Privacy notice
How Usertick collects and uses personal data, how long it keeps it and what rights you have.
Last updated: November 1, 2026
This privacy notice explains how Usertick Ltd (“Usertick”) uses personal data when it decides why and how the data is used, and what rights you have. It applies to the people who use Usertick’s product, buy it or contact Usertick, and to visitors to its websites. Usertick handles personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended by the Data (Use and Access) Act 2025. This notice takes effect on November 1, 2026.
1. Who is responsible for your data
Usertick Ltd is a company registered in England and Wales under company number 17517933, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For the processing this notice describes, Usertick is the controller. Usertick is registered with the Information Commission (ICO) under number ZC283297.
You can reach Usertick about data protection at privacy@usertick.com or by post at the registered office.
2. When this notice applies, and when Usertick acts for its customers
Usertick is the controller of the personal data it collects to run its own business:
- accounts, the people invited to them, and the organizations they belong to;
- billing and purchase records;
- security and usage records;
- support requests;
- the forms on usertick.com, the newsletter and product email;
- visits to Usertick’s own websites, usertick.com, docs.usertick.com and status.usertick.com; and
- its review of reported surveys and other content that may break its terms or the law, and the records the law requires it to keep.
Usertick’s customers use Usertick to run surveys on their websites, at survey links and by email. For that data, the customer is the controller and Usertick is its processor, which means Usertick handles it only on the customer’s instructions under the Data Processing Addendum (DPA). This covers survey responses and the details sent with them, the data the Usertick widget stores and reads on a customer’s website, the identity and traits a customer passes to the widget, files that respondents upload, and the contacts a customer emails surveys to. If you answered a survey or visited a website that uses Usertick, the privacy notice of that company explains how your data is used, and that company is the one to ask about it. If you send Usertick a request about such data, Usertick forwards it to the customer concerned and tells you that it has done so, or, where it can’t identify the customer, asks you to contact the customer directly.
The content you create inside an organization on Usertick, such as surveys, comments, notes and dashboards, also belongs to that organization, which is its controller. It stays with the organization if you leave it or delete your account. Your account itself (your name, email address, password and sign-in settings) remains under this notice.
Usertick uses its customers’ data only to provide the service and on their instructions in the DPA, which include creating anonymized aggregate statistics that identify no person and no customer. Usertick does not train AI models on its customers’ data, and its contracts with its AI providers don’t allow them to. The AI features read survey answers for the customer, as its processor. AI at Usertick describes which features use AI, where they run and how customers control them.
3. The personal data Usertick collects, and where it comes from
| Category | Personal data | Source |
|---|---|---|
| Account and profile | Name, email address, password (stored only in hashed form), and the profile details you choose to add: photo and time zone. Your sign-in method, two-factor settings, notification settings and whether you turned off product email. The page of usertick.com you followed the sign-up link from, when you came that way. | You, when you sign up, accept an invitation or edit your profile. A colleague who invites you gives Usertick your email address and role. Google gives Usertick your name, email address and Google account ID when you sign in with Google. Your organization's identity provider gives your email address, its ID for you and, where it sends one, your name when your organization uses single sign-on or SCIM. |
| Organization and billing | The organization's name, logo and plan, the subscription state, the billing country, records of purchases (what was bought, when and for how much) and the identifiers Stripe uses for the organization and its subscription. Usertick never receives card or bank details. | You, and Stripe and Link when you buy a plan, extra responses or extra emails. |
| Security and usage | For each signed-in session: IP address, browser and operating system (user agent), the country your connection comes from and the times of sign-in and use. Records of security events, such as sign-in alerts and two-factor changes. Records of requests to the API. The organization's activity log, which records the changes you make inside the organization. Request records that Usertick's content delivery network keeps for its websites, which include IP addresses. | Collected automatically when you use Usertick or visit its websites. |
| Support | Your name and email address, the subject and messages of each request, an attachment you add, and the plan, browser and website domain that Usertick adds for its staff. A message from the contact form on usertick.com also holds the company you name and the topic you pick. | You, when you ask for help or send the contact form on usertick.com. |
| Website forms | Sales inquiries and Enterprise requests (name, work email, company, team size and message), event registrations (event, name, email and message), job applications (name, email, LinkedIn, GitHub and other links, message and CV) and abuse reports (reason, the reported link, details and, if you give one, a contact; for an intimate image report, also your email, your declarations and your name as a signature), with a salted hash of the IP address that sent the form. | You, when you send a form on usertick.com. |
| Newsletter and product email | Your email address, whether you confirmed your newsletter subscription and when, and whether you unsubscribed. Whether an address bounced permanently, so that Usertick stops sending to it. | You, when you subscribe or use Usertick, and Usertick's email delivery provider, which reports bounces. |
| Website analytics and marketing | Google Analytics: The pages you view on usertick.com and the page or campaign that brought you there, the time of each visit, your browser, device and operating system, your approximate location, which Google derives from your IP address, and the random identifiers in the analytics cookies. Microsoft Clarity: The pages you view on usertick.com and how you click, scroll and move the pointer on them, what the page showed you, with the text you type into fields masked, the time of each visit, your browser, device and screen size, your approximate location, which Microsoft derives from your IP address, and the random identifiers in the Clarity cookies. | Collected on usertick.com by the tools named here, when they load (section 4 and the cookie policy say when). |
| Cookie choices on usertick.com | A random ID that your browser creates and keeps in the ut_consent cookie, the categories you allowed and refused, the version of the cookie policy, the country your visit came from, where you made the choice and its time. The record holds no IP address and is not linked to an account. | Your browser, when you make a choice in the cookie banner or under Cookie settings, or when its Global Privacy Control signal refuses marketing that you allowed before. |
You need to give your name, your email address and a password, or use Google or single sign-on, to create an account; without them Usertick can’t create it. A paid plan needs the billing details that Stripe asks for at checkout. Everything else, such as your profile details, is optional. No law requires you to give Usertick personal data. Usertick doesn’t ask for special category data, such as health information, and asks you not to include it in support requests or applications.
4. Why Usertick uses your data, and the lawful basis for each use
| Purpose | Personal data | Lawful basis under the UK GDPR |
|---|---|---|
| Creating your account, signing you in and providing Usertick to you and your organization | Account and profile, organization, security and usage | Contract (Article 6(1)(b)) where you use Usertick for yourself or your own business. Where an organization that you belong to holds the contract, Usertick's legitimate interest (Article 6(1)(f)) in providing the service that the organization signed up for. |
| Counting how many accounts each page of usertick.com brings, so that Usertick can see which pages help people and improve them | The page you followed the sign-up link from, and your answer to how you heard about Usertick | Legitimate interests (Article 6(1)(f)) in knowing which pages of its website are useful. |
| Selling plans, extra responses and extra emails, managing subscriptions and keeping purchase records | Organization and billing, the owner's email address | Contract (Article 6(1)(b)), and legal obligation (Article 6(1)(c)) for the accounting and tax records that UK law requires. |
| Keeping accounts, the service and customers' data secure and preventing abuse: two-factor checks, sign-in alerts, limits on attempts, bot checks on forms, logs, the investigation of misuse, and refusing sign-ups, email address changes and invitations with an address from a disposable email service, checked against a list that Usertick keeps in its own systems without sending the address to any third party | Security and usage, account and profile, the IP address hash on website forms | Legitimate interests (Article 6(1)(f)): protecting accounts, Usertick's systems and its customers' data, and preventing fraud and abuse. |
| Sending service messages: sign-up and sign-in codes, security emails, invitations, notifications, and notices about billing, deletion and changes to these documents | Account and profile, organization | Contract (Article 6(1)(b)), and legitimate interests (Article 6(1)(f)) in keeping you informed about your account and its security. |
| Answering support requests | Support, account and profile, organization | Contract (Article 6(1)(b)), and legitimate interests (Article 6(1)(f)) in helping the people who use customers' accounts and in answering the questions people send through the contact form. |
| Sending product email to account holders: tips for getting started and up to one news email a month | Name, email address, the state of your organization's setup, your product email setting | Legitimate interests (Article 6(1)(f)) in telling the people who use Usertick how to get started and what is new. You can turn it off at any time. |
| Sending the newsletter | Newsletter subscription | Consent (Article 6(1)(a)), which you give by confirming your subscription and can withdraw at any time. |
| Answering sales inquiries and Enterprise requests, and registering you for events | Website forms | Steps you ask Usertick to take before a contract (Article 6(1)(b)), and legitimate interests (Article 6(1)(f)) in answering business inquiries and running events. |
| Considering job applications | Website forms (job applications and CVs) | Steps you ask Usertick to take before a contract of employment (Article 6(1)(b)), and legitimate interests (Article 6(1)(f)) in choosing the right candidates. |
| Handling abuse reports about surveys | Website forms (abuse reports), the survey and its owner | Legitimate interests (Article 6(1)(f)) in keeping Usertick free of abuse and protecting the people a survey targets. Where a report concerns a crime, the recognized legitimate interest in detecting, investigating or preventing crime (Article 6(1)(ea) and Annex 1). |
| Understanding how Usertick is used, to improve it, and producing anonymized aggregate statistics that identify no person and no customer | Security and usage, organization | Legitimate interests (Article 6(1)(f)) in improving Usertick and running the business. |
| Measuring how the documentation at docs.usertick.com is used, such as page views and page feedback | Security and usage | Consent (Article 6(1)(a)), which the documentation site asks for and where you can withdraw it at any time. |
| Measuring how visitors find and use usertick.com, such as the pages they view and where they came from, so that Usertick can improve the site (Google Analytics) | Website analytics and marketing | Consent (Article 6(1)(a)), in every country, which you give in the cookie banner or under Cookie settings on usertick.com and can withdraw there at any time. |
| Seeing how visitors move through the pages of usertick.com, through heatmaps of clicks and scrolls and recordings of visits, so that Usertick can find and fix what makes the site hard to use (Microsoft Clarity) | Website analytics and marketing | Consent (Article 6(1)(a)), in every country, which you give in the cookie banner or under Cookie settings on usertick.com and can withdraw there at any time. |
| Keeping a record of the cookie choices on usertick.com, to be able to show the consent Usertick relies on | Cookie choices on usertick.com | Legal obligation (Article 6(1)(c)): the UK GDPR (Article 7(1)) requires Usertick to be able to show that you consented. |
| Meeting legal obligations, answering lawful requests from authorities, and establishing, exercising or defending legal claims | Any of the above, as needed | Legal obligation (Article 6(1)(c)); the recognized legitimate interest in disclosing data to a public authority that asks for it for its public tasks (Article 6(1)(ea) and Annex 1); and legitimate interests (Article 6(1)(f)) in protecting Usertick's legal position. |
| Selling, merging or reorganizing Usertick's business | Any of the above, as needed | Legitimate interests (Article 6(1)(f)) in running and developing the business. |
Where Usertick relies on legitimate interests, it has weighed those interests against your rights and found that its use of your data is necessary and doesn’t override them. You can ask for details of that assessment, and you can object to any use based on legitimate interests (see section 8). Where Usertick relies on consent, you can withdraw it at any time, which doesn’t affect what Usertick did before.
5. Who receives your data
Usertick does not sell personal data and does not share it for advertising. It shares personal data only as follows:
- Providers that run Usertick for it, under written contracts that require them to protect the data and to use it only on Usertick’s instructions: hosting and infrastructure providers, which host the application and its databases, deliver and protect Usertick’s websites, check forms for bots and store files such as support attachments and CVs; an email delivery provider, which sends Usertick’s emails; AI processing providers, which run the AI features; a documentation provider, which hosts docs.usertick.com; and a status page provider, which runs status.usertick.com and the status badge on Usertick’s websites and in the app. The providers that process customers’ data are listed on the sub-processors page.
- Payments: Stripe and its affiliate Sold through Link, LLC (“Link”), which is the merchant of record for the payments for paid plans, extra responses and extra emails and processes them for Usertick. Usertick sends Stripe the organization’s name and identifier, the owner’s email address and the billing country, and Stripe collects payment details directly from you. Stripe and Link use this data as independent controllers under their own privacy policies.
- Google LLC, under Google’s own privacy policy. When the app’s sign-in page offers Sign in with Google, Google receives your IP address, your browser details and the email address of a Google account that your browser remembers. When you sign in with Google, or pick a spreadsheet with Google Picker for the Google Sheets integration, it receives your Google account details.
- Analytics and marketing providers, when their tools load on usertick.com (section 4): Google Analytics: Google Ireland Limited, which provides Google Analytics as Usertick's processor under Google's data processing terms. Usertick turns off Google signals and advertising features for usertick.com. Microsoft Clarity: Microsoft Ireland Operations Limited, which provides Microsoft Clarity and uses the data as a controller under the Microsoft Privacy Statement, including to improve its own products. Usertick doesn't let Clarity set Microsoft's advertising cookies. The cookie policy lists the cookies they set.
- The organization you belong to. Its members see your name, email address, photo and role, and its activity log records the changes you make. When the organization connects integrations, such as Slack or HubSpot, the data it sends there goes on its instructions.
- Professional advisers, such as lawyers, accountants, auditors and insurers, who are bound to confidentiality.
- Authorities, such as the police, courts, regulators and HM Revenue and Customs, where the law requires it or where it is necessary to prevent or detect crime or to establish, exercise or defend legal claims.
- A buyer or successor of all or part of Usertick’s business, and its advisers, in a sale, merger or reorganization, under a duty of confidentiality. The buyer may use the data only as this notice describes.
6. Where your data is stored, and transfers outside the UK
Usertick stores personal data in the United Kingdom. Files, such as support attachments and CVs, are stored in the European Union, which the United Kingdom recognizes as giving adequate protection.
Some providers process personal data outside the United Kingdom and the European Union:
- The content delivery and security network that carries requests to Usertick is global, so a request can pass through the data center closest to you, which may be outside the United Kingdom. Usertick relies on the provider’s data processing addendum, which includes the UK International Data Transfer Addendum to the EU standard contractual clauses.
- Stripe and Link process payment data in the United States and elsewhere as independent controllers. Stripe takes part in the EU-US Data Privacy Framework and its UK Extension, which the UK recognizes as giving adequate protection.
- Google LLC receives your data in the United States for Sign in with Google and Google Picker. It takes part in the EU-US Data Privacy Framework and its UK Extension.
- The documentation provider hosts docs.usertick.com from the United States and receives the technical data of visitors to it, such as IP addresses and browser details. It relies on the EU standard contractual clauses with the UK International Data Transfer Addendum.
- The status page provider runs status.usertick.com and the status badge on Usertick’s websites and in the app from the United States, and receives the technical data of the people who view them, such as IP addresses and browser details. Its data processing addendum includes the EU standard contractual clauses with the UK International Data Transfer Addendum.
- Google Analytics, when it loads on usertick.com: Google processes Google Analytics data in the United States and elsewhere. Google LLC takes part in the EU-US Data Privacy Framework and its UK Extension, and Google's data processing terms include the EU standard contractual clauses with the UK International Data Transfer Addendum.
- Microsoft Clarity, when it loads on usertick.com: Microsoft processes Microsoft Clarity data in its cloud in the United States. Microsoft Corporation takes part in the EU-US Data Privacy Framework and its UK Extension, and Microsoft Ireland Operations Limited passes the data to it under the EU standard contractual clauses.
You can ask for a copy of the safeguards for a transfer at privacy@usertick.com. Personal data sent to Usertick from the European Economic Area is covered by the European Commission’s adequacy decision for the United Kingdom.
7. How long Usertick keeps your data
Usertick keeps personal data only as long as it needs it for the purposes in section 4:
| Data | How long |
|---|---|
| Account and profile | While the account exists. When you delete it, Usertick removes or de-identifies it 14 days later (30 days after an organization removes an account that single sign-on created), as described below. |
| Signed-in sessions | Until 30 days after the session ends. A session lasts at most 30 days. |
| Organization data | While the organization exists. Usertick deletes it 14 days after the owner deletes the organization. |
| Purchase records | Usertick keeps its records of an organization's subscription and purchases while the organization exists and deletes them with it. Stripe keeps the record of each payment, and Link issues the receipts and invoices for paid orders. Usertick's accounting records are kept for six years, as UK tax law requires. |
| Support requests | Until 24 months after the request's last activity, as Usertick's record of the help it gave. If your account is deleted before then, Usertick removes your name and email address from the request at that time. |
| The organization's activity log | For the life of the organization. Usertick deletes it together with the organization. When your account is deleted, your name and email address are removed from its entries. |
| API request records | 7 days. |
| Request logs of the content delivery network for Usertick's websites | Up to 7 days. |
| Website form submissions | 24 months after they arrive. Job applications and CVs: 12 months. |
| Google Analytics on usertick.com | Google Analytics keeps the events of a visit for 14 months and then deletes them. Its cookies last 2 years. |
| Microsoft Clarity on usertick.com | Microsoft Clarity keeps the recordings of visits for 30 days, and the click and heatmap data and the recordings Usertick marks for 9 months, and then deletes them. Its cookies last up to 1 year. |
| Records of cookie choices on usertick.com | 24 months after each choice. |
| Newsletter | Until you unsubscribe. Usertick then keeps the address with the date you unsubscribed, so that it doesn't email you again by mistake. |
| Addresses that bounced permanently | For as long as Usertick sends email, so that it doesn't send to them again. |
| Backups | Production databases are backed up by Usertick's hosting providers. Backups are overwritten on a rolling schedule, and Usertick uses them only to recover the service. |
Deleting your account
You can delete your account yourself in Usertick, or ask for its deletion at privacy@usertick.com. The deletion takes effect 14 days after you confirm it, and signing in during those 14 days cancels it. When it takes effect, your account details and sign-in data are deleted, and your name and email address are removed from the organizations’ records. Content you added to an organization stays with that organization (section 2).
If you are the only member of an organization, the organization is deleted with your account, including its surveys and responses, and any paid subscription is canceled. If you own an organization that has other members, you need to transfer its ownership or delete the organization first.
If your organization manages your account through single sign-on, ask your organization’s administrator to remove you, or email privacy@usertick.com. Usertick deletes an account that single sign-on created 30 days after the organization removes it, if it belongs to no other organization. Signing in again before then cancels the deletion.
Deleting an organization
An organization’s owner can delete it. Usertick stops collecting responses for the organization at once, and the deletion takes effect 14 days later; until then the owner can cancel it. When it takes effect, Usertick cancels any paid subscription and deletes the organization’s data, including its responses and files. The members’ own accounts are not affected.
If Usertick blocks an account
If Usertick blocks an account or deactivates an organization, for example after a serious breach of the terms, it keeps the data only as long as it needs to deal with the breach, to establish, exercise or defend legal claims, or to meet a legal obligation, and then deletes it. You can ask about this at privacy@usertick.com.
Deleting your account doesn’t unsubscribe you from the newsletter if you signed up for it separately; use the unsubscribe link in any newsletter email. To ask Usertick to delete anything else it holds about you, email privacy@usertick.com.
8. Your rights
Under the UK GDPR you have the right:
- to be told how your personal data is used, which is what this notice does;
- to get a copy of your personal data (access);
- to have inaccurate or incomplete data corrected (rectification);
- to have your data deleted in certain circumstances (erasure);
- to have the use of your data restricted in certain circumstances (restriction);
- to receive the data you gave Usertick in a structured, machine-readable format, or have it sent to another organization, where the use is based on contract or consent (portability);
- to object to any use of your data based on legitimate interests, on grounds relating to your situation, and to object at any time to the use of your data for direct marketing, which Usertick then stops (objection);
- to withdraw your consent at any time, where Usertick relies on consent; and
- not to be subject to significant decisions based solely on automated processing without safeguards (see section 10).
To use any of these rights, email privacy@usertick.com or write to the registered office. You can also correct your profile and delete your account yourself in Usertick (section 7), and turn off product email in your settings or with the link in any of those emails. Usertick may ask you to confirm your identity before it acts. It answers without undue delay and within one month of receiving the request, or of receiving what it needs to confirm your identity. Where requests are complex or numerous, Usertick may extend this by up to two further months, and it tells you why within the first month. If Usertick needs you to clarify what you are asking for, the time limit pauses until you reply. When you ask for a copy of your data, Usertick carries out a reasonable and proportionate search. Using your rights is free; Usertick may refuse a request, or charge a reasonable fee, only where the request is manifestly unfounded or excessive, and it tells you why.
For survey responses and other data that Usertick processes for a customer (section 2), contact the customer. Usertick helps its customers answer these requests.
9. How to complain
If you are unhappy with how Usertick handles your personal data, please complain to Usertick first, at privacy@usertick.com or by post to the registered office. Usertick acknowledges every data protection complaint within 30 days of receiving it, looks into it, keeps you informed and tells you the outcome without undue delay, as section 164A of the Data Protection Act 2018 requires.
You also have the right to complain to the UK regulator, the Information Commission (ICO), under section 165 of the Data Protection Act 2018, at ico.org.uk/make-a-complaint. If you live in the European Economic Area, you can also complain to the data protection authority in your country.
10. Automated decisions
Usertick does not make decisions about you based solely on automated processing that have legal effects on you or similarly significant effects. Automated security checks, such as limits on sign-in attempts and the bot check on forms, can briefly block a request; if one blocks you, contact support@usertick.com and a person will look at it. The AI features read survey answers for Usertick’s customers (for example to find themes and sentiment); they make no decisions about the people who answered or about you.
11. Security
Usertick protects personal data with technical and organizational measures that include encryption in transit and at rest, access controls, two-factor authentication, logging, and confidentiality and limited access for its staff. The security page describes the security features of the product.
12. Cookies
usertick.com sets one strictly necessary cookie that keeps your choice about optional cookies, and its optional analytics and marketing tools set cookies only as section 4 and the cookie policy describe. The Usertick app uses cookies and browser storage that are strictly necessary or that remember your preferences. The cookie policy lists each of them, explains the storage on hosted survey pages and in the widget on customers’ websites, and says how to remove it.
13. Children
Usertick is a business service. You must be 18 or older to create an account. Usertick’s services are not intended for people under 16: customers must not aim surveys at them or knowingly collect their responses, unless Usertick has agreed otherwise in writing, and Usertick does not knowingly collect personal data about people under 16. Usertick does not verify the age of the people who answer surveys. If Usertick learns that it holds personal data about a person under 16, it deletes the data, and when the data came through a customer’s survey, it tells that customer. If you believe that Usertick holds such data, contact privacy@usertick.com.
14. Changes to this notice
Usertick updates this notice when its use of personal data changes. The “last updated” date at the top shows when that last happened. Usertick tells account holders about material changes by email or in the app before they take effect.
15. Contact
Questions about this notice go to privacy@usertick.com, or by post to Usertick Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
16. Contacts for specific countries
Some data protection laws ask Usertick to name a contact. For each of them, the contact is privacy@usertick.com, which reaches the person responsible for data protection at Usertick:
- Canada. The person accountable for Usertick’s compliance with the Personal Information Protection and Electronic Documents Act is the person responsible for data protection at Usertick.
- Quebec. The person in charge of the protection of personal information at Usertick is Furkan Çetin, a director of Usertick Ltd.
- Brazil. Usertick’s encarregado under the General Data Protection Law (LGPD) is Furkan Çetin, a director of Usertick Ltd.
- India. Questions about how Usertick processes your personal data under the Digital Personal Data Protection Act, 2023 can be sent to the person responsible for data protection at Usertick.
- United States. Usertick does not sell personal information and does not share it for cross-context behavioral advertising, as the California Consumer Privacy Act and similar US state laws define those terms. Where such a law gives you rights, such as the rights to know, correct or delete your personal information, you can use them by emailing privacy@usertick.com, and Usertick does not discriminate against you for doing so.