Privacy Policy

Our Policies

At Userlytics Corporation, we attach great importance to the protection and privacy of our customers, testers, research participants, business partners, and website visitors.

Personal data is processed lawfully, fairly, and transparently, and is handled and secured with appropriate care and safeguards in accordance with applicable data protection laws.

We comply with the General Data Protection Regulation (GDPR) and the EU-U.S. Data Privacy Framework (DPF). This Privacy Statement explains how we collect, use, store, and share your personal data.

If you are a citizen of California, you can read our annex on compliance with the CCPA here.

This Privacy Policy applies to all interactions, services, platforms, tools, and applications that we operate or manage.

When We Collect Your Personal Data 

We collect only personal data that is relevant and necessary for the provision of our services, the operation of our platforms, and the management of our contractual and business relationships.

We may collect personal data when you:

• Visit or use our websites;
• Register for, access, or use our platforms, including user testing platforms, client management dashboards, or related tools and mobile applications;
• Interact with us in the course of providing or participating in usability testing, research activities, or related services;
• Communicate with us by email, phone, post, or other electronic means;
• Engage with us as a client, tester, participant, partner, or authorized user of our services.

Personal data may be disclosed to our clients solely for the purpose of conducting usability testing, research studies, and related services, and only to the extent necessary for those purposes. We may also disclose personal data to third party service providers acting on our behalf, to advertising and marketing partners in connection with our promotional activities, to fraud prevention and detection service providers  or where required by applicable law or legal obligation. 

Children’s privacy

Protecting the privacy of young children is especially important. For that reason, USERLYTICS™ does not knowingly collect or solicit personal information from anyone under the age of 16 without parental consent. In the event that we learn that we have collected personal information from a child under age 16 without parental consent, we will delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at dpo@userlytics.com.

Personal Data Categories and Legal Basis 

We process personal data based on the specific nature of your interaction with our services as described below; the categories collected and the legal basis relied upon vary according to whether you are a website visitor, platform tester, or client and according to the specific purpose for which the personal data is used. 

Website Visitors

For individuals accessing our public website and applications, we process technical data, such as your IP address, browser type, and device information, approximate location and activity data regarding your interaction with our website and applications, collected automatically, including through cookies and similar technologies, as further described in our Cookies Policy. Where you contact us or subscribe to our communications, we also process identification and contact data, such as your name and email address.

Purpose	Legal Basis
Prevent fraud and misuse of the platform	Legitimate Interest
Operate, secure, and maintain the website	Legitimate Interest
Understand website usage, improve performance, and manage advertising	Consent
Respond to inquiries, provide support, and communicate about our products and services.	Legitimate Interest; Performance of a Contract
Send newsletters and blog updates	Consent

Panel Testers

For users participating in our study platform, we process identification and contact data, such as your name, email address, age and username; account credentials; professional, approximate location and demographic data, such as your job title, industry, and other screening information relevant to study eligibility; audio/visual data, including video and screen recordings of testing sessions and audio captures generated during your participation in research activities; responses, feedback, and behavioral observations generated during testing sessions; and technical identifiers, device and browser characteristics, and other technical and security data used to detect and prevent fraudulent activity. 

Purpose	Legal Basis
Provide access to the platform and enable its features; send invitations for studies	Performance of a Contract
Administer the contractual relationship, including payments and claims	Performance of a Contract and Legal Obligation
Assess eligibility for a specific study or research project	Performance of a Contract
Send subscription or account update communications	Performance of a Contract
Send communications and promotional messages	Consent
Make study invitations more relevant to your profile and preferences	Legitimate Interest
Improve and develop models, simulation tools, and platform features	Legitimate Interest
Prevent fraud and misuse of the platform	Legitimate Interest

Clients

For registered clients and their authorized representatives, we process identification and contact data of your representatives; business and account information; professional service data related to the studies and projects you commission; and economic and billing data necessary for invoicing and regulatory compliance.

Manage the contractual relationship and authorized client staff; send communications related to the service	Performance of a Contract
Improve and develop models and platform features	Legitimate Interest
Send marketing and promotional communications	Consent

Retention Periods

We retain personal data for as long as necessary to fulfil the purposes set out in this Privacy Statement, taking into account the following criteria:

• Duration of the contractual relationship and platform account.
• Statutory retention obligations under tax, accounting, commercial, and regulatory law (typically up to ten years for accounting records).
• Statute of limitations for civil, contractual or regulatory claims.
• Specific periods agreed with our clients for the retention of research outputs.
• Time strictly necessary to address security incidents, audits, and legal proceedings.

Once the applicable retention period expires, personal data is securely deleted, anonymised, or otherwise disposed of in accordance with applicable laws and our internal policies.

Sharing of Personal Data

We may share your personal data where necessary to operate, provide, and promote our services and platforms, including through the use of cookies and similar technologies, such as for analytics and performance measurement, conduct research activities, or where required by applicable law. Further information about our use of cookies and similar technologies is available in our Cookie Policy.

Userlytics collaborates with several trusted partners who support our usability testing, research, and related services. These include:

• IT and cloud service providers that maintain our systems, databases, websites, and communication platforms;
• Analytics, cookie, and technology partners that assist us in operating, securing, analyzing, promoting and improving our websites and services through cookies and similar technologies, as described in our Cookie Policy;
• Clients to whom we provide tester profile and screening information for the purpose of conducting usability tests, user experience research, and similar studies, where such clients act as the data controller and we act as their data processor in providing the services; 
• Professional advisors and service providers, including legal, accounting, and compliance advisors, where necessary for our business operations;
• Supervisory authorities, regulators, and courts, where disclosure is required by law or necessary to establish, exercise, or defend legal claims;
• Third parties involved in corporate transactions, such as mergers, acquisitions, or asset transfers involving Userlytics.

All third parties are contractually bound by data processing agreements or equivalent safeguards to ensure that personal data is processed securely, used only for its intended purpose, and protected in accordance with applicable data protection laws, including the GDPR. Only the personal data strictly necessary for the relevant purpose is shared.

As part of certain research activities, our clients may ask testers to register for, log into, or otherwise interact with third-party applications or services in order to complete a testing task. Any personal data you provide directly to such third-party applications or services is collected and processed by those third parties in accordance with their own privacy policies and terms, and not by us. We encourage you to review the privacy practices of any third-party application or service before participating in a related testing activity.

International Transfers of Personal Data

Userlytics, Inc. is a company based in the United States. Where personal data is transferred from the European Economic Area (“EEA”), the United Kingdom, or Switzerland to the United States or other countries, Userlytics ensures that such transfers are carried out in accordance with applicable data protection laws.

Userlytics represents that it is self-certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. Data Privacy Framework (UK Extension to the EU-U.S. DPF), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF). With respect to personal data transferred pursuant to these frameworks, Userlytics complies with the applicable Data Privacy Framework Principles. Further information about the Data Privacy Frameworks is available at:
https://www.dataprivacyframework.gov/

In accordance with the Data Privacy Framework Principles, Userlytics commits to resolving complaints regarding its collection or use of personal data. Individuals from the EEA, the United Kingdom, or Switzerland with inquiries or complaints related to Userlytics’ Data Privacy Framework compliance should first contact Userlytics at DPO@Userlytics.com.

Userlytics has further committed to refer unresolved Data Privacy Framework complaints to the Insights Association, which serves as Userlytics’ independent recourse mechanism and alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint from Userlytics, or if your complaint has not been satisfactorily resolved, you may contact the Insights Association for more information or to file a complaint at:
https://www.insightsassociation.org/Resources/Data-Privacy-Framework/Information-for-EU-Swiss-Citizens-to-file-a-complaint
The services of the Insights Association are provided at no cost to you.

Where the Data Privacy Frameworks do not apply or are not available for a particular transfer, Userlytics relies on other legally recognized transfer mechanisms, including the European Commission’s Standard Contractual Clauses (SCCs), together with any required supplementary measures.

Userlytics has implemented appropriate technical, organizational, and contractual safeguards to ensure that personal data transferred internationally is protected in accordance with applicable data protection laws, including the GDPR.

For additional information, please refer to the Userlytics Data Privacy Framework Statement.

Security of processing

We apply technical and organizational security measures appropriate to the risks of our processing activities, including:

• Restricted access and role-based permissions;
• Firewalls, encryption, and intrusion detection systems;
• Regular backups and secure storage;
• Employee confidentiality and privacy training;
• Incident reporting and data breach notification within 72 hours when required.

Our systems are regularly reviewed and tested to ensure the ongoing confidentiality, integrity, and availability of your personal data.

Automated Decision-Making and Profiling

Certain activities on our services may involve automated decision making that can produce legal or similarly significant effects on the individuals concerned, including screening decisions on whether a tester is selected for a study, validity assessments of completed study responses, and fraud prevention checks to detect the use of multiple accounts by the same tester; for more information about the logic involved, or to request human review, please contact us at inquiry@userlytics.com. 

Data subject rights

Depending on your location and the applicable data protection laws, you may have certain rights in relation to your personal data. These rights may include:

• Right to access: obtain confirmation and a copy of your personal data.
• Right to Rectification: correct inaccurate or incomplete data.
• Right to Erasure: request deletion of your data in certain cases.
• Right to Restriction: limit processing in specific situations.
• Right to Portability: receive your data in a structured format and transfer it to another controller.
• Right to Objection: object to processing based on legitimate interests or to direct marketing.
• Right to Withdraw consent: when processing is based on consent, you may withdraw it at any time.
• Right to not be subject to automated decision making that produces legal or similarly significant effects, where applicable. 

You can exercise these rights by sending an email to dpo@userlytics.com

We will respond within one month of receiving your request, or earlier if required by applicable law.

Please note that when you are a tester participating in a study for a specific client of Userlytics, that client acts as the controller for the personal data processed in that context and is primarily responsible for complying with these rights for that purpose. We recommend contacting that client directly to exercise any right in relation to that specific study. If you require assistance identifying the relevant client or need further guidance, you may also contact us at dpo@userlytics.com. 

Updates to this Privacy Statement

We may update this Privacy Statement from time to time to reflect changes in our practices, services, or applicable law.