Data access, retention and deletion policy

What we hold

• Your account: your email address, name if you add it, and where you came from when you signed up (for example a link or campaign tag).
• Your workspace: forms and every published version of them, routing rules, webhook addresses (signing secrets are encrypted), settings and team members.
• Submissions: the answers respondents send, files they upload, tags, notes, assignments and a timeline of what happened to each one. Responses saved to finish later are held too.
• Respondent details we record for security: a one-way hash of the IP address (never the address itself) and the browser's user-agent, used for spam and rate limits.
• Webhook delivery logs: when each delivery was attempted, the receiver's status code, and the first 500 characters of its reply.
• Workflow records: approvals and who made them, reminders sent, signature requests and their outcome, and what was sent to connected apps.
• Connected apps: the access Tallyn was given (encrypted), the account name, and where you chose to send submissions. API keys are stored only as a hash.
• AI summaries of submissions and descriptions of uploaded documents, when AI help is switched on for a form.
• Billing: your plan and subscription status. Card details are held by Stripe, never by Tallyn.

Who can access it

• Each workspace is separate. Only its members can see its forms and submissions; every query is limited to the signed-in workspace.
• Owners and admins manage the team, webhooks and data exports. Editors build forms and handle submissions. Viewers can read but not change anything.
• Respondents see only the form. A save-and-resume link shows that respondent's own saved answers; a missing-information link shows only the questions you asked for. Both are private, random links that expire (30 days to resume; 14 days and a single use for missing information).
• Uploaded files are stored privately in Cloudflare R2. They're downloaded through links that expire after five minutes, after checking you're in the workspace. Links inside webhook payloads expire after seven days.
• “New submission” and routing-rule emails never include answers, only the form name, the submission number and a link that needs you to sign in.
• Webhooks send submissions to the addresses you add, over HTTPS, signed so your receiver can check they came from Tallyn.
• Client portal: a respondent who signs in with an emailed link sees only submissions sent from their own email address to your business, with their answers and anything still needed. Private links to finish a form or add missing details are stored encrypted so reminders can resend them.
• Connected apps and webhooks receive the submissions you choose to send them: answers, file names and download links that expire after seven days. Disconnect an app or remove a webhook to stop this.
• E-signatures: when a workflow sends a document to sign, the PDF and the respondent's name and email go to Dropbox Sign, which emails them the signing link; the signed PDF is stored with the submission.
• Voice intake: answers captured by an Onda voice assistant are sent to Tallyn only for forms where you set it up, signed with a secret you control.
• New Odyssey staff access your data only to provide support you ask for, or to investigate abuse or a fault. We don't share it with other New Odyssey products, and we don't use it to train AI models. When you build a form with AI, your description is sent to our AI provider (Anthropic) to draft the form. When a form's AI help is on (it is by default, and can be switched off per form), its answers and readable uploaded files are sent to Anthropic to write the team's summary and describe the documents; identifiers in documents are masked in what Tallyn stores. Anthropic doesn't use this data to train models.

How long we keep it (retention)

• Each form has its own setting: keep submissions for 30, 90 or 180 days, one or two years, or until you delete them. You set a default for new forms under Settings.
• When a submission reaches its form's retention period (counted from when it was submitted), it is deleted automatically with its files, within minutes. Changing the period applies to submissions you already have.
• AI summaries and document descriptions are part of the submission and are deleted with it.
• Responses saved to finish later are deleted when their link expires (30 days after the last save) if they were never submitted.
• Files uploaded to a form but never submitted are deleted after two days.
• Everything else stays until you delete it or the workspace.

Exporting your data

• Any form: download all its submissions as a CSV spreadsheet from the Submissions page or the form's Settings tab.
• Everything: workspace owners and admins can download all forms, versions, submissions, rules, webhooks and delivery logs as one JSON file under Settings → Your data.
• Files: download each from its submission.

Exports are available at any time while your workspace exists, including after you cancel your plan.

Deleting data

• Delete a single submission from its page, or a whole form (with all its submissions and files) from the form's Settings tab.
• The workspace owner can delete the whole workspace under Settings → Your data. This cancels the plan immediately and permanently deletes everything in it, including uploaded files. Sign-in accounts that belong to no other workspace are deleted too.
• Deletion takes effect immediately in the live service. Database backups kept by our hosting provider (Render) expire on its standard schedule.
• A minimal security log (account ids and actions such as “signed in”, “form published” or “submission deleted by retention”, with no answers) is kept so misuse can be investigated.
• Stripe keeps its own billing records as the law requires.

Respondents

If you filled in a form, the business that sent it controls your answers. Ask them to see, correct or delete what you sent. You can also contact us and we'll pass your request on.

Asking us

To ask what we hold, or to have us export or delete it for you, email clio@new-odyssey.com. We reply within 5 working days.