Security and privacy
Where your data goes
For security and procurement reviews. Each line describes what the product does today.
Updated October 14, 2026 · Privacy Policy
Where data is stored
Our database, file storage, app and background jobs run in the United States.
| System | Provider | Region | Holds |
|---|---|---|---|
| Database | Supabase (PostgreSQL) | United States | Accounts, studies, responses and transcripts |
| Files | Amazon S3 | us-east-1 | Recordings and files respondents upload |
| App and API | Vercel | iad1 (US East) | Requests and logs |
| Background jobs | Trigger.dev | us-east-1 | Job data for reports, exports and deletions |
Encryption
- In transit. The site, the app and the API are served over HTTPS. Voice, video and screen-share interviews stream over encrypted WebRTC through LiveKit Cloud.
- Stored data. Recordings and uploaded files are stored encrypted in Amazon S3. Webhook signing secrets and the credentials for connected integrations, such as Slack, Google Sheets, Qualtrics and panel accounts, are encrypted with AES-256-GCM before they are saved.
Subprocessors
These providers are part of the default setup. The voice providers handle only voice interviews.
| Provider | What it does |
|---|---|
| Supabase | Database |
| Amazon Web Services | Storage for recordings and uploaded files |
| Vercel | Hosting for the site, the app and the API |
| Trigger.dev | Background jobs: reports, exports and deleting recordings |
| Anthropic | Default AI model for voice interviews, analysis, reports and response quality checks |
| OpenAI | Default AI model for text interview follow-ups, and transcription of recorded voice answers |
| LiveKit | Live audio, video and screen sharing in voice interviews, and routing to speech and voice providers |
| Deepgram | Default speech recognition in voice interviews, through LiveKit |
| ElevenLabs | Default interviewer voice, and speech recognition for Swahili, Amharic and Kinyarwanda |
| MaxMind | IP geolocation for responses, unless Minimize IP and location data is on |
| Sentry | Error reports |
| PostHog | Product analytics. Open-ended answers and transcripts are kept out of events. |
| Postmark | Email, including verification codes |
| Stripe | Billing and payments |
Only when a study uses the feature
- Google: Gemini models when a researcher picks one, backup transcription, and some interviewer voices.
- OpenRouter: Models from other providers, when a researcher picks one for a text interview.
- Cartesia and AssemblyAI: Voices and speech recognition, when chosen for a voice interview.
- Twilio: Text-message codes, when phone verification is on.
- Giftbit, Tavus, LemonSlice and panel providers: Gift-card incentives, video avatars and panel recruitment, when a researcher turns them on.
Deleting data
- Responses. Delete any response or respondent from a study. A background job then deletes its recordings from storage.
- Your account. Delete your account in Settings. This cancels any subscription, removes your billing record from Stripe, deletes your studies and responses, and deletes their recordings and files.
- By email. Researchers and participants can send privacy requests, including deletion requests, to privacy@questionpunk.com.
- Retention. Studies and responses stay until you delete them or ask us to.
GDPR
- Roles. For a study a researcher runs, the researcher is the controller and BIALEROLOGY LLC, which operates QuestionPunk, is the processor. For account data and our own studies, BIALEROLOGY LLC is the controller.
- Minimize IP and location data. A setting on each study, off by default. When it is on, the study stops collecting respondent IP addresses and locations for new and in-progress responses. It also keeps location out of AI prompts and turns off the study's tracking pixels. Hosting and error logs can still record IP addresses.
- AI consent screen. On by default before voice interviews. It tells participants what is recorded, which providers process the conversation, and how to withdraw.
- Ad measurement. For visitors in the EEA, the UK and Switzerland, the app does not send a hashed email address to ad platforms.
- EU representative. Prighter Group is our representative under Article 27 of the GDPR. Contact Prighter.
Contact
For a security review or vendor questionnaire, email jake@questionpunk.com. For a privacy request, email privacy@questionpunk.com.