Privacy policy

This document explains what information Porsino (porsino.com) receives from you and from the people who fill in forms, what it does with it, where and for how long it is kept, and the choices you have. For cookies and visit statistics see the Cookie policy; for the rules of use see the Terms of Service.

Last revised: 9 Oct 2026

1. At a glance

We do not sell your data or give it to anyone for advertising.
The site has no advertising cookies, tracking pixels or third-party analytics (such as Google Analytics).
The responses to a form belong to the person who made it; Porsino only keeps them on that person's behalf.
Porsino's server is in Germany, and every connection is encrypted (HTTPS).
Files that respondents upload are deleted automatically after a set period, and a deleted form is erased for good 30 days later.
You can export or delete your data whenever you like.

2. Who we are

Porsino is an online service for building forms, surveys, exams, contests and résumés, offered at porsino.com. The business «Porsino» is registered with Iran's e-commerce trust mark system (eNamad), with Khaf as its city, and the eNamad badge appears at the bottom of the site's pages.

Ways to reach us are listed on the Contact us page, and the seller's details are printed on the official invoice of every purchase.

3. Porsino's two roles

For your account data (name, email, payments and so on) Porsino is the controller, and this document covers that data directly.
Data collected through a form, exam or contest belongs to the form owner, who decides what to ask, what is recorded and what is done with the answers. Porsino only stores and processes it on the owner's instructions in order to provide the service (as a processor) and never uses it for its own purposes.
If you are a respondent, the form owner's own notice and privacy policy also apply to your answers.

4. What we collect from account holders

Name, email address and, if you provide it, a mobile number
To give the free trial, we verify the account's mobile number with an SMS code and keep a one-way keyed fingerprint (hash) of it — even after the account is deleted — so each number gets the free trial only once.
Your password, stored only as an argon2 hash; nobody, including Porsino's administrators, can see it
What you create: forms, exams, question banks, contact lists, résumés, templates and settings
Team members and colleagues you invite
Orders, plans and licences, and discount codes used; for card-to-card payments, the receipt you send (an image or the bank's text message, the reference number, the last four digits of the card, the amount and the time)
Details you enter for an official invoice: your name or company name, national ID or company ID, economic code, address, postcode and phone number
Messages you send through the contact form or by email, together with your IP address and browser type to keep spam out
Questions you ask the panel's AI assistant, used to improve the help content
Important account events (such as signing in, creating, publishing and deleting forms, changing settings and purchases) for security and follow-up

5. Information about respondents and participants

When you fill in a form, exam or contest, the following is stored for its owner:

The answers and files you enter or upload yourself (including a signature, voice recording or photo if the form asks for one)
When you started and submitted, and how long it took
Your IP address and browser details, unless the owner has switched them off or the form is anonymous; and the device type (phone, tablet or computer)
The page you came from, your screen size and time zone, except on anonymous forms
A hashed identifier made from your IP address, browser and a few technical device features, used to spot duplicate responses; on anonymous forms only when «One response per person» is on, and only valid for that form
Your location, only if the form has a location field and you allow it in your browser
The mobile number you confirm with an SMS code, if the form requires it
On payment forms: the amount, reference number and result of the transaction (card details are only ever entered on the bank gateway's page)
In exams: answers, timings and the score; and, if the owner has turned them on, anti-cheating events (such as leaving the page or full-screen mode), a device identifier for «device lock», and periodic webcam photos
A tracking code, if the owner has enabled it
If you arrived through a personal invitation link: when you opened it and when you completed it, so the owner does not send you reminders

Read the form's own description before you fill it in. To see, correct or delete your answers, contact the form owner first; if you get no reply, tell us through the contact page and we will follow it up.

6. Why we use this information

To provide the service and perform our contract with you: building and showing forms, recording responses, reports and exports, payments and invoices
Security and abuse prevention: sign-in, protection against forged requests, rate limits, and detecting spam and duplicate responses
Legal obligations: keeping financial records and invoices, and answering a competent judicial authority
Talking to you: the emails and text messages your account needs (confirmation, password reset, receipts, reminders that a plan or trial is ending, news of «Queued» responses, reminders about an unfinished purchase, and clean-up reminders), and occasional news or offers; every marketing email carries an unsubscribe link, and to stop informational text messages just tell us
Improving the site with aggregate visit statistics that identify nobody
Your consent, wherever you switch something on yourself: the exam webcam, location, microphone or the AI tools

We never use data for targeted advertising, to build marketing profiles, or to sell to others.

7. Sign in with Google

If you choose «Sign in with Google», you go to Google's own sign-in page and your Google password never reaches Porsino. Porsino asks only for the basic scopes (openid, email and profile) and, of what Google returns, uses and keeps only your verified email address and display name.

The email address is used to find your existing account or create a new one, and the name to show in the panel. Porsino has no access to Gmail, Drive, Contacts or any other data in your Google account, does not keep Google tokens, does not share this information, does not use it for advertising and does not use it to train AI models.

Porsino's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Porsino's access at any time from your Google account permissions page; your Porsino account keeps working with your email and password.

8. AI tools

Porsino's AI tools — building a form or exam from a sentence, editing by instruction, reading a file, summarising, classifying and translating responses, analysing a report, and the AI assistant — only run when you press one of them.

At that moment the text needed (your instruction, the file's text, the form's structure, or the responses and report figures you selected) is sent to an AI provider. The main provider is Google Gemini; if it is unavailable, the request goes to one of the back-up providers the administrator has enabled (such as Groq, OpenRouter or the AvalAI gateway).

Separately from these tools, a message you send through the “Contact us” form is sent to the same providers to draft a reply; if you have a Porsino account with the same email, a summary of that account (plans and licences, usage and orders) goes with it, but not your IP address or browser details. Porsino support reads the draft before it is sent; only when auto-send is on may answers to simple how-to questions be sent without review. The draft stays with the message in the support inbox.

These providers may keep the text for a while or use it to improve their services under their own terms, so do not give the AI tools sensitive information (such as national ID numbers or health or financial details). AI output can be wrong; review it before you use it.

The text and result of each AI job stay on Porsino's server for 24 hours unless you save the result into a form or report. Questions asked to the AI assistant are kept for 180 days.

9. Exam supervision and webcam

Anti-cheating checks, «device lock» and webcam photos are switched on by the exam owner, not by Porsino; the exam's start page tells you which ones are on.

Webcam photos are taken only when the owner has turned them on and you have agreed on the start page; while the exam runs you see a «Camera is on» badge. Photos are taken at the interval the owner sets (every 5 minutes by default), are shown only to the exam owner, and are deleted automatically after the period the owner sets (30 days by default, at most 365 days).

«Device lock» keeps a random cookie (fc_dev) and a hash of browser features so that the exam opens only on the permitted devices.

10. Payments, text messages and email

Online payments happen on the page of a bank gateway licensed by Shaparak (Porsino works with Zibal and Zarinpal, and whichever is active appears on the payment page). You enter your card number and PIN only on the gateway's own page and they never reach Porsino; Porsino keeps only the amount, the reference number and the result.
Card-to-card receipts are reviewed by Porsino's administrator to confirm the payment.
Money paid through payment forms goes straight to the form owner's own gateway, and Porsino is not a party to that transaction.
Text messages (verification codes, sign-in links, reminders and messages a form owner sends) go through the FarazSMS gateway, which receives only the number and the text of that message.
Emails are sent by Porsino's own mail server. Mail you send to @porsino.com addresses reaches our support mailbox in Gmail through Cloudflare's email routing service.
If a form owner sends invitations or notifications by text message, email or Telegram, the address and text of that message are passed to the service concerned.

12. Where data is stored and international transfer

Porsino's database, files and backups are kept on its virtual private server (VPS) in a data centre in Germany. So if you are in Iran or any other country, your data is transferred outside your country and stored there.

Some providers (such as Google and Cloudflare) may process data in other countries; the text-message gateway and payment gateways are in Iran. If your organisation must keep data inside Iran, take this into account before using Porsino.

13. How long we keep data

Data	How long
Your account, forms, exams and responses	While the account is active, or until you delete them
Deleted forms and exams	30 days in the trash, then erased for good with their responses and files
A response you delete on its own	Leaves lists, reports and exports at once; its data is erased when the form is erased for good, or sooner if you ask us
Files uploaded by respondents	Deleted from the server after the retention period (15 days by default; the current number is shown in the editor and on the responses page, and the owner gets emails 3 days and 1 day before). Signatures and workflow attachments are kept.
«Save and resume» drafts on the server	30 days after the last save
Answer drafts in your own browser	Until you submit; drafts older than 7 days are removed
Exam webcam photos	The period the exam owner sets (30 days by default, at most 365 days)
Site visit statistics (no IP addresses)	400 days
Questions to the AI assistant	180 days
AI jobs on the server	24 hours
Export files (Excel, PDF and the like)	About 10 minutes after they are made
Orders, payments and invoices	As long as tax and commercial law requires, even after the account is deleted
Account security events, contact messages and the log of messages sent	As long as they are needed for security, support, resolving disputes or legal obligations
Backups	Nightly backups of the database and files are kept for 14 days, and the database is also backed up before system updates. Backups exist only for recovery after a failure, and deleted data may remain in them until they are removed.

Your account, forms, exams and responses
How long:
While the account is active, or until you delete them
Deleted forms and exams
How long:
30 days in the trash, then erased for good with their responses and files
A response you delete on its own
How long:
Leaves lists, reports and exports at once; its data is erased when the form is erased for good, or sooner if you ask us
Files uploaded by respondents
How long:
Deleted from the server after the retention period (15 days by default; the current number is shown in the editor and on the responses page, and the owner gets emails 3 days and 1 day before). Signatures and workflow attachments are kept.
«Save and resume» drafts on the server
How long:
30 days after the last save
Answer drafts in your own browser
How long:
Until you submit; drafts older than 7 days are removed
Exam webcam photos
How long:
The period the exam owner sets (30 days by default, at most 365 days)
Site visit statistics (no IP addresses)
How long:
400 days
Questions to the AI assistant
How long:
180 days
AI jobs on the server
How long:
24 hours
Export files (Excel, PDF and the like)
How long:
About 10 minutes after they are made
Orders, payments and invoices
How long:
As long as tax and commercial law requires, even after the account is deleted
Account security events, contact messages and the log of messages sent
How long:
As long as they are needed for security, support, resolving disputes or legal obligations
Backups
How long:
Nightly backups of the database and files are kept for 14 days, and the database is also backed up before system updates. Backups exist only for recovery after a failure, and deleted data may remain in them until they are removed.

Automatic clean-up: a form, survey or exam that has sat unused with no responses, and a résumé that has not been edited or viewed for a while, moves to the trash after three email reminders and can be restored for 30 days; choosing «Keep it» stops this.

14. Security

We use the following measures:

Encrypted connections (HTTPS) on every page
Passwords hashed with argon2, short-lived sign-in sessions and httpOnly sign-in cookies
Protection against forged requests (CSRF), request rate limits, and bot and spam detection
Checking the real type of uploaded files and sanitising incoming HTML
Encrypting form owners' payment-gateway keys, and confirming every payment on the server only
Logging important account events, and nightly backups

No system is perfectly secure. If a security incident affects your personal data, we will email you without delay once we know of it — within 72 hours where possible — explaining what happened and what we have done, and we will report it to the relevant authority where the law requires. If you notice a security problem, please tell us through the contact page.

15. Your rights

See and edit your account details in «Settings»
Export responses and reports (Excel, CSV, JSON and more) whenever you like
Delete a response, a form, an exam or your whole account
Unsubscribe from marketing emails with the link at the bottom of each one, and revoke Google access from your own Google account
Ask for a copy of your data, or for correction, restriction or objection, through the contact page; we reply within 30 days
If you are in the European Union, you can also complain to your country's data protection authority

Deleting your account: go to «Settings › Security › Delete account». Once you confirm, you are signed out and can no longer sign in, and your email address and mobile number are removed from the account; this cannot be undone. Your previous email address stays only in the security event log.

Deleting the account does not automatically erase its forms and responses. If you want them gone too, delete them before deleting the account (they are erased for good 30 days later), or ask for «full data deletion» through the contact page and it will be done within 30 days. Financial records the law requires are kept.

If you are a respondent, send your request to the form owner first; if they do not reply, we will help pass it on and follow it up.

16. Children and young people

Accounts and purchases are for people with full legal capacity; Porsino does not knowingly open accounts for children. Schools and teachers who build forms or exams for students are the controllers of the students' data: they must obtain the consent of parents or the school, ask for as little as possible, and use tools such as the webcam only for a clear reason.

17. Changes to this policy

The date of the last revision is shown at the top of this page. We announce important changes on the site and by email at least 7 days before they take effect. The Persian text of this document is authoritative; the English version is a translation.

18. Contact

For any privacy question or request, send us a message from the Contact us page and mention that it is about privacy.

Related documents: Porsino Terms of Service · Cookie policy