Effective 22 July 2026
Fivesay is designed so that respondent anonymity is technically enforced — not just promised. This policy describes what information we process, why, where it is stored, and your rights under the GDPR and the Icelandic Data Protection Act No. 90/2018.
The service is operated by Nómi ehf., Reykjavík, Iceland. Privacy inquiries: privacy@fivesay.com.
Our role is twofold:
When someone answers a pulse, we store the scores, the eNPS answer (where applicable) and the written comment — and nothing else. No names, email addresses, IP addresses, browser or device information accompany the answer into the database.
| Data | Purpose and legal basis | Retention |
|---|---|---|
| Account: work email and name | Sign-in and account operation — contract (Art. 6(1)(b) GDPR) | Until the account is deleted |
| Sign-in links by email | Secure passwordless sign-in — contract | Each link is valid for 10 minutes |
| Mailing lists (staff emails on your own domain) | Survey delivery on your company's behalf — processed as a processor | Until the owner deletes the list or the account |
| Ballots (single-use answer keys) | One answer per person without recording who answered — only a SHA-256 hash is stored, never linked to the answer itself — legitimate interest (result integrity) | Unused keys are invalidated when a survey is re-sent |
| Survey answers | Aggregate results for the group — no personal identifiers, see section 2 | For the lifetime of the pulse |
| Hosting provider logs (incl. short-lived IP addresses) | Security, debugging and abuse prevention — legitimate interest | Short-term retention at Vercel |
| Web analytics (Vercel Analytics) | Aggregate, cookieless usage statistics that do not identify individuals — legitimate interest | Aggregate only |
We use strictly necessary cookies only — no advertising or tracking cookies, and no third-party tracking pixels.
| Cookie | Purpose | Lifetime |
|---|---|---|
| Session cookie | Keeps a registered user signed in | For the session |
| Language cookie (NEXT_LOCALE) | Remembers your language choice | 1 year |
| “Already answered” cookie (one per pulse) | Prevents duplicate answers — lives only in your browser and is never stored on our side | 30 days |
| Results admin cookie | Gives the person who created a pulse access to their results page | 30 days |
We use the following subprocessors to operate the service:
| Provider | Role | Data location |
|---|---|---|
| Neon Inc. | Database (Postgres) | European Union (AWS data centers in the EU) |
| Vercel Inc. | Web hosting and runtime | Compute in the EU; global CDN for static assets |
| Resend Inc. | Email delivery | United States |
The database — where answers, lists and accounts are stored — is hosted within the EU. Email delivery and parts of web hosting involve processing in the United States; those transfers rely on the European Commission's adequacy decision under the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses (SCCs). Remember: the survey answers themselves contain no personal identifiers.
Under data-protection law you have the right to access your data, and to rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interest. Send requests to privacy@fivesay.com; we respond within one month.
Note: rights concerning your email address on your employer's mailing list should be raised with your employer, who is the controller of that processing — we assist them in fulfilling such requests. Rights do not extend to anonymous survey answers, see section 2.
You may lodge a complaint with the Icelandic Data Protection Authority, Persónuvernd (personuvernd.is), or your local supervisory authority.
The service is a workplace tool and is neither intended for nor directed at children.
We update this policy when the service changes — for example if a subprocessor is added. Material changes will be announced to registered users. The effective date at the top always reflects the current version.