PRIVACY POLICY

Version dated November 10, 2026

This Privacy Policy (“Policy”) outlines how we, UCOZ LTD, process your personal information (“Personal Information”) during your use of the Survey Ninja service (“Service”), including:

• (a) what information we collect;
• (b) how and why we do this;
• (c) how we protect the information;
• (d) what rights you have regarding this information.

By this, you consent to the processing of your Personal Information under the terms of this Policy. Your actions aimed at using the Service constitute your unconditional acceptance of the terms of the Policy and the conditions of Personal Information processing specified therein.

Before starting to use the Service, you must carefully read the Policy in its entirety and ensure that you fully understand, agree with its terms, and meet the necessary requirements for accepting them. If you have not read it fully, do not understand it, do not accept the terms of the Policy, or do not meet the necessary requirements, you may not use the Service and must immediately cease any interaction with it.

A necessary requirement for accepting the terms of the Policy is that you are at least 13 years old; the Service is not directed at children under 13. If you are 13 or older but have not reached the age that allows you to independently manage your Personal Information in accordance with the laws of your jurisdiction, or if there are other limitations on your legal capacity, you must obtain the appropriate permission from your parent or legal representative (or guardian) to accept the terms of the Policy; if you are acting on behalf of another person, you must have confirmation of the relevant authority to accept the terms of the Policy.

Under the applicable law, you are not obligated to provide us with any Personal Information; however, providing such information is a mandatory condition for using the Service. By this, you confirm, guarantee, and agree that any information you provide to us is given of your own free will, that this consent is specific, unambiguous, and reflects your actual desire for us to use your Personal Information for the purposes described in the Policy.

You may withdraw your consent for the processing of your Personal Information at any time. We guarantee that the process for withdrawing consent will be as simple as the process for providing it. The withdrawal of consent does not affect the legality of the processing of Personal Information based on consent prior to its withdrawal.

1. COLLECTION OF PERSONAL INFORMATION

1.1. In our operations, we are guided by the applicable laws of Cyprus regarding the processing of personal data and the General Data Protection Regulation (GDPR).

1.2. We process Personal Information on the following legal bases under Article 6(1) GDPR:

• (a) performance of the contract with you (point (b)), to provide access to the Service, technical support and service notifications;
• (b) our legitimate interests (point (f)), to improve the Service, compile aggregate statistics and prevent fraud and violations of law;
• (c) compliance with a legal obligation (point (c)), to comply with applicable law;
• (d) your consent (point (a)), to send promotional newsletters and use non-essential cookies.

1.3. In accordance with the principle of "data minimization," we collect Personal Information only to the extent necessary for using the Service and achieving the purposes for which it is collected.

1.4. During your use of the Service, we collect:

• 1.4.1. Personal information that allows us to identify you. This information is provided by you when filling out the registration form or is transmitted from the Google account used to log into the Service. The mandatory type of personal information for using the Service is your email address. Additionally, you may provide your phone number, which is not required to access the Service and is provided to us solely at your discretion.
• 1.4.2. Technical information collected automatically during registration and use of the Service:
• (a) information obtained through cookies, pixel tags, web beacons, browser analytics tools, server logs, and other similar technologies and tools;
• (b) information about the devices you use to access the Service, including the operating system type, device model, browser type, system settings, language information, geolocation data (country/region identification), device time zone, and carrier/provider information;
• (c) action logs stored on the server, recording IP addresses of devices used to interact with the Service, access time, sequence of actions within the Service, session information including response time, and loading errors;
• (d) other non-identifying information depending on the permissions you have granted.
• 1.4.3. Information related to payments for the Service, such as billing details and payment history.
• 1.4.4. Information contained in your requests to technical support.

1.5. You accept and agree that, in some cases, we have the right to request additional information about you, as well as copies of documents to verify the provided details, and to make any other requests when necessary based on reasonable assumptions and legitimate interests.

2. PURPOSES OF COLLECTING PERSONAL INFORMATION

2.1. We use your Personal Information for the following purposes:

• 2.1.1. To provide access to the Service for its further use.
• 2.1.2. To improve the Service, enhance its usability, and adjust necessary settings based on general or individual preferences, user experience, or difficulties you may encounter.
• 2.1.3. To provide technical support, feedback, including sending notifications, requests, and information related to the use of the Service (notifications about updates, security information, changes to our terms and conditions of using the Service).
• 2.1.4. To create aggregate statistical information, including analytics and monitoring of trends in the use of the Service and actions within the Service.
• 2.1.5. To send promotional newsletters to your email address and display advertising materials within the Service about products, services, promotions, events, and other news and information that we believe may interest you. You can opt out of receiving promotional messages by using the "unsubscribe" button.
• 2.1.6. To prevent fraud or violations of applicable laws, particularly for detecting, investigating, and preventing illegal activities, and to protect our rights and property, as well as the rights and property of other users and third parties.
• 2.1.7. To comply with the laws of Cyprus or the laws applicable to you.

2.2. Your Personal Information will not be used for purposes other than those stated above.

2.3. You confirm that the purposes for which we use your Personal Information align with your interests, and the consent for processing your Personal Information, expressed at the beginning of using the Service, is given for each purpose of processing specified in the Policy.

3. DISCLOSURE OF PERSONAL INFORMATION

3.1. We are committed to not disclosing your Personal Information to third parties, except in the following cases:

• 3.1.1. You have given explicit and specific consent for the disclosure of your Personal Information.
• 3.1.2. This is necessary for your use of the Service, or for the execution of our User Agreement or other binding documents that govern our relationship.
• 3.1.3. This is necessary for the operation of the Service and its functionality. Depending on the functions you use, recipients of Personal Information may include the following categories of third parties:
• (a) hosting, communications and content delivery network providers;
• (b) data protection and cybersecurity service providers;
• (c) billing and payment processing service providers;
• (d) fraud detection and prevention service providers;
• (e) email distribution service providers;
• (f) web analytics and Service status monitoring providers, including performance measurement and optimization;
• (g) providers of artificial intelligence models and related infrastructure, which process the content you submit to the AI features of the Service (such as prompts, survey questions, responses and uploaded files), including personal data of third parties contained in it, solely to generate results for you.
• 3.1.4. You have consented to the transfer of your Personal Information to marketing and advertising service providers for the purpose of promoting the Service, where such transfer is permitted by applicable law.
• 3.1.5. Under your account, the Service is used through or connected to an AI assistant or AI agent, integration, webhook or other third-party service, or survey results are shared via a public link. In this case, data is exchanged at your initiative and within the settings you have chosen:
• (a) we receive from the third-party service only the data necessary to fulfil the request made through it;
• (b) we transfer to the third-party service the result of the request and other information, including personal data of third parties, determined by the settings of the connection;
• (c) the information determined by the settings of a public link is available to anyone who has the link.
• You can disconnect third-party services and disable public links at any time; this does not affect information already transferred or accessed. Recipients under this clause are chosen by you, do not act on our behalf, and we do not control their further use of the information. The processing of information by the operator of a third-party service is governed by that operator’s terms of use and privacy policy.
• 3.1.6. The transfer of Personal Information is carried out in accordance with the laws of Cyprus and international legislation in response to requests from authorized entities for such information (court orders and law enforcement requests), when we are obligated to disclose such information, provided we act in good faith, believing that the law requires us to do so.
• 3.1.7. There is a transfer of ownership or control of all or part of the Service to a new owner.
• 3.1.8. The transfer of Personal Information is carried out to ensure the protection of our rights and legitimate interests, or the rights and interests of third parties, in cases where you violate the Policy or other binding documents that govern our relationship or applicable laws. The above-mentioned cases should not be considered as unauthorized disclosure of personal information, as these actions are aimed at achieving the purposes of processing Personal Information.

3.2. Information may be transferred to third parties only in strict accordance with this Policy and the laws of Cyprus.

4. TERRITORY OF STORAGE AND TRANSBORDER TRANSFER OF PERSONAL INFORMATION

4.1. We store Personal Information within the European Union. Some of the recipients referred to in Section 3 may process Personal Information outside the European Economic Area. In such cases, the transfer is carried out on the basis of an adequacy decision of the European Commission, the standard contractual clauses approved by the European Commission or other safeguards provided for by the GDPR.

4.2. If you are located outside the European Union, by accessing or using the Service or otherwise providing us with your Personal Information, you consent to the processing and transborder transfer of your Personal Information to the territory of the European Union countries.

4.3. We will strive to protect your Personal Information to at least the same extent as required in your jurisdiction, provided that it does not violate the laws of Cyprus or the General Data Protection Regulation (GDPR).

5. YOUR RIGHTS REGARDING THE PERSONAL INFORMATION PROVIDED

5.1. Under this Policy, you have all the rights granted to you by the General Data Protection Regulation (GDPR), which include:

• 5.1.1. The right to access your Personal Information. You can review the main information we hold about you in your account. Upon your request, we will provide a complete list of the Personal Information we have collected about you, the legal basis, the purposes of processing, categories of Personal Information, a list of third parties to whom the Personal Information has been or will be disclosed, the retention period of the Personal Information, as well as the security measures in place for Personal Information that are not confidential. A response will be provided within a reasonable time frame in accordance with the laws of Cyprus.
• 5.1.2. The right to rectification. At any time, you have the right to make corrections to your Personal Information through your account. If, for any reason, you encounter issues with correcting your Personal Information, you can send us a request, and we will make the necessary corrections within a reasonable period. Considering the purposes of processing, you have the right to provide only partial Personal Information, specifying only the mandatory types of Personal Information necessary for accessing the Service.
• 5.1.3. The right to withdraw consent for the processing of Personal Information. You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The Service provides the option to withdraw consent as easily as it was given. You can request the deletion of your account at any time, and we will delete it within a reasonable time after receiving the corresponding request. Please note that you can correct, update, or delete certain parts of your Personal Information on your own. When you make corrections to your Personal Information or withdraw consent for its processing, we will notify all third parties who have access to your Personal Information, unless this proves impossible or involves disproportionate effort. Regardless of the withdrawal of consent for processing Personal Information and receiving a corresponding request for its deletion, we may continue processing certain Personal Information if required by the laws of Cyprus.
• 5.1.4. The right to erasure ("right to be forgotten"). You have the right to request, and we are obligated to delete your Personal Information without undue delay if:
• (a) the Personal Information is no longer necessary for the purposes for which it was collected;
• (b) the legal basis for processing the Personal Information is no longer valid (the consent for processing the Personal Information has been withdrawn);
• (c) the processing of Personal Information would violate your rights;
• (d) the Personal Information must be erased in accordance with the laws of Cyprus, the General Data Protection Regulation (GDPR), or the applicable laws in your jurisdiction.
• 5.1.5. The right to data portability. You have the right to receive your Personal Information in a structured, commonly used, and machine-readable format. To obtain all the Personal Information we have ever collected, you can send a corresponding request to our technical support service. You have the right to transfer your Personal Information directly from one controller to another, if technically feasible.
• 5.1.6. The right to restriction of processing in the cases provided for by Article 18 GDPR.
• 5.1.7. The right to object to processing based on our legitimate interests and, at any time, to processing for direct marketing purposes.
• 5.1.8. The right to lodge a complaint with a supervisory authority, including the Commissioner for Personal Data Protection in Cyprus.

6. USE OF TRACKING TECHNOLOGIES

6.1. By default, we use only cookies necessary for authentication, session management, security, saving your preferences and connection stability. Cookies used for analytics and marketing are used only with your consent, which you can withdraw at any time in the cookie settings.

7. STORAGE PERIOD OF PERSONAL INFORMATION

7.1. We retain Personal Information only for as long as necessary for the purposes for which it was collected:

• (a) account information, for as long as your account is active, and deleted after the account is deleted, unless longer retention is required by law;
• (b) technical information and action logs, for the period necessary to ensure the security and stable operation of the Service;
• (c) information related to payments, for the period required by tax and accounting laws;
• (d) information contained in your requests to technical support, for the period necessary to handle the request and resolve any related disputes;
• (e) information processed on the basis of your consent, until you withdraw your consent.

Information may be retained for a longer period if necessary to comply with legal obligations, resolve disputes, prevent fraud and abuse, or protect our legitimate interests.

8. INFORMATION SECURITY

8.1. We take all necessary and sufficient organizational and technical measures, in accordance with Cyprus law, to protect your Personal Information from unauthorized or accidental access, destruction, alteration, blocking, copying, distribution, and other unlawful actions by third parties. In our operations, we use widely recognized industry standards to protect data. The protection of Personal Information is implemented by default at the design level of the Service during its development. Security measures include firewall protection, data encryption, data minimization, system resilience to failures, the ability to restore availability and access to Personal Information in case of physical or technical incidents, physical access control to data centers, and access control to data. We regularly monitor our systems for potential vulnerabilities and attacks, assess the effectiveness of technical and organizational measures for ensuring the security of Personal Information, and continuously seek new ways and service providers to further enhance the security of our Service and protect the privacy of our users. All third parties who have access to Personal Information and are involved in providing access to the Service adhere to security measures for protecting Personal Information that are at least as stringent.

8.2. We cannot guarantee absolute security, and therefore, we encourage you to exercise caution, set a strong password for your account, and avoid providing any sensitive information whose disclosure could cause you significant harm.

8.3. In the event of a personal data breach, we take all necessary measures to eliminate or minimize its potential negative consequences and notify the supervisory authority and you in the cases and within the time limits provided for by the GDPR. Such incidents are recorded in the incident log maintained in accordance with the GDPR.

8.4. A breach of personal information confidentiality, as defined in this Policy, refers to a security incident that results in the unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal information that we process.

9. AMENDMENT AND INTERPRETATION OF POLICY

9.1. Policy, its interpretation, and any claims or disputes related to it are governed, construed, and enforced exclusively in accordance with the laws of Cyprus and the General Data Protection Regulation (GDPR).

9.2. By this, you agree that any disputes arising shall be resolved exclusively by the courts in the location of our residence, in accordance with the procedures established by the laws of Cyprus, unless otherwise provided by mandatory provisions of applicable law.

9.3. We reserve the right to amend the Policy at any time. If we deem the changes to be significant (at our sole discretion), we will notify you before the changes take effect. In other cases, we are not obligated to provide such notice.

9.4. We recommend that you periodically review this page for the most up-to-date information on our Policy. Unless otherwise explicitly stated, our most recent version of the Policy applies to all information we hold about you.

10. INTERACTION WITH US AND RESPONSES TO YOUR INQUIRIES

10.1. If you have any questions or notices regarding this Policy and the use of your Personal Information, please contact us through the designated form or via email at team@surveyninja.io.

10.2. You can also send a letter to our address: Vasili Michailidi 9, 3026 Limassol, Cyprus.

10.3. We will respond to your inquiry within a reasonable time frame, but no later than the period specified by applicable law.

10.4. We provide the first copy of the information free of charge. For any further copies you request, we may charge a reasonable fee based on administrative costs. If you make the request electronically, and unless otherwise specified by you, we will provide the response in a commonly used electronic format.

10.5. If your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may refuse to act on them or charge a reasonable fee.

10.6. If we have reasonable doubts regarding the identity of the person making the request, we may ask for additional information necessary to verify the identity of the requester.