Transparency
How StrawPoll works behind the scenes
Who pays for StrawPoll, how we deal with illegal content and requests from authorities, and who we work with.
This page is also available in German and French. If the versions differ, the German version applies.
How StrawPoll is funded
StrawPoll is run by Gregor Krambs Internet GmbH & Co. KG, an independent, owner-run company in Hamburg, Germany. We have never taken money from outside investors.
- Paid plans are ad-free and pay for most of our work.
- Ads from Google AdSense keep the free plan free. Personalized ads are only shown with your consent.
- We don’t sell data. Personal data and voting data are never sold, rented or traded to advertisers, data brokers or anyone else.
Digital Services Act
StrawPoll is a hosting service under the EU Digital Services Act (DSA). Our single point of contact for authorities of the EU member states, the European Commission, the European Board for Digital Services and for users (Art. 11 and 12 DSA) is:
Gregor Krambs Internet GmbH & Co. KG
Email: gregor@gk-internet.de
Languages: German and English
Reporting illegal content
To report a poll, a comment or other content that you believe is illegal, email gregor@gk-internet.de with:
- the link to the poll or results page;
- which content is affected and why you believe it is illegal;
- your name and email address, unless the report concerns child sexual abuse material;
- a statement that your report is accurate and complete to the best of your knowledge.
We confirm that we received your report, review it promptly and tell you what we decided.
Moderation
Polls and comments go live without being checked by us first. We act when content is reported to us or when we notice it ourselves. If content is illegal or breaks our rules, for example bullying, harassment or spreading other people’s personal data, we remove it or disable access to it. In serious or repeated cases we may also close the account.
When we remove content, we tell the person who created it why, unless the law forbids it, and they can reply to the same address to object to our decision. We don’t use automated systems to decide about content. Automated checks such as captchas and VPN detection only protect the fairness of votes.
Requests from authorities
We only hand over data when a German or EU authority sends a valid legal order, and only the data that order covers. We check each request before we respond. To be able to answer such orders, we log sign-ups, sign-ins, image uploads and polls created without an account with the IP address they came from, and delete that log after 90 days, as described in the privacy policy. Votes, answers and results are never shared with anyone without a legal obligation.
Where we store IP addresses
IP addresses are personal data, so we only keep them where we need them, and delete them after 90 days. Votes and other poll data stay until the poll’s creator deletes the poll, or until the retention period they set on the Business plan. We don’t pass them to third parties. Only Google receives them, directly from your browser, when it shows ads on the free plan.
| Where | Why | How long |
|---|---|---|
| Votes and responses | Duplicate vote checks and spotting fraud, together with the network, country and browser. The poll creator and their team can see it in the response export. | 90 days |
| Email verification | Limiting how many verification codes one address can request, in polls that require email | 90 days |
| Sign-in sessions | Listed with each session in Settings, so you can spot sign-ins you don’t recognize | 90 days |
| Legal log | Answering orders from authorities: sign-ups, sign-ins, image uploads and polls created without an account | 90 days |
| Server log files | Running the site securely and fixing errors | 90 days |
| Rate limits | Slowing down spam in questions and uploads | Kept in memory only, never saved |
Data processing agreement (DPA)
When a business or organization collects answers with StrawPoll, we process its participants’ data on its behalf. Our data processing agreement under Art. 28 GDPR applies automatically, with nothing to sign, and includes our technical and organizational measures. The subprocessors it covers are the providers below that act on our behalf. We announce changes to them here at least 30 days in advance.
Service providers
These providers process data only on our behalf and according to our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers and databases that run StrawPoll and store all of its data | Germany |
| Amazon Web Services (Amazon SES) | Sending emails, such as sign-in links, vote confirmations and notifications | Germany (Frankfurt region) |
These providers act as independent controllers under their own privacy policies:
| Provider | Purpose | Location |
|---|---|---|
| Paddle.com Market Limited | Selling paid plans as reseller and merchant of record; only when you buy a plan | United Kingdom |
| Google AdSense (Google Ireland Limited) | Ads on the free plan; personalized ads only with your consent | Ireland, may process data in the US |
| Google, Facebook, Microsoft, Discord | Signing in, only if you choose to sign in with one of these accounts | Varies by provider |
Some things run on our own servers, without any third party:
- Rybbit: Cookieless page view statistics, without storing IP addresses
- Cap: Captcha for polls that require one
- VPN and proxy list: Detecting VPN and datacenter addresses in polls that block them
Details on each provider and the legal basis are in the privacy policy.