Privacy policy for client users analysing market research studies

This Policy explains how personal data is collected and used for people who may access our market research studies as users of the contracting client, in order to manage the services provided.

The specific information provided in each contract and project may supplement or amend this Policy.

• Entity: AUTENTIC LABS SL
• Tax identification number (NIF): B24842650
• Registered office: Carrer de Llull, 63 2 6, 08005 Barcelona, SPAIN
• Email: hola@autentic.ai
• Website: autentic.ai

Hereinafter, “Autentic”.

The role of the research organisation may vary depending on the study.

3.1. Autentic as controller

The research organisation acts as controller when it independently determines the purposes and essential means of processing, for example to manage its participant panel, select people for studies, monitor quality and prevent fraud, manage incentives, maintain participation records and conduct its own research.

3.2. Autentic as processor

In some studies, the client determines the purposes and essential means, and the research organisation processes data on its instructions.

In that case, the client is the controller and its identity will be communicated. Autentic acts in accordance with the data processing agreement and the client’s documented instructions.

3.3. Joint controllership

Autentic and the client may be joint controllers when they jointly determine the purposes and essential means of processing.

Where there is joint controllership, the identity of the joint controllers will be disclosed and their responsibilities allocated by agreement.

3.4. Independent controllers

When Autentic and the client process data for their own purposes and independently decide how to do so, each acts as an independent controller.

The mere disclosure of data between the parties does not in itself constitute joint controllership. The information specific to each study must correctly identify the applicable model.

We may process data concerning current or potential participants, panel members and people who appear incidentally in materials provided by participants, as well as the personal data of people designated as authorised users by the client.

Depending on the study, we may process various categories of participant data:

• Identification data: first and last names, alias, internal identifier, signature, identity document where strictly necessary, photograph, image or voice.
• Contact data: email address, telephone number, postal address, country, town or city and preferred communication channel.
• Sociodemographic data: age, date or year of birth, gender, household composition, family circumstances, education, employment status, occupation, industry, income range or other variables needed to segment the sample.
• Consumption and preference data: purchases, brands used, consumption habits, frequency of use, opinions, ratings, interests, expectations, purchase intentions and experience of products or services.
• Responses and content: responses and reactions.
• Technical data: IP address, device or session identifiers, browser, operating system, language, time zone, connection date and time, activity logs and technical data needed for security or fraud prevention.
• Professional data: company, position, duties, experience, industry, organisation size, professional contact information and opinions expressed in a professional capacity.
• Financial data: information needed to pay incentives or tax information, where necessary.
• Recordings: image, voice, body language, contributions and transcripts of interviews or sessions.
• Special categories of data: some studies may involve information about health or disability, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, biometric data intended to uniquely identify a person and genetic data. These categories will only be processed where necessary, specific information has been provided and a valid exception under Article 9 of the GDPR applies, such as explicit consent where appropriate. General acceptance of this Policy must not be understood as explicit consent to the processing of special categories of data.

For authorised users, we only process identification and contact data needed to establish authorised-user status, together with information about their activity as users of the systems.

Data is obtained directly from the individual concerned or from those acting on their behalf as representatives of the client, as well as from activity on our platform.

Managing your status as a user of our platform and your activity on it. The legal basis is performance of the contractual relationship.

Preparing aggregated reports: producing analyses, conclusions, statistics, presentations and reports for our own use or the client’s use. The legal basis is performance of the study and the legitimate interest in obtaining research results.

When an authorised user activates and uses an external integration, such as the Autentic connector for AI assistants (for example Claude or ChatGPT), Autentic makes available only the study data the user is entitled to access through their Autentic account.

Depending on the tool enabled and used during the user’s interaction with the AI assistant, the information processed may include study settings and results, participant responses and transcripts, demographic attributes, quotations used as evidence, recording identifiers and video clips.

To index, search and analyse study content for the user, Autentic may generate numerical representations of text called embeddings. The text needed for this operation may include participant questions and answers or evidence excerpts when indexing a study, as well as terms entered by an authorised researcher when performing a semantic search. This text is sent through OpenRouter to the selected model provider. No audio or video files are sent in this specific embedding-generation process. Instructions the AI assistant sends to Autentic when invoking a tool (such as the study requested, filters applied or search terms) are processed solely to fulfil that request.

Where Autentic acts as processor for client data for which the client is controller, Autentic processes that data on the client’s instructions. Where Autentic acts as controller, it is responsible for implementing the necessary measures and having a legal basis for the relevant purpose.

Product analytics: separately from the connector’s audit log, an MCP tool-usage event is recorded against the user’s external identifier. It includes the tool, operation outcome, duration, response size, study and organisation identifiers where applicable, client class (Claude, ChatGPT, Cursor or other), administrator and impersonation indicators, and error class where applicable. This usage event does not include tool arguments or study content. Its purpose is to analyse product usage and operation. It must not be confused with the security audit log.

Data may be disclosed or made available to:

• Study clients or sponsors: other users of the client and the client’s representative, who may request this information to assess the service provided.
• Authorities: data may be disclosed to courts, law enforcement agencies, tax authorities, data protection authorities or other bodies where there is a legal obligation or valid request.

Providers of AI assistants connected directly by the authorised user, such as Anthropic (Claude) or OpenAI (ChatGPT and Codex). The user connects the assistant using an account for that service to which they have authorised access. Data returned by enabled and invoked tools is transmitted from Autentic to the chosen assistant provider and processed as part of the user’s conversation in that service. The data returned depends on the tool used and the permissions of the user’s Autentic account; Autentic does not give the integration broader access than the user already has in Autentic. In these cases, both the AI assistant and Autentic act on behalf of the user, without a legal relationship linking Autentic to the assistant provider chosen and used by the user.

Service providers engaged by Autentic to deliver the platform, acting as Autentic’s processors: authentication and identity, hosting and database, transactional email, EU-hosted product analytics, video processing and playback, voice transcription, and routing to artificial intelligence model providers for interviews, analysis, reports and embeddings (OpenRouter and the model provider selected through that service). Only the information necessary for each operation is sent.

The capacity in which Autentic, the client and each provider act is determined by the specific data flow, the client’s instructions and the service chosen by the authorised user. Information specific to each contract and project may supplement this Policy.

Some providers, clients or group companies may be located outside the European Economic Area.

Where an international transfer occurs, a mechanism recognised by the GDPR will be used. Where necessary, the circumstances of the transfer will be assessed and supplementary measures adopted.

The use of AI assistants such as Claude or ChatGPT, OpenRouter or other underlying model or technology service providers may involve processing personal data in countries outside the European Economic Area (EEA), or access to that data from third countries.

Where such international transfers occur in services contracted, selected or managed by Autentic, they will take place only where a valid mechanism under Chapter V of Regulation (EU) 2016/679 (GDPR) exists, such as a European Commission adequacy decision or, failing that, appropriate safeguards, including, where applicable, standard contractual clauses approved by the European Commission. The need for supplementary technical, contractual or organisational measures will also be assessed in light of the destination country, the nature of the data and the risks associated with processing.

Where the client or an authorised user directly selects, configures or connects a third-party service whose processing conditions are not determined by Autentic, processing and any international transfers arising from its use are also subject to that provider’s contractual and privacy terms, account settings and transfer mechanisms. In these cases, the client must check that use of the service is compatible with its data protection obligations and that, where required, appropriate safeguards exist for international transfers, without prejudice to Autentic’s obligations for processing in which it acts as controller or processor.

Authorised users’ data is retained while they remain users and for the periods necessary to address liabilities arising from the service provided or the user’s actions.

The information retained includes the identification and contact data establishing user status, as well as activity on our platform.

The Autentic connector keeps a minimal access log including the Autentic user identifier, the tool used, the study or session accessed where applicable, the operation outcome, approximate response size, duration, and date and time. This log is retained for a maximum of 365 days.

IP addresses and user-agent data (browser or client) associated with connector requests are retained for a maximum of 90 days and then removed from the log. Search phrases, semantic queries and other free-text arguments are not retained in the connector’s audit log. Review decisions and notes recorded through the connector by a user with administrative permissions are saved in the study itself, just as if entered on the platform, and follow the retention period for study data.

The connector does not extend the retention period applicable to the original study data. Data returned to the AI assistant may become part of the authorised user’s conversation in that service. Text processed to generate embeddings passes through OpenRouter and a model provider. Retention by these services is governed by the applicable contract, account settings and each provider’s terms. Autentic does not control and cannot guarantee the retention periods applied by services selected and managed directly by the client or authorised user.

Retention periods must not be extended generally or indefinitely without justification.

The 365-day and 90-day periods above apply to the connector’s audit log, not to product analytics. MCP usage analytics is processed separately in PostHog Cloud in the EU. Autentic’s current paid plan provides a seven-year event-retention window. That window determines which events are available for queries and does not, by itself, guarantee physical deletion when it expires. Data-erasure requests are handled separately; for information or to exercise your rights, contact dpd@autentic.ai.

Technical and organisational measures appropriate to the risk will be adopted.

No system is completely invulnerable. In the event of a security breach, the assessment, documentation and notification procedures required by the GDPR will be followed.

• Access: individuals have the right to know whether the controller processes their personal data and, if so, to access that data and obtain information about the processing carried out.
• Rectification: individuals have the right to have inaccurate personal data corrected and incomplete personal data completed.
• Erasure: individuals have the right to obtain erasure of their personal data (“right to be forgotten”) when it is no longer necessary for the purpose for which it was collected, consent underlying processing is withdrawn, they object to processing, the data has been processed unlawfully, it must be erased to comply with a legal obligation, or it was obtained in connection with the offer of information society services to children.
• Restriction of processing: individuals may request that stored personal data be marked to limit its future processing. Restriction means that processing of the specified personal data ceases at the individual’s request.
• Objection: individuals have the right to object to processing in certain circumstances on grounds relating to their personal situation.
• Data portability: individuals have the right to receive personal data they have provided to the controller in a structured, commonly used, machine-readable format, where processing is based on consent or a contract or is carried out by automated means.
• Not to be subject to automated individual decisions: individuals have the right not to be subject to a decision based on automated processing of their data, including profiling, that produces legal effects concerning them or adversely affects them.

Requests may be sent to the postal address stated above or to dpd@autentic.ai.

Anyone who considers that processing infringes applicable law may contact Autentic or the Data Protection Officer at dpd@autentic.ai.

They may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

Surveys or platforms may use cookies, local storage, pixels, session identifiers or other technologies.

Detailed information must be provided in a separate Cookies Policy where applicable.

This Policy may be amended to reflect legal, technological, methodological or organisational changes. The update date will be stated at the beginning.

Where a change substantially affects existing processing, it will be communicated by appropriate means and renewed consent will be requested where necessary.

For any questions about this Policy: dpd@autentic.ai.