Privacy Policy

This Privacy Policy explains how BLIT Solutions (“SwiftSurvey”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you use our websites, applications, and services (the “Service”).

We process personal data in accordance with the Data Protection Act, 2019 (Kenya) and other applicable data protection laws. This Policy forms part of our Terms of Service.

Our responsibilities depend on whose data is involved:

• Account holders (Creators). For the personal data you provide when you register and use the Service — such as your name, email, and billing details — we are the data controller.
• Survey respondents.For answers and files submitted to a Creator’s survey (“Respondent Data”), the Creator is the data controller and we act only as a data processor on the Creator’s instructions. Questions about a specific survey should be directed to the organisation or person that sent it to you (see Section 11).

Data you provide directly:

• Account information: name, email address, password (stored as a secure hash), and profile picture;
• Workspace information: workspace name, member roles, and logos;
• Billing information: plan selection and payment records (card details are handled by our payment provider and never stored on our servers);
• Content you create: surveys, questions, media, themes, and settings;
• Communications: messages you send to our support or contact channels.

Data collected automatically:

• Usage data: pages visited, features used, and actions taken within the Service;
• Device and connection data: IP address, browser type, operating system, and approximate region derived from your IP address;
• Log data: timestamps, error reports, and security events used to keep the Service reliable and secure.

Respondent Data (processed on behalf of Creators): survey answers, uploaded files, and — where the Creator enables it — metadata such as submission time and completion status.

• To provide, operate, and maintain the Service, including authenticating you and syncing your data across devices;
• To process payments and manage subscriptions;
• To respond to support requests and communicate service updates, security alerts, and administrative messages;
• To monitor, secure, and improve the Service, including debugging, fraud prevention, and abuse detection;
• To enforce our Terms of Service and comply with legal obligations;
• With your consent, to send product news and marketing (you can opt out at any time).

We do not sell personal data, and we do not use Respondent Data to train AI models or for advertising.

Under the Data Protection Act, 2019 (Kenya), we rely on the following lawful bases:

• Performance of a contract — to deliver the Service you signed up for;
• Legitimate interests — to secure the Service, prevent abuse, and improve our features, balanced against your rights;
• Legal obligation — to keep records required by tax, accounting, and other laws;
• Consent — for optional communications and any processing where the law requires it. You may withdraw consent at any time.

We share personal data only in the following circumstances:

• Service providers. We use vetted third-party providers for hosting, data storage, email delivery, payment processing, error monitoring, and (where enabled) AI-powered features. These providers process data only on our instructions and under contractual confidentiality and security obligations.
• Within your Workspace. Your name, email, and activity may be visible to other members of Workspaces you belong to.
• Integrations you enable.If you connect a third-party integration, we share the data needed for that integration to work, under that third party’s own terms and privacy policy.
• Legal requirements. We may disclose data where required by law, court order, or a competent authority, or where necessary to protect the rights, safety, or property of SwiftSurvey, our users, or the public.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy.

Our service providers may store or process data on servers located outside Kenya. Where personal data is transferred outside Kenya, we do so in accordance with the Data Protection Act, 2019, including ensuring appropriate safeguards such as contractual data protection commitments with our providers.

• Account data is retained for as long as your account is active;
• If you delete your account, we delete or anonymise your personal data within ninety (90) days, except where retention is required by law (e.g., billing records);
• Respondent Data is retained according to the controlling Creator’s instructions — when a Creator deletes a survey or response, we delete the associated data from live systems within thirty (30) days;
• Backup copies are purged on a rolling basis within a further ninety (90) days;
• We may retain aggregated, de-identified data that no longer identifies any person.

We apply technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit (TLS) and at rest;
• Password hashing and support for two-factor authentication;
• Role-based access controls within Workspaces and least-privilege access internally;
• Logging and monitoring for suspicious activity;
• Regular review of our security practices.

No system is completely secure. If we become aware of a personal data breach that poses a real risk of harm, we will notify the Office of the Data Protection Commissioner and affected users as required by the Data Protection Act, 2019.

Subject to applicable law, you have the right to:

• Be informed about how your personal data is used;
• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your personal data;
• Object to or restrict certain processing;
• Request a copy of your data in a portable format;
• Withdraw consent where processing is based on consent.

To exercise these rights, contact us at info[at]blithost[dot]com. We will respond within the timelines required by law. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

If you received a survey built with SwiftSurvey, the organisation or person who sent it to you controls the data you submit. We store and process your answers only on their behalf.

• Requests to access, correct, or delete your survey answers should be directed to the survey creator;
• If you contact us instead, we will forward your request to the relevant Creator where we can identify them, or assist as required by law;
• Never submit passwords, payment card numbers, or similar credentials through a survey — legitimate surveys will not ask for them.

We keep cookies to a minimum. The Service uses strictly necessary, first-party cookies — primarily a session cookie that keeps you signed in and protects your account. We also use a first-party analytics cookie (via PostHog, proxied through our domain) to understand how the Service is used, which is only set after you accept our cookie notice. We do not use third-party advertising or cross-site tracking cookies.

Because the session cookie is essential for the Service to function, it cannot be switched off, but you can clear it at any time through your browser settings (you will be signed out). The analytics cookie is only set with your consent and records your acknowledgement, stored locally on your device.

The Service is not directed at children, and you must be at least eighteen (18) years old to create an account. We do not knowingly collect personal data from children as account holders. Creators who survey minors are responsible for obtaining all consents required by law (including parental or guardian consent). If you believe a child’s data has been collected improperly, contact us and we will take appropriate action.

We may update this Policy from time to time. For material changes, we will notify you by email or in-product notice before the changes take effect. The “Effective date” at the top of this page shows when this Policy was last revised.

For privacy questions or to exercise your rights, contact our data protection contact at info[at]blithost[dot]com.