Contact Info

Log in
Sign up

Privacy Policy

Last updated: 25 August 2026

Key points

This is a plain-language summary of our full policy below. It doesn't replace it — if the two ever conflict, the full policy governs.

  • We collect what we need to run Diggle: account info, the content you create, billing details, and basic technical/log data. If you're a participant, we collect what you submit in a session.
  • If you use an AI Feature (chat, content generation, design suggestions, translation, document upload, or grouping open-ended answers), the data relevant to that request — including, where applicable, participant answers — is sent to our AI sub-processor to provide that feature. We don't use that data to train AI models. See "AI features" below.
  • You're the data controller for personal data you or your participants put into Diggle (for example, in a survey). We're the processor.
  • We share data with named sub-processors who help us run the service (including hosting, payments, email, security, consent management, and AI), never for their own marketing purposes, and always under a data processing agreement. We never sell your personal data.
  • You can access, correct, or delete your data by contacting [email protected]. See "Your rights and choices."
  • Our main data center is in the EU (France). Where personal data is transferred outside the EEA, we use an applicable GDPR transfer mechanism, such as an adequacy decision, the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses.
  • When you interact with an AI Feature, we'll let you know within the product, in line with the EU AI Act.
  • Our technical and organizational security measures are described in full in our separate Security Policy.

Definitions

The Landing Page means diggle.com and www.diggle.com and help.diggle.com. The App means app.diggle.com, godiggle.com, puppeteer.diggle.com, and any other diggle.com subdomain. Together, these make up the Platform; the Platform plus support from our team makes up the Service. A Supporting Service is one of our sub-processors. Output means whatever an AI Feature generates for you — including drafted text, design suggestions, translations, and groupings or summaries of open-ended answers.

Diggle Users fall into these categories:

  • Account Owner — the person or company that pays for the App.
  • Creators — people who create content and host sessions on the App.
  • Participants — people who take part in sessions Creators run.
  • Translators — people invited to review and edit AI-generated translations of a Diggle. Translators can view and edit content in the language(s) they're invited to work on.

Every account has one Account Owner, who may invite several Creators; because Account Owners are also Creators within their own account, anything that applies to Creators applies to Account Owners too. "Account" means the data stored in the App for an Account Owner.

Your data is your data

We only collect what we need to deliver and improve the Service. Below is what we collect, why, and the GDPR legal basis for each.

What data we collect

  • User account information. Email and username, used to operate the Service, keep it secure, maintain backups, and communicate with you. Required to deliver the Service under our contract with you (GDPR art. 6(1)(b)).
  • Transaction information. Billing details such as card information, billing email, banking details, transaction location, and billing address, processed by us and our payment processor to deliver paid services and keep transaction records. Required to perform our contract (art. 6(1)(b)) and to comply with accounting/tax law (art. 6(1)( c)).
  • Technical log data. IP address, pages visited, browser type and settings, and timestamps, collected automatically when you use the Platform.
  • Device information. Device type, OS, settings, app IDs, unique identifiers, and crash data. Legal basis: our legitimate interest in running, securing, and improving the Service and assisting with support (art. 6(1)(f)), and performing our contract with you.
  • Service and transactional notifications. Emails about your account, service changes, or policy updates. You can't opt out of these (short of deleting your account) — legal basis is our contract with you (art. 6(1)(b)) and our legitimate interest in keeping you informed (art. 6(1)(f)).
  • AI feature data. If you choose to use an AI Feature, we process what you give it — chat messages and prompts, questions and answers you ask AI to generate or improve, documents you upload, and, where you ask an AI Feature to read or edit them, your Diggle's existing content and settings. This also covers the text of your Diggle when you use AI Translation, and Participant answers to open-ended questions when you or another Creator use AI to group or summarize them. This data goes to our AI sub-processor(s) (see "Our third-party sub-processors") solely to provide the feature you requested. We do not use this data, and do not permit our AI sub-processors or any other third party to use it, to train or improve AI models. Legal basis: performance of our contract with you (art. 6(1)(b)), triggered by your choice to use the feature.

Your responsibility

If you store personal data in Diggle — for example, by running a survey — you're the data controller for that data, including data you collect from participants, and you're responsible for complying with GDPR and local law.

This includes AI Features: if you upload a document to an AI Feature, ask it to use your existing Diggle content, or use AI to group or summarize Participants' open-ended answers, you remain the controller for that personal data. Our AI sub-processor only processes it to carry out the request you made.

Database backups

Data is backed up hourly and retained for up to 21 days. If you need something deleted faster, email us and we'll speed it up. You're free to distribute answer-display images and Excel reports from your sessions, but you're responsible for complying with personal-data rules when you do. If you cancel your subscription, your account becomes a trial account and your data remains; you can request full account deletion at [email protected], after which your data is removed from our servers (and from backups after the retention period above).

Information you provide voluntarily

  • Contact data. Email, name, and optionally a phone number for support.
  • Content data. Anything you create or upload — exercises, titles, choices, URLs, pictures, demographics — and, as a Participant, your answers or inputs.
  • Billing data. For predefined subscription plans, our processor (Stripe) collects your billing address and card details; we don't store card numbers, type, or expiry ourselves.
  • Profile data. Where you consent (for example, to get our newsletter), a third-party marketing/email tool receives parts of your profile — name, username, email, plan — to help us manage and grow the Service.

Information collected automatically

Like most websites, we and our service providers may use cookies, web beacons, and similar technology when you use the Platform, subject to your opt-out preferences below. This includes log and device data — the page you came from or are going to, device model, OS, browser, unique identifier, IP address, network carrier, and time zone/location — which varies by device and its settings.

Cookies and other tracking

We may use session cookies (until you close your browser) or persistent cookies (until deleted), including to keep you logged in. Some are tied to your account. We may confirm when you open a marketing email, if your device supports it. You can opt out of marketing emails but not transactional ones. We may use third-party analytics providers such as Google Analytics — as of today, we don't use Google Analytics, and we'll update this policy if that changes.

How we use your information

We use your information to: provide and manage the Service, including facilitating sessions between Creators and Participants; understand and improve our products; communicate with you (service-related messages you can't opt out of, and promotional messages you can); respond to your requests; keep you informed about changes to our services or this policy; protect our and our users' rights; comply with legal obligations; and manage our business consistent with what we've described here.

With whom we may share your information

We never sell your personal data, and we never will. We don't share personal information beyond what's described in this policy, or without letting you opt out where relevant. We may share it with: our sub-processors; EEA-based subcontractors who help us improve the Service; recipients required by law (courts, regulators, law enforcement) or needed to enforce our terms or protect safety and rights; a party involved in a merger, acquisition, or similar transaction; aggregated or de-identified data for research or marketing; and, if you sign up with an organization email, that organization's Account Owner, who can then move your account into their workspace and apply their own policies (use a personal email if you'd rather avoid this).

Independent third-party services: Some optional features connect to third-party services that act as independent controllers rather than as our sub-processors. When you use Unsplash image search or display Unsplash images in Diggle, certain search-related and technical request data may be sent to Unsplash. Unsplash processes personal data it receives under its own Privacy Policy .

If you choose Sign in with Facebook, Meta authenticates your Facebook account and provides Diggle with your name and email address. Meta processes information associated with Facebook Login under its own Privacy Policy.

If you choose Sign in with Google, Google authenticates your Google account and provides Diggle with account information used for authentication, such as your name and email address. Google processes information associated with your Google account under its own Privacy Policy.

Google Drive and Google Slides. If you choose to import a presentation from Google Drive or Google Slides, you authorize Diggle to access the file you select. Diggle downloads the selected file from Google, converts it into a format that can be used in Diggle, and stores the imported content as part of your Diggle. We use the Google user data obtained through this integration only to provide the import functionality you requested. Google processes information associated with your Google account and Google Drive under its own Privacy Policy.

Legal basis for processing your information

We rely on: your consent, where given (withdraw it anytime at [email protected]); performance of our contract with you; and our legitimate interests in providing, improving, and marketing the Service, balanced against your rights.

Your rights and choices

You can review and update your account information in your settings, or contact us to request details of what we hold, or a correction, modification, or deletion, subject to our legal obligations. You can unsubscribe from marketing email via the link in any message (allow up to 10 days to process) — you'll still get service-related emails unless you deactivate your account. You can manage cookies through your browser. Some third-party analytics tools offer their own opt-outs. We don't currently respond to browser "Do Not Track" signals. You may have further rights under local law, including the right to complain to your data protection authority.

  • AI Features. In line with the EU AI Act, we'll let you know within the product when you're interacting with an AI system. Where the law requires it, AI-generated output will be marked as such. AI Features are optional — Diggle is fully usable without them.
  • Automated decision-making. We don't use your personal data for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

International transfers

We may transfer, process, and store your information outside your home country where our service providers operate. Where personal data is transferred outside the EEA, we use an applicable lawful transfer mechanism depending on the recipient and destination. This may include an EU adequacy decision, the EU-U.S. Data Privacy Framework, or EU Commission-approved Standard Contractual Clauses. Our sub-processors are also subject to appropriate data processing agreements. Our main application, database, backups, and AI infrastructure are hosted in France within the EEA. See our Data Processing Agreement and current sub-processor list for more information.

Our third-party sub-processors

See our sub-processor list for the current, complete list of our sub-processors and the services they provide.

Security and storage of information

We've implemented technical and organizational measures to keep data sent to Diggle secure. You can choose between different security settings when inviting participants; higher security means more complexity for you and them, so simpler, less secure options remain available by choice. We're not responsible for privacy breaches that happen because a simpler, less secure option was chosen.

Levels of security when joining a Diggle

  • Live session: access expires automatically after 48 hours by default; you can choose a longer login code than the 8-character default, and anonymous or nickname login.
  • Invite by link: expiration is set manually, defaulting to 48 hours.
  • Email verification: available to all customers — a six-character code, valid 15 minutes with three attempts.

We may adjust these configurations without notice to improve security or experience.

Hosting and processing, in brief

Scaleway (France) hosts our application, database, backups, and user-uploaded images, and is ISO 27001:2013, HDS, ISO 50001:2018, and Tier 3 Uptime Institute certified, and GDPR- and SWIPO-compliant. For AI Features, we use Scaleway's generative-AI infrastructure, also hosted in France. The underlying model is an open-weight model originally developed by OpenAI, but it's hosted and operated by Scaleway — under our current setup, OpenAI doesn't receive your prompts or the content Diggle generates for you. We may use additional or different AI providers as these features develop — see our sub-processor list for the current, up-to-date list. Data is encrypted at rest and in transit; card details are held by Stripe, a Level 1 PCI-compliant processor. Our full technical and organizational security measures — encryption standards, access control, incident response, and engineering practices — are described in detail in our separate Security Policy.

Changes to this policy

We may update this policy from time to time; if we make material changes, we'll post them here and, where required, notify you as described in our Terms & Conditions. Continuing to use Diggle after a change takes effect means you accept it.

Contacting us

Questions or comments about this policy: [email protected]. Notices to us should be in English or Norwegian, to the same address.