Privacy Policy

Mindshare Studio LLC ("Mindshare Studio," "we," "us") provides AutoSurvey, a survey-building and survey-runtime product for Salesforce, with AI-assisted survey authoring, a Google Sheets authoring add-on, and a hosted control-plane service. This Privacy Policy explains what personal data AutoSurvey handles, where it is stored, who it is shared with, and the choices available to you. It is written for two audiences: Subscribers (the organizations and admins who operate AutoSurvey) and Respondents (the people who answer surveys built with AutoSurvey).

1. Our role: controller vs. processor

AutoSurvey is a business-to-business tool. When a subscriber uses AutoSurvey to collect survey responses:

• The subscriber is the data controller (GDPR) / business (CCPA/CPRA) for respondent personal data. The subscriber decides what to ask and who to ask, establishes the lawful basis, and is responsible for providing respondents the required notices and obtaining any required consent.
• Mindshare Studio is a processor / service provider that handles respondent data only on the subscriber's behalf and on its instructions, under our Data Processing Agreement ("DPA").

For data about our subscribers themselves — account, billing, configuration, and usage of our control-plane service — Mindshare Studio acts as a controller, and this policy describes that processing directly. If you are a respondent, contact the organization that sent you the survey; we route respondent requests we receive to the relevant subscriber.

2. The three parts of AutoSurvey, and where data lives

2a. Salesforce managed package — where survey responses live

The AutoSurvey managed package is installed in the subscriber's own Salesforce org. Surveys run on the subscriber's Salesforce Experience Cloud site, and all survey responses are stored in the subscriber's own Salesforce org.

Within the subscriber's org, AutoSurvey applies a least-privilege, private-by-default model: response objects use Private sharing, runtime sessions are token-gated, and security token fields are excluded from broad visibility.

2b. Survey design — AI authoring and the Google Sheets add-on

Subscribers create surveys two ways: with AutoSurvey's AI generation inside Salesforce (you describe the survey and AI drafts the questions and structure), and/or in Google Sheets using the AutoSurvey add-on. Either way, what is created is survey design content, not respondent data. Where the Google Sheets add-on is used, survey sheets are hosted in Mindshare Studio's managed Google Workspace (a Shared Drive) and shared with the subscriber.

Sheets contain survey design content (question text, options, display types, configuration) authored by the subscriber's admins. They are not intended to hold respondent personal data, and respondent answers are not written back to the sheet.

2c. Control plane — subscriber/tenant metadata and service operations

Mindshare Studio operates a hosted control plane (a Salesforce org we run; not part of the managed package) that provisions tenants, manages licensing and entitlements, brokers Google access for managed sheets, custodies AI keys, and meters AI usage. It stores subscriber/tenant metadata (see §3). It does not store respondent answers.

3. What we collect about subscribers (we are the controller)

• Org & tenant identifiers: Salesforce Org ID, org domain, org type, package version, install date, and first-/last-seen activity timestamps.
• Account & commercial data: admin/account/contact names and email tied to the subscription, plan, subscription status, expiration, and invitation/entitlement records.
• AI configuration: AI provider selection and API keys — either a key we provision on your behalf ("hosted") or your own key ("BYOK"). Keys are stored in encrypted fields and never returned to a browser in plaintext.
• AI usage telemetry: token counts and computed spend per month, for entitlements and spend caps.
• Managed-sheet metadata: URLs/IDs and assignment status of allocated Google Sheets, and your Google Drive folder ID.
• Support & diagnostics: information you provide to support, and operational logs (security event logs are redacted of secrets/tokens).

We use this data to provide, secure, meter, bill, and support the service, and to comply with law. We do not sell subscriber or respondent personal data, and we do not use survey content for advertising.

4. AI processing — what is and is not sent to AI

AutoSurvey offers optional AI features that operate only on survey design content authored by your admins: AI question generation (drafting questions from a topic description) and AI field-name suggestions (proposing Salesforce field names from question wording). These send the admin-provided prompts and question text to an AI provider (OpenAI or Anthropic, depending on the model selected). They do not send respondent answers.

• Respondent answers are never sent to any AI service. In-product analytics ("Insights") are computed by aggregating data inside your Salesforce org; response export is a subscriber-initiated CSV download. Neither uses AI.
• BYOK mode: your own AI key is used and requests go directly from your org to the AI provider; the control plane is not in the path.
• Hosted mode: we custody the AI key and our control plane meters token usage (counts only) for billing/limits; the AI request — the same survey design content — is sent to the AI provider. Respondent answers are never part of these requests.

5. Sub-processors

We use the following sub-processors. The current list, with locations and roles, is maintained in our DPA:

The subscriber's own Salesforce org (where responses live) is the subscriber's infrastructure, not our sub-processor.

6. Respondent personal data (subscriber is the controller)

The categories of respondent personal data collected are defined by the subscriber when it designs the survey. As processor, we store responses in the subscriber's own Salesforce org only, do not use them except to provide the service to that subscriber, and assist the subscriber with respondent data-subject requests under the DPA.

Respondents: to exercise your rights, contact the organization that asked you to complete the survey. We route any request we receive to that organization.

7. Data retention

• Survey responses are retained in the subscriber's Salesforce org under the subscriber's control and retention policies, and can be deleted by the subscriber at any time (see §9 for uninstall).
• Subscriber/tenant metadata, AI usage telemetry, and operational logs are retained for the duration of the subscription and up to 18 months afterward, then deleted or anonymized, except where longer retention is required for billing, tax, security, or legal compliance.
• AI authoring audit records are written to the AI_Generation__c object inside your own Salesforce org (under your control); control-plane security event logs are retained for up to 12 months.

8. Security

We apply safeguards appropriate to the data, including least-privilege and private-by-default access to response objects; token-gated public sessions (no record IDs in URLs); secrets stored via Salesforce Named/External Credentials and encrypted fields, never returned to the browser; and redaction of secrets in logs. No method of transmission or storage is perfectly secure. For security-incident commitments, see our DPA.

9. Uninstalling the package and deletion

If a subscriber uninstalls the AutoSurvey managed package, AutoSurvey's managed objects and the response data they hold are removed from the subscriber's org as part of Salesforce's standard package-uninstall behavior. If the subscriber has mapped a customer-owned reporting object, that object and its data remain in the subscriber's org. We recommend exporting any response data you wish to keep before uninstalling. Retention and deletion of responses are controlled by the subscriber as data controller. On termination, control-plane metadata is handled as described in the DPA.

10. International data transfers

The service relies on sub-processors (§5) that may process data in the United States and other countries. Where required, transfers are governed by appropriate safeguards (e.g., Standard Contractual Clauses or an applicable data-transfer framework).

11. Children's privacy

AutoSurvey is a business tool not directed to children. It is the subscriber's responsibility, as controller, to ensure its surveys are not used to collect personal data from children in violation of applicable law. We do not knowingly collect personal data from children.

Website analytics (autosurvey.app)

When you visit our public marketing website at autosurvey.app (including our blog), we use Google Analytics 4 to understand how the site is used — for example, which pages are viewed, how visitors arrive (referrer or campaign link), and general device/browser characteristics. Google may set cookies or use similar technologies for this purpose.

We use this information only to measure and improve our marketing content. It is not linked to your AutoSurvey subscriber account, Salesforce org, or survey responses. Google processes this data as our service provider; see Google's Privacy Policy. You can opt out of Google Analytics in your browser using Google's opt-out add-on.

12. Your choices

• Subscribers: access, correct, or delete account data, configure BYOK, manage retention of responses in your org, and export your data anytime. Revoke the add-on's Google access via Google Account → third-party access.
• Respondents: contact the surveying organization (controller) to exercise your rights.

13. Changes to this policy

We may update this policy. Material changes will be reflected in the "Last updated" date and, where appropriate, communicated to subscribers. Continued use after an update constitutes acceptance.

14. Contact

Mindshare Studio LLC
3916 N Potsdam Ave #2392, Sioux Falls, SD 57104
Privacy / support: support@mindsharestudio.com

For processor-related (respondent data) matters, see the Data Processing Agreement.