Skip to content
Join on Telegram Create a survey

Privacy Policy

Last Updated: October 3, 2026

Welcome to FillASurvey! Your privacy is critically important to us. This Privacy Policy explains how we collect, use, disclose, and protect your personal information in compliance with the Nigeria Data Protection Act 2023 (NDPA) and Nigeria Data Protection Regulation (NDPR).

FillASurvey is a subsidiary of GoRemote Africa.

IMPORTANT: By creating an account, accessing, or using FillASurvey, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with any part of this Privacy Policy, you must not use our Service.

Data Controller Information

FillASurvey is the Data Controller for your personal information and operates as a subsidiary of GoRemote Africa.

Information We Collect

Personal Information You Provide

Account Registration:

  • Name (first name and last name)
  • Email address
  • Phone number (optional)
  • Password (encrypted)
  • Workspace name (for creators)

Profile Information:

  • Profile picture
  • City, region, country
  • Age and gender (optional)
  • Interests and preferences
  • Notification preferences

Survey Participation:

  • Survey responses and answers
  • Short-lived survey activity signals that let authorised staff see which unfinished responses are currently active. A visible survey page sends an activity update while you answer; activity expires after 45 seconds without an update. These signals do not extend your reservation or affect your rewards.
  • Time spent on surveys
  • Device and browser information
  • Location data (anonymized: country, region, city)

Payment Information:

  • Payment card and bank details (processed by Fincra, not stored by us)
  • Bank account information (for cashouts)
  • Transaction history
  • Wallet balance

Identity Verification:

  • ID verification status
  • ID verification outcome status (not started, pending, success, failed)
  • ID verification failure reason (if verification fails)
  • Profile verification score

BVN Processing for ID Verification:

  • Bank Verification Number (BVN) or other identity document numbers submitted by you for validation
  • We transmit identity document details to Prembly only for verification
  • We store masked verification identifiers and verification outcome metadata only

Customer Support:

  • Chat messages (when using support chat)
  • Email communications
  • Support ticket information

Information Collected Automatically

Technical Data:

  • IP address (hashed for privacy)
  • Device type (mobile, desktop, tablet)
  • Operating system and version
  • Browser type and version
  • Session tokens
  • Login history

Usage Data:

  • Pages visited
  • Features used
  • Time spent on platform
  • Click patterns
  • Error logs

Location Data:

  • Country, region, city (anonymized)
  • Timezone
  • Locale preferences

How We Use Your Information

We use your personal information for the following purposes:

Service Provision

  • Create and manage your account
  • Process survey responses
  • Deliver survey results to creators
  • Process payments and manage wallets
  • Provide customer support
  • Send transactional emails (password resets, confirmations)

Communication

  • Respond to your inquiries
  • Send important service updates
  • Send marketing communications (with your consent)
  • Notify you of survey opportunities

Legal Compliance

  • Comply with Nigerian data protection laws
  • Comply with financial regulations (payment processing)
  • Respond to legal requests
  • Prevent fraud and abuse

Service Improvement

  • Analyze usage patterns
  • Improve platform functionality
  • Develop new features
  • Ensure platform security

Legal Basis for Processing

We process your personal information based on:

  1. Consent: When you explicitly consent (e.g., marketing emails, optional profile data)
  2. Contract: To fulfill our service agreement with you (e.g., processing survey responses, payments)
  3. Legal Obligation: To comply with Nigerian laws (e.g., financial record retention)
  4. Legitimate Interest: For security, fraud prevention, and service improvement

Third-Party Service Providers

We use the following third-party services to operate our platform. Each processes your data as a Data Processor under our instructions:

Fincra (Payment Processing)

Purpose: Process wallet top-ups and cashouts

Data Processed:

  • Email address
  • Name
  • Phone number
  • Payment card information (encrypted)
  • Bank account details (for cashouts)
  • Transaction amounts and references

Data Storage: United Kingdom

Privacy Policy: https://fincra.com/privacy-policy

Optional Google Forms Connection

Researchers can separately authorize read-only access to Google form definitions and Google Drive file metadata so they can choose a form and import it. This connection is separate from Google sign-in and does not merge accounts. We use a verified Google account identifier to bind the resource connection and keep refresh credentials encrypted on the server. Access credentials are used only in server memory and are not returned to the browser.

We import the reviewed form definition and retain its source reference and conversion provenance with the native survey. We do not import existing Google responses or continuously synchronize the source. Disconnecting removes local access immediately and queues revocation with Google; deleting an account also removes its retained connection credentials and temporary previews. Imported native survey records follow the survey and research-record retention described in this policy.

Optional Browser Push

If you enable browser push, we store an account-owned device identifier, label, app surface and the subscription endpoint/keys needed for encrypted delivery through your browser's Google, Mozilla or Apple push service. You can disable a device or all push messages in notification settings. Revocation, subscription expiry and account deletion clear the device's delivery credentials. Delivery history retains safe status metadata. Browser permission and push preferences are independent of email marketing preferences.

Prembly (Identity Verification)

Purpose: Verify user identity (BVN, NIN, passport, voter card, driver's license, documents)

Data Processed:

  • Identity document numbers (BVN, NIN, etc.)
  • Name
  • Document images (when applicable)
  • Verification outcome metadata

ID Validation Flow with Prembly:

  • Verification is processed synchronously by Prembly.
  • We submit identification details to Prembly and receive the result immediately.
  • We use the result to update your verification status in the product UI.

Data Minimization Commitment:

  • We do not persist plaintext BVN in our database.
  • We may temporarily process identity document details in transit/server memory solely to submit verification to Prembly.
  • We retain an HMAC fingerprint of the document number for uniqueness checks, the verified name, document type, verification outcome and review metadata. The plaintext document number and provider response payload are not stored.

Privacy Policy: https://prembly.com/privacy-policy

Telegram (Authentication)

Purpose: User authentication and account access

Data Processed:

  • Telegram user ID
  • Phone number (registered with Telegram)
  • Authentication tokens
  • Session data

Data Storage: Netherlands and multiple international locations

Important Notice:

  • Telegram is not registered with the Nigeria Data Protection Commission (NDPC)
  • Telegram does not have confirmed NDPR compliance
  • In September 2024, Telegram updated its privacy policy to share user IP addresses and phone numbers with law enforcement upon valid court orders for Terms of Service violations
  • By using Telegram authentication, you consent to international data transfer with these risks

Privacy Policy: https://telegram.org/privacy

Alternative: If you prefer not to use Telegram authentication, please contact [email protected] for alternative access methods.

Plunk (Email Communications)

Purpose: Send transactional and marketing emails

Data Processed:

  • Email address
  • Name (if provided)
  • Email interaction data (opens, clicks, bounces)
  • Subscription preferences
  • Custom metadata

Data Storage: Amazon Web Services (exact region not specified, likely USA or EU)

Subprocessors:

  • Amazon Web Services (AWS) - Cloud hosting and email delivery

Privacy Policy: https://useplunk.com/privacy

Note: We are evaluating self-hosting Plunk on Nigerian infrastructure to achieve full data localization. We will notify you of any changes.

International Data Transfers

Your personal data is transferred and processed outside Nigeria by the following services:

  1. Fincra - United Kingdom
  2. Prembly - Nigeria
  3. Telegram - Netherlands and multiple jurisdictions (requires your explicit consent)
  4. Plunk - AWS (likely USA/EU, exact location unspecified)

Safeguards for International Transfers:

  • Encryption of data in transit and at rest
  • Contractual safeguards through Data Processing Agreements
  • Security certifications (ISO, PCI-DSS where applicable)
  • Your explicit consent for transfers without adequacy determination

Your Rights: You can withdraw consent for international data transfers at any time by contacting [email protected]. Note that withdrawing consent may limit your ability to use certain features.

Data Retention

We retain your personal information for the following periods:

  • Account Information: Duration of account plus 2 years after account closure
  • Survey Responses: Until you request deletion or 5 years (whichever is sooner)
  • Payment Records: 7 years (legal requirement for financial records)
  • Support Chat: 2 years or until issue resolved
  • Email Data: Until you unsubscribe or 2 years of inactivity
  • Session Data: Dashboard sessions expire after 30 days and can be revoked in account security settings. Mini app bearer tokens expire after 15 minutes.
  • Activity Logs: 2 years

After retention periods expire, we securely delete or anonymize your data.

Your Data Protection Rights

Under the Nigeria Data Protection Act 2023, you have the following rights:

1. Right to Access

You can request a copy of all personal data we hold about you.

2. Right to Rectification

You can request correction of inaccurate or incomplete data.

3. Right to Erasure

Dashboard account settings and mini app profile settings provide export and deletion. Deletion requires a zero earnings balance, no pending payout and no owned workspaces. It anonymises account data and removes access; survey responses and ledger records remain associated with an anonymised account. There is no account recovery window. Contact support about retained operational or financial records.

4. Right to Data Portability

You can request your data in a structured, machine-readable format.

5. Right to Object

You can object to processing of your data for specific purposes.

6. Right to Restrict Processing

You can request limitation of how we use your data.

7. Right to Withdraw Consent

You can withdraw consent at any time for consent-based processing.

8. Right to Lodge Complaint

You can file a complaint with the Nigeria Data Protection Commission (NDPC).

How to Exercise Your Rights:

Contact us at:

Please provide:

  • Your name and contact information
  • Specific right you wish to exercise
  • Any additional information to help us verify your identity

Response Time: We will respond within 30 days of receiving your request. We may request additional information to verify your identity before fulfilling your request.

Data Security

We implement appropriate technical and organizational measures to protect your personal information:

  • Encryption: Data encrypted in transit (TLS/SSL) and at rest (AES-256)
  • Access Controls: Role-based access, authentication required
  • Regular Security Audits: Annual security assessments
  • Employee Training: Data protection training for all staff
  • Incident Response: Comprehensive breach response plan

Data Breach Notification

In the event of a data breach that may pose risk to your privacy:

  1. NDPC Notification: We will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach.

  2. User Notification: We will notify you immediately if the breach poses high risk to your rights and freedoms.

  3. Information Provided: We will provide information about:

    • Nature of the breach
    • Data categories affected
    • Likely consequences
    • Measures taken to address the breach
    • Steps you can take to protect yourself

Report Suspected Breaches: [email protected]

Cookies and Tracking Technologies

We use cookies and similar technologies to:

  • Maintain your login session
  • Remember your preferences
  • Analyze website usage
  • Provide customer support chat

For detailed information about cookies, see our Cookie Policy.

Children's Privacy

We do not knowingly collect personal data from children under 18 without parental consent. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at [email protected].

Marketing Communications

We may send you marketing communications if you have consented. You can:

  • Unsubscribe using the link in any marketing email
  • Update preferences in your account settings
  • Contact us at [email protected]

Transactional emails (password resets, survey invitations, receipts) are sent as part of service provision and cannot be unsubscribed from.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

  • Posting the updated policy on our website
  • Sending you an email notification (for significant changes)
  • Requiring re-consent for material changes affecting data processing

Last Updated: October 3, 2026

Contact Information

Data Protection Officer:

Privacy Inquiries:

Security Incidents:

Nigeria Data Protection Commission (NDPC): If you have concerns about our data processing practices or wish to file a complaint:

Your Responsibilities

You are responsible for:

  1. Accurate Information: Providing accurate, current, and complete personal information
  2. Information Updates: Promptly updating your information when it changes
  3. Account Security: Maintaining the security of your account credentials
  4. Third-Party Services: Understanding and accepting the privacy practices of third-party services we use
  5. Consent Withdrawal: Understanding that withdrawing consent may limit Service functionality
  6. Policy Review: Periodically reviewing this Privacy Policy for changes

You acknowledge that:

  • We rely on the accuracy of information you provide
  • False or misleading information may result in account termination
  • You are responsible for maintaining the confidentiality of your account
  • We are not liable for unauthorized access resulting from your failure to secure your account

Consent and Agreement

By creating an account, clicking "I Agree", "Sign Up", "Register", or otherwise accessing or using FillASurvey, you acknowledge the processing needed to operate the Service as described in this policy. Optional marketing communications require your separate consent. You may withdraw consent for future consent-based processing. The Service processes data for:

  1. All data processing activities described in this Privacy Policy
  2. International data transfers to the third-party services disclosed herein
  3. Storage of your data outside Nigeria as described in this Policy
  4. Processing of sensitive data (financial, biometric) where applicable
  5. Use of cookies and tracking technologies as described in our Cookie Policy
  6. Communication methods including email, SMS, and in-app notifications

Your consent is:

  • Freely given - You have the right to refuse, but this may limit Service functionality
  • Specific - For the purposes clearly described in this Policy
  • Informed - You have been fully informed of all data processing activities
  • Unambiguous - Your use of the Service constitutes clear affirmative action

Withdrawal of Consent: You may withdraw your consent at any time by:

  • Contacting us at [email protected]
  • Using account settings to update preferences
  • Requesting account deletion

Consequences of Withdrawal: Withdrawing consent may result in:

  • Inability to use certain Service features
  • Account limitations or termination
  • Loss of access to previously collected data

Continued Use: Your continued use of the Service after any changes to this Privacy Policy constitutes acceptance of the updated Policy. We will notify you of material changes, but it is your responsibility to review this Policy periodically.

Binding Agreement: This Privacy Policy, together with our Terms of Service, constitutes a legally binding agreement between you and FillASurvey. By using our Service, you represent and warrant that:

  • You have read, understood, and agree to be bound by this Privacy Policy
  • You have the legal capacity and authority to enter into this agreement
  • You are at least 18 years old (or have parental consent if under 18)
  • All information you provide is accurate and truthful
  • Your consent is freely given, specific, informed, and unambiguous

No Withdrawal of Past Consent: While you may withdraw consent for future processing, you cannot withdraw consent for data already processed in accordance with this Policy. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Severability: If any provision of this Privacy Policy is found to be unenforceable, the remaining provisions will remain in full force and effect.

Entire Agreement: This Privacy Policy, together with our Terms of Service and Cookie Policy, constitutes the entire agreement regarding data processing between you and FillASurvey.