Security and Privacy Policy

Poll Maker is a registered business name of My Plaza Pty Ltd (ABN 58 110 054 245), an Australian company at Suite 1, Ground Floor, Enterprise 1, Innovation Campus UOW, Squires Way, North Wollongong NSW 2500, Australia. In this policy, "we", "us" and "our" mean My Plaza Pty Ltd.

It explains how we handle information across poll-maker.com and its subdomains, our poll, survey, quiz, form and scheduling tools, and the polls you embed in your own website. Together we call these the Services. It applies to three groups of people:

• Creators, who make polls, surveys, quizzes, forms or scheduling polls, with or without an account.
• Respondents, who vote in a poll or answer something a Creator made.
• Visitors, who read our pages without doing either.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This distinction shapes everything else in the policy.

The data	Who decides what happens to it
Your account data. Your name, email address, password, billing records, support messages and how you use the Services.	We do. We are the controller. We decide what to collect and why, and this policy tells you what we do.
Respondent data. The votes, answers and form entries people submit to your poll, survey, quiz or form, plus the technical records attached to them.	You do. You are the controller and we are your processor. We hold it and act on your instructions, and your own privacy notice governs it.

If you need a written data processing agreement or a current list of the providers who handle respondent data, ask through our contact page and we will provide them.

Account information

When you register we collect your name, email address and a password. If you sign in with Google or Facebook instead, that provider tells us your name and email address and confirms the account is yours. We never receive your password for those services.

What you create

Your polls, surveys, quizzes, forms and scheduling polls: questions, answer options, images, themes, custom code, settings, and anything you import.

Votes and responses

The votes and answers submitted to what you publish, together with technical records attached to each one so you can report on it and so we can keep voting fair: IP address, approximate location derived from it, browser, operating system and device type, the referring page, the time and duration of the response, and markers that recognise a device that has already voted. If your survey or form asks a respondent for their name, email address, phone number or postal address, we collect that too, because you asked for it.

Scheduling polls

The names participants enter and the times they choose. Organisers confirm their email address with a short code we send them, so we hold that address to keep their poll linked to them.

Payment information

Card payments are handled entirely by Stripe. We receive a record of each transaction, the last four digits, card type and expiry date, and the billing details you enter. We never see or store your full card number.

Technical and usage information

Each visit creates a session identifier. We log account creation, sign in, sign out, poll creation, publishing, changes, responses received, and plan changes, together with the IP address, browser and device details attached to each event. These logs are how we investigate abuse, fix faults and detect fraudulent sign-ups. They are never made public.

Support messages

What you send us through our contact forms, and our replies.

We use personal information only for the purposes below, and we do not use it for anything unrelated without asking you first.

Purpose	What we use
Running your account and delivering the Services	Account information, what you create, votes and responses
Showing you results and reports	Votes and responses
Keeping votes fair and stopping abuse	Technical records on votes and responses, usage logs
Taking payment and issuing invoices	Account and payment information
Support, and telling you about billing, security and service changes	Account information, support messages
Fixing faults and improving the Services	Technical and usage information, aggregated statistics
Meeting our legal, tax and regulatory obligations	Account and payment information

Where the law where you live requires a legal basis, we rely on performing our contract with you, our legitimate interest in running and securing the Services, your consent where we ask for it, and compliance with our legal obligations.

Email

While you hold an account we send service messages you cannot opt out of, such as trial reminders, billing notices, security alerts and notice of changes to our terms. Anything promotional is separate, and every promotional email has an unsubscribe link that works. We do not sell or rent your email address, and we never add your respondents to a mailing list.

We use cookies and similar browser storage for three things:

• Keeping you signed in and the site working. A session identifier, your sign-in state and your preferences. The Services do not work without these.
• Keeping votes fair. Markers that let a poll recognise a device that has already voted, when the Creator has chosen that protection.
• Understanding how our site is used. We use Google Analytics to see which pages are visited, how people arrive and where they get stuck.

Google Analytics

Google Analytics sets its own cookies and receives your IP address and information about your visit to our pages, which Google processes under its own privacy policy. It tells us how our pages are used; it does not receive the answers anyone gives in a poll, survey or form. You can read how Google uses information from sites or apps that use its services, and you can opt out with the Google Analytics opt-out browser add-on.

You can block or delete cookies in your browser settings. Blocking essential cookies stops you signing in or saving a poll, and blocking vote markers may mean a poll cannot count your vote.

We do not currently show a cookie consent banner. If you embed a poll in your own site in a place where the law requires consent before non-essential cookies are set, you are responsible for the consent notice on your site. Section 14 of our Terms covers embeds.

Polls made on free accounts may show ads served by Google. That is part of how we keep the free plan free. Upgrading to a paid plan removes ads from your polls.

• Third party vendors, including Google, use cookies to serve ads based on a person's prior visits to our website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to our visitors based on their visits to our sites and other sites on the internet.
• You can opt out of personalised advertising in Google's Ads Settings, and opt out of some other vendors' use of cookies for personalised advertising at aboutads.info.

We never pass your account details, your poll content or your respondents' votes and answers to an advertiser.

Provider	What they do, and where
Liquid Web	Hosts our dedicated servers and the databases holding accounts, polls and responses. Michigan and Arizona, United States.
Cloudflare	Content delivery, protection against attacks, web application security, and storage for some public files such as images and printable downloads. A global network.
Stripe	Processes card payments and stores card details. We never hold your full card number.
Google Analytics	Measures how our own pages are used. It does not receive poll votes, survey answers or form entries.
Google ads	Shows ads on polls made with free accounts, as described in section 6.
Google and Facebook sign-in	Confirm your identity, and give us your name and email address, only when you choose to sign in with them.

If you connect Poll Maker to another service through our API or an integration, we send your responses there on your instruction, and that service handles them under its own terms.

We also disclose information in three other situations:

• When the law requires it. A court order, subpoena, regulator or law enforcement request we are legally obliged to answer. Where we are allowed to tell you, we will.
• To protect people. Where we reasonably believe disclosure is needed to prevent serious harm, fraud or a crime, or to enforce our Terms.
• If our business changes hands. If My Plaza Pty Ltd is sold or merged, information may pass to the buyer, who is bound by this policy until it gives you notice of any change.

Inside our business, access to customer information is limited to the few staff who need it for their work, and only when they need it.

We are an Australian company, but our servers are in the United States. Using the Services means your information and your respondents' votes and answers are stored in and accessed from the United States, and pass through the countries where Cloudflare operates its network. Google and Stripe may process information in other countries too.

Before we disclose personal information to an overseas recipient, we take reasonable steps to make sure it is handled consistently with the Australian Privacy Principles, including through the contracts we hold with our providers. If you need data kept inside a particular country, tell us through our contact page before you start, because the standard service cannot do that.

We keep information while your account is open and you need it, and after that only for as long as we have a reason to.

• Polls and responses stay until you delete them or your account.
• Closed or lapsed accounts. You have at least 30 days from the day an account closes to sign in and export your data before we may delete it permanently.
• Backups. Deleted data can remain in encrypted backups until those backups cycle out in the normal course.
• Billing records are kept for as long as Australian tax and company law requires.
• Security and usage logs are kept for a limited period so we can investigate incidents.

Deleting your account yourself

You do not need to ask us. Deleting your account removes the information we hold about you and your respondents, and it cannot be undone.

1. Sign in and open your Dashboard.
2. Choose Account from the menu.
3. If you have an active subscription, click Cancel on the right side of the page first.
4. With no active subscription you will see a Delete button. Click it to delete the account.

People trust a poll when they know each vote was real. Every poll can use our vote protection, and the Creator chooses how strict it is in the poll's settings.

• We compare the IP address, a browser marker and device details of each vote to recognise repeat voting.
• Unusual voting patterns on large polls are flagged, and can be reviewed by our team.
• Paid plans add fraud detection and results filtering, which set aside votes and responses that look automated or duplicated.

These records are used to protect polls and to investigate abuse, and for nothing else. Some of them, such as the approximate location and time of a response, can appear in the Creator's results and reports. We do not publish how our detection works, because that would make it easier to defeat.

The platform behind Poll Maker has carried customer and public data since 2003, and these are the controls that matter most.

Accounts and sign-in

Every management and reporting feature needs a signed-in account over an encrypted connection. Passwords are hashed before storage and never kept in plain text, so nobody at Poll Maker can read yours. Repeated failed sign-in attempts lock the account, and access is restored by email verification.

Access control

A sign-in reaches one account and one account only. On plans with team members, the account owner decides who is added and removes them when they leave.

Encryption in transit

Votes, answers and all account traffic travel over TLS using current cipher suites, which we review as recommendations change. Our embed code is served over an encrypted connection too. If your own website is served over plain HTTP, the connection between your visitors and your site is not encrypted, so we recommend serving your site over HTTPS.

What an embedded poll does and does not do

An embedded poll collects only what its visitors submit to it and the technical records described in section 3. It does not read or change the rest of your page.

Secure development

Security requirements are set before a feature is built. Changes go through code review, automated vulnerability scanning and testing on a separate platform before they reach the live site, and we have our security assessed by third parties from time to time.

Responsible disclosure

We welcome security research. Tell us before you start testing, through our contact page, so we do not mistake you for an attacker. Report anything you find the same way. We will work with you, we will not pursue researchers who act in good faith and give us a reasonable chance to fix the issue, and we ask that you never access, change or delete anyone else's data.

We run dedicated servers rented from Liquid Web in data centres in Michigan and Arizona in the United States. The facilities provide 24 hour hardware support, on-site security staff, monitored cameras, and redundant power and network capacity. Cloudflare sits in front of them for content delivery and security.

Code and data are backed up daily and stored offsite. Servers are patched and reviewed on a regular cycle. An independent monitoring service checks availability every 15 seconds and alerts our staff automatically, at any hour, if something goes wrong.

If a data breach is likely to result in serious harm, we assess it promptly and notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) requires.

Where you are the controller of the affected respondent data, we tell you without undue delay and give you the information you reasonably need to meet your own obligations, so you can tell your respondents.

You can do most of this yourself from your Dashboard, and we will help with anything you cannot.

• See what we hold. Most of it is in your Dashboard. Ask us for the rest.
• Correct it. Update your account details in the Dashboard, or ask us.
• Export it. Download your polls and results from the Dashboard at any time.
• Delete it. Delete individual polls and responses, or the whole account, as described in section 9.
• Stop promotional email. Use the unsubscribe link in any promotional message.

We respond to privacy requests within a reasonable time, normally within 30 days. We may need to confirm who you are first, which protects you from someone else asking for your data. We do not charge for a request unless it is repetitive or clearly excessive, and we tell you before any charge applies.

Depending on where you live, you may have further rights under local law, such as the right to object to or restrict some processing, or to receive your data in a portable format. Tell us what you need and we will meet the obligations that apply.

If you voted in a poll or filled in a survey or form and want your answers changed or removed, the person or organisation that made it controls that data, so go to them first. Their name is usually on the poll, in its branding, or on the site where you found it.

If you cannot identify or reach them, contact us through our contact page with the link to the poll, and we will pass your request to the account holder and help where we reasonably can.

If a poll, survey or form is unlawful, deceptive, impersonates someone or breaks our rules, report it through the report content form. We review reports and can remove content or close accounts, as section 13 of our Terms explains.

Accounts are for people aged 18 and over. Anyone younger may use the Services only through an account held and supervised by a parent, guardian, teacher or school.

Polls are widely used in classrooms, so respondents are often children. If you publish a poll, survey or form that children are likely to answer, you are responsible for any parental or school consent the law requires, for explaining what you collect in words they understand, and for collecting only what you need. Section 4 of our Terms sets this out in full.

We do not knowingly hold accounts for people under 18. If you believe a child has registered one, tell us through our contact page and we will close it and delete the information.

If you think we have mishandled your information

Tell us through our contact page and set out what happened. We will acknowledge your complaint, investigate it, and write back with what we found and what we will do. Most matters are resolved this way.

If you are not satisfied with our response, you can take it to the Office of the Australian Information Commissioner, which regulates privacy in Australia, or to the privacy regulator where you live.

Changes to this policy

We update this policy when our practices, our providers or the law change. If a change materially affects how we handle your personal information, we give you at least 30 days notice by email or in the product before it takes effect. The date at the top of this page shows when it was last updated, and earlier versions are available on request.