Privacy Policy

Mindshare Studio LLC ("Mindshare Studio," "we," "us") provides AutoSurvey, a survey-building and survey-runtime product for Salesforce, with AI-assisted survey authoring, a Google Sheets authoring add-on, and a hosted control-plane service. This Privacy Policy explains what personal data AutoSurvey handles, where it is stored, who it is shared with, and the choices available to you.

This policy is written for three audiences:

• Subscribers — the organizations and their admins who install and operate AutoSurvey.
• Respondents — the people who answer surveys built with AutoSurvey.
• Website visitors — the people who visit our public website at autosurvey.app (see "Our public website (autosurvey.app) — analytics and third parties").

1. Our role: controller vs. processor

AutoSurvey is a business-to-business tool. When a subscriber uses AutoSurvey to collect survey responses:

• The subscriber is the data controller (GDPR) / business (CCPA/CPRA) for the respondent personal data it collects. The subscriber decides what to ask, who to ask, and the lawful basis for collection, and is responsible for providing respondents the required notices and obtaining any required consent.
• Mindshare Studio is a processor / service provider that handles respondent data only on the subscriber's behalf and on its instructions. Our processing commitments are set out in our Data Processing Agreement ("DPA").

For data about our subscribers themselves — account, billing, configuration, and usage of our control-plane service — Mindshare Studio acts as a controller, and this policy describes that processing directly.

If you are a respondent and have questions about a survey you were asked to complete, contact the organization that sent you the survey (the controller). We will refer respondent requests we receive to the relevant subscriber.

2. The three parts of AutoSurvey, and where data lives

Understanding where data is stored is the core of this policy.

2a. Salesforce managed package (where survey responses live)

The AutoSurvey managed package is installed in the subscriber's own Salesforce org. Surveys run on the subscriber's Salesforce Experience Cloud site, and all survey responses are stored in the subscriber's own Salesforce org — in AutoSurvey's managed objects (Survey_Submission__c, Survey_Answer__c) and, optionally, in a customer-owned reporting object the subscriber maps.

• If the subscriber sets them up, a survey page can load a Google font, a brand image that the subscriber hosts on Google Cloud Storage, or Google reCAPTCHA. The respondent's browser then contacts Google. Survey answers are not part of those requests. (See §5.)
• Within the subscriber's org, AutoSurvey applies a least-privilege, private-by-default model: response objects use Private sharing, runtime sessions are token-gated, and security token fields are excluded from broad visibility (see our security documentation).

2b. Survey design — AI authoring and the Google Sheets add-on (where surveys are designed)

Subscribers create surveys two ways: with AutoSurvey's AI generation inside Salesforce (you describe the survey and AI drafts the questions and structure), and/or in Google Sheets using the AutoSurvey add-on. Either way, what is created is survey design content, not respondent data. Where the Google Sheets add-on is used, survey sheets are hosted in Mindshare Studio's managed Google Workspace (a Google Shared Drive) and shared with the email addresses that the subscriber's admin enters.

Sheets contain survey design content (question text, options, display types, configuration) authored by the subscriber's admins. They are not intended to hold respondent personal data, and respondent answers are not written back to the sheet.

2c. Control plane (subscriber/tenant metadata and service operations)

Mindshare Studio operates a hosted control plane (a Salesforce org we run; not part of the managed package) that provisions tenants, manages licensing and entitlements, brokers Google access for the managed sheets, custodies AI keys, and meters AI usage. The control plane stores subscriber/tenant metadata, described in §3. It does not store respondent answers.

3. What we collect about subscribers (we are the controller)

For subscribers and their admin users, the control plane and our systems hold:

• Org & tenant identifiers: Salesforce Org ID, org domain, org type, package version, install date, first-/last-seen activity timestamps, and the Salesforce user ID of the admin who connects the org to our service.
• Account & commercial data: the admin/account/contact names and email associated with the subscription (sourced from the Salesforce License Management App), plan, subscription status, expiration, invitation/entitlement records, and related commercial fields.
• AI configuration: AI provider selection and the API key we provision on the subscriber's behalf ("hosted"). The keys we hold are stored in our control-plane Salesforce org. We send a key to a subscriber's org only in answer to a signed, authenticated request over TLS. That org keeps a delivered OpenAI key in a protected setting that its users cannot read, and holds a delivered Anthropic key only in memory for the request that uses it. Keys are never returned to a browser in plaintext. A subscriber's own key ("BYOK") is stored in the subscriber's org, in a Salesforce External Credential; we do not receive it.
• AI usage telemetry: token counts and computed spend per month, used for entitlements and spend caps.
• Managed-sheet metadata: the URLs/IDs and assignment status of the Google Sheets allocated to the subscriber, and the subscriber's Google Drive folder ID.
• Support & diagnostics: information you provide when you contact support — from AutoSurvey Setup, that is your message, your contact email, and a diagnostics bundle that you can preview before you send it — and operational logs. Security event logs are redacted of secrets/tokens.

We use this data to provide, secure, meter, bill, and support the service, and to comply with law. We do not sell subscriber or respondent personal data, and we do not use survey content for advertising.

4. AI processing — what is and is not sent to AI

AutoSurvey offers optional AI features that operate only on survey design content authored by the subscriber's admins:

• AI survey and question generation — drafts a survey, or questions and option sets, from a description the admin provides.
• AI shortening — shortens long question text and long option labels while a survey is generated.
• AI background-art suggestion — reads the survey's title, description, and question labels, and suggests artwork from AutoSurvey's built-in art catalog.

These features send the admin-provided prompts and the survey's design content (title, description, question text, and option labels) to an AI provider (OpenAI or Anthropic, depending on the model selected). They do not send respondent answers.

• Respondent answers are never sent to any AI service. Survey analytics ("Insights") are computed by aggregating data inside the subscriber's Salesforce org (counts, averages, NPS, distributions); response export is a subscriber-initiated CSV download. Neither uses AI.
• BYOK mode: the subscriber's own AI key is used and requests go directly from the subscriber's org to the AI provider; the control plane is not in the path.
• Hosted mode: we custody the AI key and our control plane meters token usage (counts only) for billing/limits; the AI request — the same survey design content — is sent to the AI provider. Respondent answers are never part of these requests. AI authoring requests are logged to an AI_Generation__c audit record inside the subscriber's own Salesforce org (under the subscriber's control); we do not store the prompt content on our control plane.
• Web pages named in a prompt (Anthropic): if an admin's prompt contains a web address and the selected Anthropic model supports it, Anthropic fetches that page, and can run a web search, from its own servers to ground the generated survey. The admin chooses the address. The fetch does not come from the subscriber's org or from us.

5. Sub-processors

We use the following sub-processors. The current list, with locations and roles, is maintained in our DPA:

The subscriber's own Salesforce org (where responses live) is the subscriber's infrastructure, not our sub-processor.

Services the subscriber chooses (not our sub-processors). The services below are contacted only when the subscriber turns on the feature that uses them. The subscriber's org, or the respondent's browser, contacts them directly, and we do not receive the data that crosses them.

• The subscriber's own AI provider account (BYOK) — OpenAI or Anthropic, under the subscriber's own agreement with that provider (§4).
• Survey import sources — SurveyMonkey, GetFeedback, Typeform, and Google Forms. When an admin imports a survey, the subscriber's org reads the source survey's structure and images, with the subscriber's own access token or through a public link. What is sent is the survey ID or link. To read a multi-page SurveyMonkey survey through a public link, the import answers the required questions of each page with fixed test values (for example, "AUTOSURVEY IMPORT TEST — please disregard") and never submits the final page. These values contain no personal data.
• Google reCAPTCHA — when the subscriber turns on CAPTCHA for a survey, with the subscriber's own reCAPTCHA keys. The respondent's browser loads Google's reCAPTCHA widget, and the subscriber's org sends Google the reCAPTCHA response token and the subscriber's secret key to verify it. The org does not send the respondent's IP address.
• Google Fonts and Google Cloud Storage — when the subscriber's survey theme uses a Google font, or a brand image that the subscriber hosts on Google Cloud Storage, the browser loads it from Google.

In the browser cases, Google receives the request data that every browser sends (such as IP address and browser type), and reCAPTCHA collects the signals it needs under Google's terms. None of these services receives survey answers.

6. Respondent personal data (subscriber is the controller)

When a respondent completes a survey, the categories of personal data collected are defined by the subscriber when it designs the survey, and may include contact details, free-text responses, and any other information the survey asks for. As processor, we:

• store responses in the subscriber's own Salesforce org only (§2a);
• do not use responses except to provide the service to that subscriber;
• assist the subscriber in responding to respondent data-subject requests (access, deletion, correction, etc.) under the DPA.

Respondents: to exercise your rights, contact the organization that asked you to complete the survey. We will route any request we receive to that organization.

7. Data retention

• Survey responses are retained in the subscriber's Salesforce org under the subscriber's control and retention policies. The subscriber can delete responses at any time. See §9 for what happens on uninstall.
• Subscriber/tenant metadata, AI usage telemetry, and operational logs are retained for the duration of the subscription and for up to 18 months afterward, then deleted or anonymized, except where longer retention is required for billing, tax, security, or legal compliance.
• AI authoring audit records are written to the AI_Generation__c object inside the subscriber's own Salesforce org and are retained under the subscriber's control. Control-plane security event logs are retained for up to 12 months.

8. Security

We apply administrative, technical, and organizational safeguards appropriate to the data, including: least-privilege and private-by-default access to response objects; token-gated public survey sessions (no record IDs in URLs); in the subscriber's org, secrets held in Salesforce Named/External Credentials or protected settings; AI keys released by our control plane only on signed requests; no secret returned to the browser; and redaction of secrets in logs. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security. For security incidents, see the breach-notification commitments in our DPA.

9. Uninstalling the package and deletion

If a subscriber uninstalls the AutoSurvey managed package, AutoSurvey's managed objects (Survey_Submission__c, Survey_Answer__c) and the response data they hold are removed from the subscriber's org as part of Salesforce's standard package-uninstall behavior. If the subscriber has mapped a customer-owned reporting object, that object and its data remain in the subscriber's org. We recommend exporting any response data you wish to keep before uninstalling. Retention and deletion of responses are controlled by the subscriber as data controller.

On termination of the subscription, control-plane metadata is handled as described in the DPA ("Return and deletion of data").

10. International data transfers

The service relies on sub-processors (§5) that may process data in the United States and other countries. Where required, transfers are governed by appropriate safeguards (e.g., Standard Contractual Clauses or an applicable data-transfer framework).

11. Children's privacy

AutoSurvey is a business tool not directed to children. It is the subscriber's responsibility, as controller, to ensure its surveys are not used to collect personal data from children in violation of applicable law (e.g., COPPA, UK/EU age-of-consent rules). We do not knowingly collect personal data from children.

12. Your choices

• Subscribers: access, correct, or delete account data, configure BYOK, manage retention of responses in your org, and export your data at any time. Revoke the add-on's Google access via your Google Account's third-party access settings.
• Respondents: contact the surveying organization (controller) to exercise your rights.

13. Changes to this policy

We may update this policy. Material changes will be reflected in the "Last updated" date and, where appropriate, communicated to subscribers. Continued use after an update constitutes acceptance.

14. Contact

Mindshare Studio LLC
3916 N Potsdam Ave #2392, Sioux Falls, SD 57104
Privacy / support: support@mindsharestudio.com

For processor-related (respondent data) matters, see the DPA.