You can view all our data security and privacy docs here. If you have any questions, contact our Data Protection Officer at [email protected] or get in touch with our team directly here.
As of November 3rd 2026, OpinionX Limited (the Data Processor) has authorised the following subprocessors. This list also serves as Annex III of our Data Processing Agreement.
"Participants" means people who take a survey. "Users" means people with an OpinionX account.
Hosting and infrastructure
Subprocessor | Purpose | Data processed | Data location |
Microsoft Corporation — Azure | Hosts the OpinionX application, background processing, file storage, message queues, secrets management and application monitoring. | All survey, response, participant and account data. Usage telemetry. | Republic of Ireland (Azure North Europe) |
Microsoft Corporation — Azure AI Translator | Machine translation of survey text when a user selects AI Auto Translate. | Survey questions and answer options written by users (not participant responses). | Republic of Ireland |
MongoDB, Inc. — Atlas | Managed database for storing and retrieving all application data. | All survey, response, participant and account data. | Republic of Ireland (Azure North Europe) |
Communications and support
Subprocessor | Purpose | Data processed | Data location |
Customer.io (Peaberry Software, Inc.) | Transactional and product emails to users. Survey invitation emails to participant lists that users upload. | User name, email and account activity. Participant email addresses. | Belgium |
Intercom R&D Unlimited Company | In-app support chat, support inbox and help centre. | User name, email, user ID and support conversations. | United States |
Slack Technologies, LLC | Internal operational alerts to the OpinionX team. | User emails, workspace names, survey titles. | United States |
Payments and sign-in
Subprocessor | Purpose | Data processed | Data location |
Stripe Payments Europe, Ltd. | Invoices, subscriptions and one-off payments. | User email, workspace ID, billing and payment details. | Republic of Ireland and United States |
Google LLC — Sign in with Google | Optional sign-in with a Google account. | Name, email and Google account ID of users who choose it. | United States |
Analytics, monitoring and delivery
Subprocessor | Purpose | Data processed | Data location |
Functional Software, Inc. — Sentry | Error monitoring, performance tracing and session replay to find and fix bugs. | Error details, device and browser data, user ID. Replays of a sample of user sessions, with input fields masked. Replays of results pages can show participant responses. | United States |
Microsoft — Clarity | Session recordings and heatmaps to improve product usability. | Pseudonymous session recordings of users and participants, device data. | United States |
Google LLC — Google Analytics | Aggregate product usage analytics. | Page views, device data, cookie identifiers. | United States |
Cloudflare, Inc. — cdnjs | Delivers a browser compatibility script. | IP address and browser data on page load. | Global edge network |
Changes to this list
We notify customers at least 30 days before a new subprocessor begins processing their data. Notice goes by email to the account contact or through an in-product notification, as set out in Section 5.2 of our DPA. Customers may object on reasonable data protection grounds within 15 days of the notice (Section 5.3). For US-based subprocessors, transfers rely on the EU–US Data Privacy Framework or the Standard Contractual Clauses (Section 11).
You can view all our data security and privacy docs here. If you have any questions, contact our Data Protection Officer at [email protected] or get in touch with our team directly here.