1. Operating Entity & Core Principles
This Privacy Policy describes how Leatra Technologies LTD (“Leatra Technologies”, “ZapPoll”, “we”, “us”, or “our”), a company registered and incorporated under the laws of the Federal Republic of Nigeria, collects, protects, processes, and handles personal data through our software platform at zappoll.com, app.zappoll.com, and our ingestion endpoints at api.zappoll.com.
ZapPoll was architected specifically to dismantle surveillance-capitalism models in survey and form software:
- Zero Cross-Site Ad Tracking: We do not deploy third-party advertising cookies, retargeting pixels, social trackers, or data-broker SDKs.
- Per-Poll Commercial Model: Capabilities are purchased as discrete, one-time grants tied permanently to an individual poll. We do not store persistent billing profiles to execute recurring auto-renewals.
- Invariant Privacy Ceilings: Purchasing additional capacity or advanced analytics never weakens a privacy promise. Payment cannot attach identity to responses collected by a poll that never asked for it.
A commercial purchase controls feature availability and response capacity; it never overrides what a poll collects about a respondent, authorization, or retention. No purchase can add identity to answers given to a poll that did not ask for it.
2. The Creator vs. Respondent Boundary
ZapPoll enforces a strict architectural boundary between two distinct user roles:
Creators
Creators design, configure, publish, and analyze polls or headless form endpoints. Creators authenticate through our dedicated authentication gateway (powered by Keycloak) using passwordless methods (single-use Email OTP or Google identity brokering) with PKCE-protected tokens stored exclusively in browser memory. Creators belong to workspaces that own polls and billing records.
Respondents
Respondents submit votes, answers, or form data. Respondents never enter the creator authentication boundary and never need an account to participate. A respondent opens a link, scans a QR code, or submits an external form. Respondent access is scoped strictly to that specific poll and cannot inherit creator permissions or cross workspace boundaries.
3. Identity Collection: Anonymous and Identified
When a creator publishes a hosted poll, they choose whether the poll asks respondents who they are. Once the first response is accepted, that choice is permanently locked for that poll ID.
| Setting | What Creators See | Individual Row Access | Respondent Identifiers |
|---|---|---|---|
| Anonymous | The answers and aggregate results of their own poll. | Allowed within the creator's own workspace. No row carries a respondent, because none is collected. | Zero. No IP, user-agent, email, name, or session handle is linked to answers. |
| Identified | Full responses with the identity fields the poll asked for. | Allowed. The respondent sees explicit disclosures before submitting. | Attached: the one or two identity fields the poll asks the respondent to supply, such as name or email. These fields are self-reported and are not verified by ZapPoll. |
Anonymous means ZapPoll does not ask who you are and stores no identifier alongside your answer, so no one — including the poll's creator — can look up who gave a particular answer. It does not mean the creator is prevented from reading individual answers to their own poll, and ZapPoll does not withhold or suppress results on small polls. On a small or distinctive group, the content of an answer may still identify the person who wrote it. Please do not include details you would not want the organizer to be able to attribute to you.
4. Information We Collect & Why
A. Information Collected from Creators
- Account Identity: Verified email address and name provided during passwordless login. We do not store passwords.
- Workspace & Configuration Data: Workspace titles, poll definitions, question schemas, brand color configurations, and notification webhook destinations.
- Commercial Transaction Records: Invoice references, transaction timestamps, purchased entitlements, and currency amounts. Payment card processing is handled directly by our payment processor; Leatra Technologies LTD never handles or stores raw payment card numbers (PAN/CVV).
B. Information Collected from Respondents
- Poll Responses: Answers, selections, ratings, or text inputs submitted into a poll or form endpoint.
- Volatile Edge Metadata: IP address and client header fingerprints are processed transiently in volatile memory at the edge for rate-limiting, DDoS mitigation, and anti-stuffing protection. IP addresses are never persisted with answer records.
C. Information Collected from Website Visitors
When you browse our public website at zappoll.com, our edge network (Cloudflare) collects
standard server log records (IP address, requested path, HTTP status, and user-agent string) strictly
for security monitoring, caching, and network diagnostics.
5. Forms Collection (Headless Endpoints) & Liability Boundary
ZapPoll provides a headless Forms Ingestion API where developers point existing HTML forms directly to our ingestion endpoints. In this architecture:
- Role of the Creator (Independent Data Controller): The creator (website owner) is the sole Data Controller responsible for providing notice, obtaining valid consent, accessibility, and lawful processing on their external website.
- Role of Leatra Technologies LTD (Data Processor): Leatra Technologies LTD acts strictly as a Data Processor providing input validation, envelope encryption at rest, abuse filtering, and creator inbox storage.
- No Responsibility for External Collection: Leatra Technologies LTD does not monitor, inspect, or verify external website collection practices. The creator is solely liable for any regulatory fines, claims, or disputes arising from data collected on their external website.
- Prohibited Ingestion: ZapPoll form endpoints must never be configured to harvest sensitive credentials, passwords, raw payment card data, private cryptographic keys, or government national identifiers.
6. Legal Bases for Processing (NDPA 2023 & GDPR Art. 6)
Under the Nigeria Data Protection Act (NDPA 2023), the European Union General Data Protection Regulation (GDPR), and the UK GDPR, we process personal data under the following lawful bases:
- Performance of a Contract (NDPA Section 25 / GDPR Art. 6(1)(b)): To authenticate creators, provision workspaces, process capability purchases, and deliver polling and form endpoints as contracted.
- Legitimate Interests (NDPA Section 25 / GDPR Art. 6(1)(f)): To secure our network, prevent automated vote manipulation and spam, mitigate DDoS attacks, and enforce capacity admission limits.
- Compliance with Legal Obligations (NDPA Section 25 / GDPR Art. 6(1)(c)): To maintain accurate corporate financial and billing records where the law requires us to keep them.
- Consent (NDPA Section 25 / GDPR Art. 6(1)(a)): Where creators or respondents voluntarily opt in to specific communications or optional notifications.
7. Data Sharing & Sub-processors
We never sell, rent, monetize, or broker personal data to data aggregators or advertisers. We share data only with infrastructure sub-processors essential to operating the platform:
| Sub-processor | Purpose | Data Transferred | Location |
|---|---|---|---|
| Cloudflare, Inc. | Edge CDN, DDoS mitigation, static asset hosting | IP addresses, transient request headers | Global Edge Network |
| Hetzner Online GmbH | Secure VPS hosting (Go API, PostgreSQL, Keycloak) | Encrypted application databases, creator accounts | European Union (Germany/Finland) |
| Supromail / Transactional SMTP | Transactional email (Email OTP login codes) | Recipient email address, verification codes | European Union |
| Payment Processor | Payment processing, settlement, invoices | Billing name, transaction amount, billing country | Disclosed on request |
8. International Transfers & Data Processing Agreement
Leatra Technologies LTD is incorporated in Nigeria, hosts application data in the European Union, and uses a payment processor in the United States. Personal data therefore crosses borders. We rely on the following safeguards:
- Nigeria (NDPA 2023, Sections 41–43): Transfers out of Nigeria are made only where the destination provides an adequate level of protection, or under contractual safeguards with the recipient, or on another lawful basis under the Act.
- European Union & United Kingdom: Where we receive personal data from the EEA or UK, transfers to Leatra Technologies LTD in Nigeria and onward to sub-processors outside those areas are made under the European Commission's Standard Contractual Clauses (Decision 2021/914), together with the UK International Data Transfer Addendum where UK data is involved, supported by a transfer impact assessment.
- Sub-processor Contracts: Every sub-processor listed in Section 7 is bound by a written contract imposing confidentiality, security, and processing-instruction obligations at least as protective as those we owe you.
- Copies: To request a copy of the transfer safeguards in place for your data, email [email protected].
Data Processing Agreement for Creators
Where you use ZapPoll to collect personal data from your own respondents, you act as the Data Controller and Leatra Technologies LTD acts as your Data Processor. We offer a Data Processing Agreement covering processing instructions, confidentiality, security measures, sub-processor engagement and notification, assistance with data subject requests and breach reporting, deletion or return of data on termination, and audit rights. Request it at [email protected]. Where a DPA is executed, it governs our processing of respondent data on your behalf and prevails over any conflicting term in this policy.
Sub-processor Changes
We will give at least 30 days' notice before adding or replacing a sub-processor that processes creator or respondent personal data, so that customers with a DPA in place have an opportunity to object.
9. Security & Encryption at Rest
Leatra Technologies LTD implements technical and organizational safeguards engineered for high security:
- Encryption in Transit: Strict HTTPS with TLS 1.3 across all services, with HSTS enabled for one year.
- Envelope Encryption at Rest: Form submission payloads and sensitive response fields are encrypted at rest using AES-256 envelope encryption. Database backups and disks are encrypted.
- Memory-Only Credentials: Creator authentication tokens use PKCE S256 and reside only in volatile browser memory. Tokens are never stored in localStorage, sessionStorage, cookies, or application logs.
- Network Isolation: Application PostgreSQL and Keycloak PostgreSQL databases reside on isolated internal Docker networks with no exposed public ports.
10. Personal Data Breach Notification
If we become aware of a personal data breach affecting personal data we hold:
- To Regulators: Where we act as controller, we notify the Nigeria Data Protection Commission (NDPC) and, where the GDPR or UK GDPR applies, the relevant supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to affected individuals.
- To Creators: Where we act as your processor, we notify you without undue delay after becoming aware, with the information you need to meet your own notification duties, and assist you in meeting them.
- To Individuals: Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we notify affected individuals directly, or through the creator where we do not hold contact details for them.
- Records: We maintain an internal register of breaches, their effects, and the remedial action taken.
11. Data Retention & Deletion Rights
We retain data only as long as necessary to fulfill the purposes outlined in this policy:
- Poll Data: Creators maintain full control over their poll and form data. Creators can delete individual responses, wipe form inboxes, or delete entire polls at any time.
- Purging: When a poll or workspace is deleted by a creator, the associated encrypted responses, schemas, and entitlement records are removed from active databases within 24 hours. Encrypted backup snapshots are retained on a rolling basis and the deleted records age out of those backups within 30 days. We do not restore deleted data from backup except to recover from a system failure.
- Account Deletion: Creators may request account deletion at any time. All associated personal data is erased, except for financial records we are required by law to retain.
12. Children's Privacy
The Services are not directed to children, and we do not knowingly collect personal data from children through our own website or creator accounts.
- Creator Accounts: Creators must be at least 18 years old, or the age of legal majority in their jurisdiction.
- Respondents: Respondents must be at least 16 years old, or 13 years old where the creator has obtained verifiable parental consent as required by applicable law. We do not verify respondent age — a poll reaches whoever holds its link.
- Creator Obligation: A creator who directs a poll or form at an audience that may include children is the controller for that data and is responsible for obtaining any required parental consent and providing an age-appropriate notice, under COPPA, Article 8 GDPR, the NDPA, or other applicable law.
- Deletion: If we learn that we hold personal data collected from a child in breach of applicable law, we delete it promptly. Parents, guardians, and creators can report such cases to [email protected].
13. Your Legal Rights (NDPA, GDPR & CCPA)
Depending on your jurisdiction, you possess statutory data protection rights:
- Nigeria Data Protection Act (NDPA 2023): Nigerian data subjects have the right to request access, rectification, erasure, and objection to processing, and lodge complaints with the Nigeria Data Protection Commission (NDPC).
- GDPR / UK GDPR: European and UK residents have rights of access, rectification, erasure (“right to be forgotten”), restriction, data portability, and right to lodge a complaint with a supervisory authority.
- California Consumer Privacy Act (CCPA/CPRA): California residents have the right to know what personal information is collected, request deletion, and opt out of any sale of personal information. Leatra Technologies LTD does not sell personal information.
To exercise any of these rights, contact our Data Protection Officer at [email protected].
15. Changes to This Policy
We update this policy when our processing, our sub-processors, or the law changes. Every version carries a version number and effective date in the header of this page.
- Material Changes: Where a change materially affects how we handle personal data, we give at least 30 days' notice by email to creators and by a prominent notice in the application before it takes effect.
- Sub-processor Changes: Notified per Section 8.
- Minor Changes: Clarifications and corrections take effect when published.
- Prior Versions: Superseded versions are available on request from [email protected].
16. Corporate & Data Protection Officer Contact
For legal notices, data protection inquiries, or regulatory communications: