Scheduled maintenance — 24 September, 20:00–22:00 CEST. Diggle may be slow or temporarily unavailable. Have a session planned during this time? Contact us

Contact Info

Log in
Sign up

Privacy Policy

Last updated: 17 September 2026

Specifique Norge AS, organisation number 981446305, is the controller for account administration, billing, marketing and operation of our websites. For personal data processed on behalf of customers through their Diggle sessions, we act as processor. Contact: [email protected]

Key points

This is a plain-language summary of our full policy below. It doesn't replace it — if the two ever conflict, the full policy governs.

  • We collect what we need to run Diggle: account info, the content you create, billing details, and basic technical/log data. If you're a participant, we collect what you submit in a session.
  • If you use an AI Feature (chat, content generation, design suggestions, translation, document upload, or grouping open-ended answers), the data relevant to that request — including, where applicable, participant answers — is sent to our AI sub-processor to provide that feature. We don't use that data to train AI models. See "AI features" below.
  • You're the data controller for personal data you or your participants put into Diggle (for example, in a survey). We're the processor.
  • We share data with named sub-processors who help us run the service (including hosting, payments, email, security, consent management, and AI), never for their own marketing purposes, and always under a data processing agreement. We never sell your personal data.
  • If Diggle is the controller for your personal data, you can access, correct, or delete it by contacting [email protected]. If we process your personal data on behalf of one of our customers, please direct your request to that customer.
  • Our main data center is in the EU (France). Where personal data is transferred outside the EEA, we use an applicable GDPR transfer mechanism, such as an adequacy decision, the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses.
  • Our technical and organizational security measures are described in full in our separate Security Policy.

Definitions

The Landing Page means diggle.com and www.diggle.com and help.diggle.com. The App means app.diggle.com, godiggle.com, puppeteer.diggle.com, and any other diggle.com subdomain used to provide the App. Together, these make up the Platform; the Platform plus support from our team makes up the Service. A Supporting Service is one of our sub-processors. Output means whatever an AI Feature generates for you — including drafted text, design suggestions, translations, and groupings or summaries of open-ended answers.

Diggle Users fall into these categories:

  • Account Owner — the person or company that pays for the App.
  • Creators — people who create content and host sessions on the App.
  • Participants — people who take part in sessions Creators run.
  • Translators — people invited to review and edit AI-generated translations of a Diggle. Translators can view and edit content in the language(s) they're invited to work on.

Every account has one Account Owner, who may invite several Creators; because Account Owners are also Creators within their own account, anything that applies to Creators applies to Account Owners too. "Account" means the data stored in the App for an Account Owner.

Your data is your data

We only collect what we need to deliver and improve the Service. Below is what we collect, why, and the GDPR legal basis for each.

What data we collect

  • User account information. Email and username, used to operate the Service, keep it secure, maintain backups, and communicate with you. Required to deliver the Service under our contract with you (GDPR art. 6(1)(b)).
  • Transaction information. Billing details such as card information, billing email, banking details, transaction location, and billing address, processed by us and our payment processor to deliver paid services and keep transaction records. Required to perform our contract (art. 6(1)(b)) and to comply with accounting/tax law (art. 6(1)( c)).
  • Technical log data. IP address, pages visited, browser type and settings, and timestamps, collected automatically when you use the Platform.
  • Device information. Device type, OS, settings, app IDs, unique identifiers, and crash data. Legal basis: our legitimate interest in running, securing, and improving the Service and assisting with support (art. 6(1)(f)), and performing our contract with you.
  • Service and transactional notifications. Emails about your account, service changes, or policy updates. You can't opt out of these (short of deleting your account) — legal basis is our contract with you (art. 6(1)(b)) and our legitimate interest in keeping you informed (art. 6(1)(f)).
  • AI feature data. If you choose to use an AI Feature, we process what you give it — chat messages and prompts, questions and answers you ask AI to generate or improve, documents you upload, and, where you ask an AI Feature to read or edit them, your Diggle's existing content and settings. This also covers the text of your Diggle when you use AI Translation, and Participant answers to open-ended questions when you or another Creator use AI to group or summarize them. This data goes to our AI sub-processor(s) (see "Our third-party service providers and sub-processors") solely to provide the feature you requested. We do not use this data, and do not permit our AI sub-processors or any other third party to use it, to train or improve AI models. Legal basis: performance of our contract with you (art. 6(1)(b)), triggered by your choice to use the feature.

Your responsibility

If you store personal data in Diggle — for example, by running a survey — you're the data controller for that data, including data you collect from participants, and you're responsible for complying with GDPR and local law.

This includes AI Features: if you upload a document to an AI Feature, ask it to use your existing Diggle content, or use AI to group or summarize Participants' open-ended answers, you remain the controller for that personal data. Our AI sub-processor only processes it to carry out the request you made.

Database backups

Data is backed up daily and retained in backups for up to 7 days. If you need something deleted faster, email us and we'll speed it up. You're free to distribute answer-display images and Excel reports from your sessions, but you're responsible for complying with personal-data rules when you do. If you cancel your subscription, your account becomes a trial account and your data remains; you can delete your account under Account settings at app.diggle.com or contact [email protected] for assistance.

Account data is retained while the account remains open. Accounting records are retained for the period required by applicable law. Other personal data is retained only as long as needed for the purposes described in this policy, including resolving disputes and meeting legal obligations.

Information you provide voluntarily

  • Contact data. Email, name, and optionally a phone number for support.
  • Content data. Anything you create or upload — exercises, titles, choices, URLs, pictures, demographics — and, as a Participant, your answers or inputs.
  • Billing data. For predefined subscription plans, our processor (Stripe) collects your billing address and card details; we don't store card numbers, type, or expiry ourselves.
  • Profile data. Where you consent (for example, to get our newsletter), a third-party marketing/email tool receives parts of your profile — name, username, email, plan — to help us manage and grow the Service.

Information collected automatically

Like most websites, we and our service providers may use cookies, web beacons, and similar technology when you use the Platform, subject to your consent choices and applicable law. This includes log and device data — the page you came from or are going to, device model, OS, browser, unique identifier, IP address, network carrier, and time zone/location — which varies by device and its settings.

Cookies and other tracking

We may use session cookies (until you close your browser) or persistent cookies (until deleted), including to keep you logged in. Some are tied to your account. We may confirm when you open a marketing email, if your device supports it. You can opt out of marketing emails but not transactional ones. We do not currently use Google Analytics.

We use Google reCAPTCHA in certain login scenarios to protect the Service against automated abuse. reCAPTCHA may process technical and interaction data and set a necessary security cookie for this purpose.

We use Cloudflare Turnstile on our contact form to protect against automated abuse. Turnstile processes technical, browser, and interaction signals necessary to distinguish legitimate users from automated traffic. Turnstile does not access, store, or transmit the contents of the contact form.

We also use Cloudflare to deliver and protect our public website and help centre. Requests and responses for these sites pass through Cloudflare and may include personal data submitted through website forms. Cloudflare provides DNS for our application and API domains, but traffic to those domains is not routed through Cloudflare’s proxy.

How we use your information

We use your information to: provide and manage the Service, including facilitating sessions between Creators and Participants; understand and improve our products; communicate with you (service-related messages you can't opt out of, and promotional messages you can); respond to your requests; keep you informed about changes to our services or this policy; protect our and our users' rights; comply with legal obligations; and manage our business consistent with what we've described here.

With whom we may share your information

We never sell your personal data, and we never will. We don't share personal information beyond what's described in this policy, or without letting you opt out where relevant. We may share it with: our sub-processors; recipients required by law (courts, regulators, law enforcement) or needed to enforce our terms or protect safety and rights; a party involved in a merger, acquisition, or similar transaction; aggregated or de-identified data for research or marketing; and, if you sign up with an organization email, that organization's Account Owner, who can then move your account into their workspace and apply their own policies (use a personal email if you'd rather avoid this).

Independent third-party services: Some optional features connect to third-party services that act as independent controllers rather than as our sub-processors. When you use Unsplash image search or display Unsplash images in Diggle, certain search-related and technical request data may be sent to Unsplash. Unsplash processes personal data it receives under its own Privacy Policy .

Creators can enable GIPHY search, and their choice is saved in their individual Diggle account and can be changed at any time. Selected GIFs load automatically for participants and projector viewers.
Searches and GIF loading send IP addresses, technical request data and GIF identifiers—and search terms when searching—directly to GIPHY. GIPHY processes this information as an independent controller, including in the United States, under its own Privacy Policy.

If you choose Sign in with Facebook, Meta authenticates your Facebook account and provides Diggle with your name and email address. Meta processes information associated with Facebook Login under its own Privacy Policy.

If you choose Sign in with Google, Google authenticates your Google account and provides Diggle with account information used for authentication, such as your name and email address. Google processes information associated with your Google account under its own Privacy Policy.

Legal basis for processing your information

We rely on: your consent, where given (withdraw it anytime at [email protected]); performance of our contract with you; and our legitimate interests in providing, improving, and marketing the Service, balanced against your rights.

Your rights and choices

If Diggle is the controller for your personal data, you can review and update your account information in your settings, or contact us to request details of what we hold, or a correction, modification, or deletion, subject to our legal obligations. If we process your personal data on behalf of one of our customers, please direct your request to that customer. You can unsubscribe from marketing email via the link in any message — you'll still get service-related emails unless you deactivate your account. You can manage non-essential cookies through our cookie consent settings and through your browser settings. We don't currently respond to browser "Do Not Track" signals. Where applicable, you also have the right to data portability, restriction of processing, and to object to processing based on legitimate interests, including direct marketing. You may withdraw consent at any time without affecting the lawfulness of earlier processing. You can complain to the Norwegian Data Protection Authority (Datatilsynet) or your local data protection authority.

  • AI Features. In line with the EU AI Act, we'll let you know within the product when you're interacting with an AI system. Where the law requires it, AI-generated output will be marked as such. AI Features are optional — Diggle is fully usable without them.
  • Automated decision-making. We don't use your personal data for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

International transfers

We may transfer, process, and store your information outside your home country where our service providers operate. Where personal data is transferred outside the EEA, we use an applicable lawful transfer mechanism depending on the recipient and destination. This may include an EU adequacy decision, the EU-U.S. Data Privacy Framework, or EU Commission-approved Standard Contractual Clauses. Our sub-processors are also subject to appropriate data processing agreements. Our primary application, database, backups, and AI infrastructure are hosted in France within the EEA. We also maintain an encrypted disaster-recovery and standby copy of relevant application data and user-uploaded content with Hetzner in Helsinki, Finland, within the EEA. See our Data Processing Agreement and current sub-processor list for more information.

Our third-party service providers and sub-processors

See our service provider and sub-processor list for the current list of providers and sub-processors and the services they provide.

Security and storage of information

We've implemented technical and organizational measures to keep data sent to Diggle secure. You can choose between different security settings when inviting participants; higher security means more complexity for you and them, so simpler, less secure options remain available by choice. Customers are responsible for choosing participant access settings appropriate to their use case.

Levels of security when joining a Diggle

  • Live session: access expires automatically after 48 hours by default; you can choose a longer login code than the 8-character default, and anonymous or nickname login.
  • Invite by link: expiration is set manually, defaulting to 48 hours.
  • Email verification: available to all customers — a six-character code, valid 15 minutes with three attempts.

We may adjust these configurations without notice to improve security or experience.

Hosting and processing, in brief

Scaleway (France) hosts our application, database, backups, and user-uploaded images, and is ISO/IEC 27001:2022, HDS, ISO 50001:2018, and Tier 3 Uptime Institute certified, and GDPR- and SWIPO-compliant. For disaster recovery, we maintain an encrypted standby copy of relevant application data and user-uploaded content with Hetzner in Helsinki, Finland. For AI Features, we use Scaleway's generative-AI infrastructure, also hosted in France. The underlying model is an open-weight model originally developed by OpenAI, but it's hosted and operated by Scaleway — under our current setup, OpenAI doesn't receive your prompts or the content Diggle generates for you. We may use additional or different AI providers as these features develop — see our sub-processor list for the current, up-to-date list. Data is encrypted in transit, and our Hetzner disaster-recovery storage is encrypted at rest; card details are held by Stripe, a PCI DSS Level 1 service provider. Our full technical and organizational security measures — encryption standards, access control, incident response, and engineering practices — are described in detail in our separate Security Policy.

Changes to this policy

We may update this policy from time to time; if we make material changes, we'll post them here and, where required, notify you as described in our Terms & Conditions. Continued use of Diggle is subject to our Terms & Conditions. Changes requiring your consent will not take effect for you without that consent.

Contacting us

Questions or comments about this policy: [email protected]. Notices to us should be in English or Norwegian, to the same address.