and the email address or phone number checked.
Legal basis
Legitimate interest in preventing fraud and protecting our members, partners and service.
How long
As long as you have an account. Some records (such as device and IP logs, and payout recipients) are kept after deletion so the same fraud can’t simply start again on a new account.
Identity checks
What we do
Only if we ask you to: confirm that you are a real person (a face check through your camera) or verify your identity from the chip in your passport (read with your phone’s NFC).
Data
Face check: images of your face, used only to check that a real, present person is taking it. Passport: the data stored on the chip, such as your name, date of birth, nationality, document number and the chip’s photo, which only our staff can see.
Legal basis
Your explicit consent, which you give when you start a check and can withdraw at any time.
How long
Until the check is finished and for as long as you have an account; erased when you delete your account.
Competitions, referrals and notifications
What we do
Run leaderboards and competitions, reward you when friends you invite join and earn, and send push notifications about rewards, surveys and your account.
Data
First name and the first letter of your last name, scores, referral codes and the activity of the friends you invite, and your push notification token.
Legal basis
Performance of contract (competitions and referral rewards); your consent for push notifications, which you can turn off in your device settings.
How long
Until you delete your account or turn notifications off.
Measuring our marketing
What we do
Find out which ads and invite links bring new members, using Branch. Branch passes scrambled (hashed) identifiers to advertising platforms such as Meta, so they can measure our campaigns without receiving your details in readable form.
Data
Your user ID, device identifiers, advertising identifier (on iPhone only if you allow tracking), IP address, country, language, events such as sign-up and completed surveys, and hashed email address, name, date of birth and gender.
Legal basis
Your consent where the law or your device requires it; otherwise our legitimate interest in measuring our marketing. You can limit ad tracking or reset your advertising identifier in your device settings.
How long
Until you delete your account; the partners keep their data according to their own terms.
Customer support
What we do
Answer your questions and solve problems. Our support staff may use an AI service (OpenAI) to help draft replies; a person always reviews them before they are sent.
Data
Your messages and screenshots, and the account details needed to help you, such as your name, country, balance, recent surveys, rewards and payouts.
Legal basis
Legitimate interest in answering and solving support matters.
How long
Attachments are deleted when your account is deleted; the conversation is kept as long as needed to handle the matter and any related claim.
Improving the app
What we do
Find and fix crashes and errors.
Data
Crash and error reports from the app (device model, operating system, app version and what went wrong). They don’t include your name or email address.
Legal basis
Legitimate interest in a working app.
How long
For a limited time, then deleted by our crash reporting provider (Sentry).
Legal claims and accounting
What we do
Handle complaints and legal claims, and keep the accounting records the law requires.
Data
Name, contact details, our correspondence with you, and transaction and payout history.
Legal basis
Legal obligation (bookkeeping); legitimate interest in establishing, exercising or defending legal claims.
How long
Accounting records: until the end of the seventh year after the year they relate to. Claims: until the matter is settled.
3. Who we share it with
We never sell your personal data. We share it only as described here, and only what each party needs. Service providers that process data on our behalf (processors) may only use it on our instructions. Partners marked “own terms” decide themselves how they use the data they receive, under their own privacy policies.
YFlow
The platform we use for sign-in, survey matching and profile questions, payouts, email and identity checks.
Survey partners
Research and panel companies that provide surveys and match them to your profile (own terms).
Game partners
Prime Earn and adjoe, who provide the games and report your progress (own terms).
Payout providers
PayPal, Swish, Venmo, Revolut and Tremendous (gift cards, prepaid cards and donations), depending on the method you choose (own terms).
Sign-in providers
BankID, Apple, Google and Facebook, if you choose to sign in with them (own terms).
Marketing measurement
Branch, and through Branch advertising platforms such as Meta (own terms).
Fraud checks
IPQualityScore (email reputation) and Numcheckr (phone number checks).
Support
OpenAI, to help our staff draft replies.
App services
Expo, Apple and Google for push notifications and device checks; Sentry for crash reports.
Hosting and network
Amazon Web Services (servers in Frankfurt, Germany) and Cloudflare.
Authorities
Courts, police or other authorities when the law requires us to.
4. Where your data is processed
We store your data in the EU, on servers in Frankfurt, Germany. Some of the partners above process data outside the EU/EEA, for example in the United States: survey partners, Sentry, OpenAI, Branch and Meta. When data leaves the EU/EEA, the transfer relies on an adequacy decision by the European Commission (such as the EU–U.S. Data Privacy Framework) or on the Commission’s standard contractual clauses. Contact us to find out more or to get a copy of the safeguards.
5. What other members can see
On leaderboards and in competitions, other members see your first name, the first letter of your last name and your score. If someone invited you, they see the same name, when you joined, how many surveys you have completed, what you have earned them and whether you have been active in the last 30 days. Nobody else sees your profile answers, contact details or balance.
6. Deleting your account
You can delete your account at any time in the app. When you do, we remove your name, date of birth, postal code, advertising identifier, sign-in details and notification tokens, and ask our partners to delete your survey profile. Your identity check data, survey recordings and support attachments are deleted too.
A few things are kept after deletion, without your name: payout and transaction records for as long as accounting law requires, and records we need to prevent fraud and handle claims, such as device and IP logs and payout recipients.
7. Your rights
Under data protection law you have the following rights. To use any of them, email hello@pollapp.io. We answer within one month.
Access: find out whether we process your data and get a copy of it.
Rectification: have wrong data corrected and incomplete data completed. You can change most of your details in the app yourself.
Erasure: have your data deleted, for example when we no longer need it or when you object to processing based on our legitimate interest and we have no overriding reason to continue.
Restriction: have us limit what we do with your data, for example while we check whether it is correct.
Data portability: get the data you have given us in a structured, machine-readable format, or have it sent to another company where technically possible.
Objection: object to processing based on our legitimate interest, and to any use for direct marketing. We then stop unless we have compelling reasons that outweigh your interests, or need the data for a legal claim.
Withdrawing consent: withdraw any consent at any time. This does not affect processing before the withdrawal.
Complaints: lodge a complaint with a supervisory authority in the EU/EEA country where you live or work, or where you think the law was broken. In Sweden this is the Swedish Authority for Privacy Protection (IMY), imy.se.
8. Balancing of interests
Where we rely on our legitimate interest, we have weighed it against your interests and rights and found that ours outweighs them, taking into account what you can reasonably expect when you use a rewards app, the safeguards we use (such as hashing identifiers and limiting who can see data) and your right to object. Contact us if you want to know more about a particular assessment.
9. Changes to this policy
We update this policy when PollApp or the law changes. The date at the top shows when it last changed; if a change matters to you, we will tell you in the app. This website itself uses no cookies or trackers; it only remembers your language choice in your browser.
This privacy policy was first established by Flow Group AB on 18 August 2021.
Questions?
Flow Group AB, Söder Mälarstrand 21, 118 20 Stockholm, Sweden. Organisation number 559183-6027.