How this research form handles your information

Who is responsible

The operator and controller of the information collected through this form is Clayton LHONI, France. Orkesa is the name of the research project and is not presented as a separate legal entity.

For any privacy question or request, email privacy@orkesa.co.

Information collected

When you submit the form, the following may be stored:

• your answers about the software-spend issue, including the type of problem, vendor (unless you prefer not to say), approximate amount, payment or commitment status, your account of what happened, any recovery attempt and its outcome;
• your role and company-size range;
• whether you agree to be contacted for an optional interview and, only if you opt in, your email address; and
• the submission date, a randomly generated submission identifier, campaign attribution information, and limited anti-abuse data as described below.

Free-text answers can contain information about you, another person, or a company. Please avoid including personal or sensitive information that is not needed to describe the software-spend issue.

The form identifies required questions as you proceed. Those answers are necessary to submit a research response; if you do not provide them, the response cannot be submitted. The final interview choice and email address are optional. An email address is stored only when you expressly opt in to interview contact.

Campaign and URL attribution

The form preserves all query-string keys and values supplied in the page URL, including repeated and unrecognized parameters. It also maps commonly used attribution fields separately: source, campaign or campaign_name, adset or adset_name, ad or ad_name, utm_source, utm_medium, utm_campaign, utm_content, utm_term, and fbclid.

Meta's _fbp and _fbc cookie values are read and stored with a submission only after you have accepted Meta measurement. Before consent, or after rejection or withdrawal, the form ignores those cookie values and clears copies accessible to this site. Campaign names are not inferred from fbclid.

Why the information is used

The information is used to:

• run the questionnaire and save completed responses;
• conduct internal research into software-spend problems and produce aggregated findings;
• understand the source and performance of research outreach and campaign traffic;
• send the operator an internal notification after Neon stores a new research response;
• secure the form, enforce rate limits, and prevent spam or abuse; and
• contact you about a research interview only when you have expressly opted in.

The legal basis for operating the questionnaire, conducting the research, protecting the service, preventing abuse, and recording source attribution is the controller's legitimate interests in carrying out and evaluating this research safely. The legal basis for using your email to invite you to an optional interview is your consent.

Research outputs and disclosure

Research may be shared as aggregated findings. No quotation or account attributable to a person or company will be published or shared without separate permission.

Service providers

The form uses Vercel for application hosting, routing, and server-side processing, and Neon for managed PostgreSQL database hosting. They process information on the controller's behalf to provide and secure these services, subject to their applicable terms and data-protection commitments.

Telegram is used to send an internal notification to the operator after Neon stores a new response. The application may transmit the following information to Telegram as part of that notification:

• answers to the questionnaire;
• the free-text account of what happened;
• company and vendor information;
• an email address only when it was voluntarily provided; and
• advertising attribution information associated with the submission.

Telegram delivery is separate from storage in Neon. A Telegram delivery failure does not change the stored response.

Meta is an advertising measurement provider only when a valid Meta Pixel ID is configured and you accept Meta measurement. If either condition is absent, the form sends no Pixel events to Meta.

GoDaddy Email & Office is used to manage the privacy email alias and route messages sent to the contact address above to the existing Orkesa mailbox.

International processing

Vercel, Neon, GoDaddy, and their subprocessors operate internationally. Information may therefore be processed outside France and outside the country where a participant is located, including in the United States. Their applicable service and data-protection terms describe the transfer mechanisms available for their services, which may include approved standard contractual clauses where relevant.

Telegram also operates internationally, so information included in an internal notification may be processed outside France and outside the country where a participant is located.

Contact privacy@orkesa.co to request current information about processing locations and the safeguards relevant to this research setup.

Meta Pixel and tracking consent

The Meta Pixel is non-essential and disabled by default. The form asks for your choice before loading any Meta script. Accepting loads the Pixel and sends a PageView event only if a valid Pixel ID is configured. A Lead event is sent only after Neon has successfully stored a form response. The Lead event does not include form answers or an email address.

Rejecting does not affect the research form. The choice is stored in this browser's local storage so the form does not ask again on every visit. You can change or withdraw it at any time. Withdrawal removes the Pixel script and globals, clears site-accessible Meta _fbp and _fbc cookies, and prevents new Pixel events unless you accept again.

Review or change Meta tracking choices

Security and abuse prevention

The server processes the connection IP address from request headers to enforce a limit of five valid submission attempts per ten-minute window. Before the rate-limit record is written to Neon, the application transforms the IP address with a secret-keyed HMAC-SHA-256 function. Only that keyed digest, rather than the raw IP address, is written to the application's Neon rate-limit table. This digest is pseudonymous security data, not anonymous data.

The raw IP address is therefore processed transiently by the application and may also be processed by Vercel as part of normal network hosting and security. The application does not write the raw IP address to its research or rate-limit tables in Neon.

Retention

Personal information collected for this research is retained for a maximum of 12 months from collection. It is then deleted or anonymized. Aggregated or genuinely anonymized findings may be kept because they no longer identify a person. Operational rate-limit records are used only for security and abuse prevention, are pruned more frequently as part of normal operation and maintenance, and remain subject to the same 12-month maximum.

Your choices and rights

Depending on the law that applies to you and your request, you may ask to access, correct, or delete your personal information; restrict its use; receive a portable copy where that right applies; or object to processing based on legitimate interests. You may withdraw your consent to interview contact at any time. Withdrawal does not affect processing that occurred before it, and you can still participate in the questionnaire without agreeing to an interview.

Send a request to privacy@orkesa.co. Include enough information to locate the relevant submission; additional information may be requested when reasonably necessary to verify the request. Requests will be handled under the applicable privacy law.

You may also lodge a complaint with the French data-protection authority, the CNIL, or another competent supervisory or privacy authority where applicable.

Meta measurement consent can be changed or withdrawn through the tracking choices control.

Automated decisions

The information is not used to make decisions about you based solely on automated processing, and no profiling produces legal or similarly significant effects for you.