SurveyMonkey's Privacy Policy Simplified

- The Privacy Notice is extremely long and complex, making it difficult for an average user to understand their rights and how their data is used.

- The notice lists many versions with future dates, including a "current" version dated May 1, 2026, which is confusing and suggests the policy may be updated retroactively or with unclear timing.

- It uses broad and vague terms like "device data," "usage information," and "event data" without clearly explaining what specific information is collected and for what exact purposes.

- The notice allows SurveyMonkey to create "user profiles" by combining data from third-party sources like LinkedIn and ZoomInfo, without giving users a clear, upfront choice about this practice.

- There is a heavy reliance on "legitimate interests" as a legal basis for processing, which can be subjective and allows for extensive data use, including for marketing and profiling, without explicit user consent.

- The policy states that "usage information" and "event data" can be used for many purposes, including creating new services, tracking behavior, and making recommendations, but it does not provide sufficient clarity on the scope of these activities.

- SurveyMonkey uses machine learning and AI tools on survey response data, including potentially personal data, to train models and provide insights, which may not be fully transparent to Respondents.

- The notice indicates that de-identified data is used to train models, but it is unclear how effective de-identification is and what safeguards are in place to prevent re-identification.

- If a Respondent wants to access, delete, or correct their survey responses, they must contact the Creator (the surveyor), not SurveyMonkey, which can be a significant barrier to exercising data rights.

- The policy allows SurveyMonkey to share data with third-party service providers for various purposes, including fraud detection and marketing, without providing a clear, simple list of all such recipients.

- The section on data retention is vague, stating that data is generally kept while an account is active, but it also reserves the right to delete accounts of inactive free users without specifying a clear timeframe or providing an advance notice period.

- The notice allows for the sharing of account data with administrators of Enterprise or team plans, which could include personal information like photos, and administrators may have the ability to change passwords, suspend accounts, or delete data, raising concerns about user control.

- The policy mentions that users can be migrated to an Enterprise account without their explicit consent, and their data may become visible to administrators, which could be unexpected for personal account holders.

- There is a potential for conflict between the Privacy Notice and the Data Privacy Framework (DPF) principles, and while the DPF is said to govern, the notice does not clearly explain how a user would invoke these protections.

- The section on minors sets the age limit at 16, which is lower than the age of consent in some jurisdictions, potentially allowing data collection from younger individuals without appropriate safeguards.

- The notice does not clearly specify how long cookies or tracking technologies persist, nor does it give users a simple, clear way to manage all of them, despite mentioning a "Cookies Preference Center."

- The policy allows for the processing of personal data to be transferred to the United States and other countries, and while it mentions standard contractual clauses, it does not fully explain the risks of such transfers to users.

- The notice states that SurveyMonkey may share hashed email addresses with marketing vendors for targeted advertising, but the process for opting out of this is not made prominent or easily accessible.

- The policy gives SurveyMonkey the right to use billing information to adjust or manage pricing, which is an unusual and potentially concerning use of personal financial data.

- The notice mentions that customer support calls are recorded, but it does not clearly state how long these recordings are kept or who has access to them.

- There is a lack of clarity on how long it takes for SurveyMonkey to respond to data subject requests,