Who we are
Ruddud provides a live audience engagement service at ruddud.com and app.ruddud.com. Ruddud is being incorporated in Morocco; the company’s registered name and address will be added to this page when registration is complete.
For any question about your data, write to privacy@ruddud.com.
Two kinds of people use Ruddud
Presenters create an account and run sessions. Participants join a session with a code or a QR code, from their own phone or computer, without creating an account. What we collect is different for each.
What we collect from presenters
- Your email address, your organisation’s name and your preferred language.
- Your password, stored only as a salted one-way hash. Nobody at Ruddud can read it.
- If you sign in with Google or Microsoft: your name, email address and profile picture, as that provider shares them. We never receive your Google or Microsoft password, and we ask for no access to your mailbox, contacts, calendar or files.
- What you create: presentations you upload, questions, sessions, their results and the reports generated from them.
- Technical data: your sign-in sessions, and the IP address of each request, used to protect sign-in and joining against abuse and kept in server logs for a limited time.
What we collect from participants
We do not ask participants for an account, a phone number or an email address.
- Your answers: votes, words, ratings, questions, open text and questionnaire responses.
- A name, only if the presenter asks for one and you choose to give it.
- A group photo, only if you choose to take part. Nothing leaves your phone until you tap send.
- A random identifier kept in your browser tab, so that you stay in the session if the page reloads. It is not linked to who you are.
- If you answer an anonymous questionnaire, a note in your browser that this device has already answered it, so it is not answered twice. It holds no answer and no name.
The presenter sees the answers and any name you gave. In an anonymous session, answers are not linked to a name. The presenter never sees your device, your IP address or the identifier above.
How we use it
- To run the service: sign you in, run live sessions, show results and produce reports.
- To summarise and group answers, and to write session reports, with the help of an AI model.
- To check that open answers and photos are suitable before they appear on a shared screen.
- To keep the service secure and prevent abuse.
- To email presenters about their account: verifying an address, resetting a password, an invitation to join an organisation.
We do not sell personal data, use it for advertising, or build profiles of participants.
Artificial intelligence
Open-text answers, questionnaire answers and the content of a session are sent to Anthropic’s Claude models to group similar answers, write summaries and reports, and screen what is about to be shown on a projector.
For a group photo, each face is sent on its own, with no name and no session details. The model is asked only whether the picture is suitable to display, never who is in it.
Under Anthropic’s commercial terms, data sent through its API is not used to train its models.
Who processes data for us
- Railway: hosting, database and file storage, in the Netherlands (European Union).
- Anthropic: the AI model described above, in the United States.
- Resend: sending account emails, from its European Union region.
- Google and Microsoft: only if you choose to sign in with them.
- Cloudflare: domain name services, and the network that delivers ruddud.com.
Each of them processes data only to provide its service to us. Where data leaves Morocco, we rely on those providers’ contractual safeguards, and we handle data to the standard of Moroccan law 09-08 and the European General Data Protection Regulation (GDPR).
How long we keep it
- Presenter accounts and their content: for as long as the account exists. To close your account, write to privacy@ruddud.com and we delete it and its content within 30 days.
- Group photos: deleted 30 days after the session ends. The framed group picture is kept with the session report.
- Session results and reports: for as long as the presenter’s account exists.
- Free polls created without an account: open for 30 minutes. Their results are anonymous votes, kept with no account or name attached.
- Password reset links expire after 30 minutes. Sign-in sessions expire on their own.
Cookies and browser storage
ruddud_session: keeps a presenter signed in. Essential; the app cannot work without it.ruddud_signed_in: tells ruddud.com that you are signed in, so it can take you to the app. It contains no personal data.- Two short-lived sign-in cookies: one that protects a Google sign-in against forgery while it is under way, and one that remembers you chose not to stay signed in.
- Your theme, language and display preferences, stored in your browser.
- The questionnaire note described above, stored in your browser.
- The participant identifier described above, stored in your browser tab.
We use no advertising, analytics or tracking cookies.
Your rights
You can ask to see the personal data we hold about you, correct it, export it, object to its use, or have it deleted. Write to privacy@ruddud.com and we will answer within 30 days.
If you took part in a session, your answers are also under the control of the presenter who ran it, and you can ask them as well. If you are not satisfied with our answer, you can complain to Morocco’s data protection authority, the CNDP (www.cndp.ma), or to the authority in your own country.
Security
All traffic is encrypted in transit. Passwords and sign-in tokens are stored only as hashes. Sensitive data is kept apart from the rest, behind database permissions that the parts of the system serving presenters do not have.
Children
Presenter accounts are for adults. Participants may include students; a presenter running a session with minors is responsible for having the authorisation their school or the parents require. Participants under 16 should take part only in sessions run by their school or with a parent’s agreement.
Changes to this policy
When this policy changes, we publish the new version here with a new date. If a change matters to how your data is used, we email presenters before it takes effect.