01Two kinds of data
The platform handles two different kinds of personal data, and we treat them differently.
- Account data: information about the researchers and teams who use the platform, such as name, work email, organization and billing details. We are responsible for this data.
- Research data: surveys, responses, contact lists, recordings and transcripts that customers collect using the platform. The customer who runs the study owns and controls this data, and we process it only on their instructions.
02Account data we collect
- Details you give us when you sign up or contact sales: name, work email, organization, role, organization type and expected survey volumes.
- Billing information needed to issue invoices. Card details are handled by our payment processor and never stored on our servers.
- Usage information such as log-in times, features used and device and browser type, used to keep the service secure and improve it.
03How respondent data is handled
Respondents are told who is asking and why, and take part only with their consent. Every survey shows the name of the organization running it and a link to that organization's privacy notice.
- Anonymous surveys stay anonymous. No name, email, phone number or IP address is attached to an anonymous response.
- For identified surveys, personal details are removed or masked before AI analysis wherever possible.
- Interview and focus-group recordings require participant consent, recorded against each session, and are stored encrypted.
- Respondents can ask the organization running a study to access or delete their answers. We help customers fulfil those requests.
04How we use AI
AI Insight Miner and Interview Notes use machine learning models to theme open-ended answers, score sentiment, transcribe recordings and write summaries.
- AI output is a starting point. Researchers review themes, and every theme and summary links back to the original answers or transcript lines.
- Research data is never used to train models for other customers.
- Where third-party model providers process data on our behalf, they are contractually bound not to retain it or use it for training.
05We never sell data
We do not sell, rent or trade account data or research data. We do not use research data for advertising, and we do not build profiles of respondents across customers.
07Security
- Encryption in transit with TLS and at rest with AES-256.
- Role-based access so each user sees only the studies and locations they are permitted to.
- Access to production systems limited to a small number of staff, with logging and regular review.
- Regular backups, with restoration tested.
08Retention and deletion
Customers decide how long research data is kept, and can delete individual responses, whole studies or recordings at any time. Deleted data is removed from active systems immediately and from backups within 30 days.
When an account is closed, research data is available for export for 30 days and then deleted. Account and billing records are kept for as long as tax and accounting laws require.
09Your rights
Depending on where you live, including under India's Digital Personal Data Protection Act, 2023 and the EU GDPR, you may have the right to access, correct, delete or export your personal data, to withdraw consent, and to raise a grievance. Researchers can manage most of this from account settings. Respondents should contact the organization that ran the survey, and we will support that organization in responding.
11Changes to this policy
If we make a material change, we will notify account owners by email before it takes effect.
Questions about this policy? Write to us through the Research Desk.