Privacy Policy

Early-access draft. This document is pending legal review and will be finalized before general availability.

How Verbalab collects, uses, and protects personal data belonging to customers and survey respondents.

Introduction

This Privacy Policy describes how Verbalab ("we", "us", "our") collects, uses, discloses, and protects personal data when you use our AI-run market research platform (collectively, the "Services"). The Services include the customer panel at app.verbalab.ai, where a study is briefed and followed, and the survey site at survey.verbalab.ai, where respondents answer.

On Verbalab, an AI research agent plans a study from the customer's brief, writes the questionnaire, runs the field, and reads the results into findings. Personal data can reach us at several points in that chain, and this policy explains what happens to it at each one.

By using our Services, you agree to the collection and use of information in accordance with this policy.

WARNING: Early Access Notice
Verbalab is currently in early access. While we implement industry-standard security measures and data protection practices, please be aware that an early-access service may undergo significant changes, updates, and improvements. Commercial terms are agreed per study during early access. We recommend keeping your own copies of briefs, questionnaires, and exported results that matter to you.

Important: Data Controller vs. Data Processor Distinction

Verbalab as Data Controller

For personal data about you (the customer using Verbalab), such as your account information, contact details, billing details, and usage data, Verbalab is the Data Controller under GDPR and applicable data protection laws worldwide. This Privacy Policy explains how we process this data.

Verbalab as Data Processor - Your Responsibility

When you commission a study and supply data about other people — your own contact list, your sample context, customer records, or any personal data embedded in your brief or your questionnaire — you are the Data Controller and Verbalab is the Data Processor.

Where you supply your own contact list or sample context, that data reaches Verbalab in cryptographically signed form, and you remain responsible for it.

This means:

You are responsible for complying with GDPR and other applicable data protection laws in your jurisdiction regarding the personal data you bring into a Verbalab study
You must inform the people on your list how their data will be used for research
You must obtain the consents required before those people are invited to an interview
You must ensure you have legal grounds to share that data with us for the purposes of the study
Verbalab has no direct relationship with the people on a list you supply, beyond conducting the interview you commissioned
Verbalab is not responsible for your compliance obligations as a data controller

What We Do as Data Processor

As a data processor for the study data you entrust to us:

We provide the infrastructure that plans the study, fields the questionnaire, and stores the answers
We implement technical and organizational security measures
We process the data only to run the study you commissioned and to produce its findings
We do not use your study data for our own commercial purposes
We do not sell, share, or disclose your study data to third parties (except as necessary to provide the Services or as required by law)
We do not sell respondent data
We assist you with data security, breach notifications, and data protection impact assessments when required

Information We Collect

1. Account Information

When you register for the customer panel at app.verbalab.ai, we collect:

Full name
Email address
Phone number
Company/organization name
Business address
Role or job title
Billing contact details

2. Billing & Commercial Information

Verbalab is in early access and publishes no prices or subscription tiers. Commercial terms are agreed per study. In connection with those terms we may collect and store:

The details needed to issue an invoice for an agreed study
Records of what was agreed and what was delivered
Correspondence about scope, cost, and payment

3. Study Data

Data you provide, or that is generated, while a study runs:

The brief you write and any material you attach to it
The questionnaire the agent writes and the edits you make to it
Sampling and quota settings, including screening criteria
Field progress and completion records
The findings the agent reads out of the results, and any notes you add

Where a study sponsor supplies its own contact list or sample context:

The list reaches Verbalab in cryptographically signed form
We store it for the purpose of fielding the study it was supplied for
The sponsor remains the controller of that data and remains responsible for it

5. Respondent Answers & Interview Records

When someone answers a study at survey.verbalab.ai:

Respondents answer one question per screen
Each answer is written to an append-only record; when an answer is superseded, the earlier answer stays in history rather than being overwritten
Interview progress is stored so that an interview can be resumed where it was left off
Screening decisions are stored with a disposition code recording how the interview was routed or why it ended
Quality flags mark suspicious records for review rather than silently deleting them

6. Usage & Analytics Data

IP address
Browser type and version
Device information
Pages visited and features used
Time spent on the platform
Click patterns and navigation paths
Error logs and technical diagnostics

7. Communications

Support requests and correspondence
Feedback about the platform
Marketing preferences
Email engagement metrics

8. Cookies & Tracking Technologies

Session cookies for authentication on app.verbalab.ai
Session identifiers on survey.verbalab.ai so an interview can be resumed
Preference cookies for settings
Analytics cookies for service improvement
Advertising cookies (with your consent)

See our Cookie Policy for detailed information.

9. AI Processing Data

The research agent is an AI system, so the following pass through AI processing:

The brief and any instructions you give the agent
Documents you upload for the agent to read
The questionnaire, the fielding decisions, and the findings the agent produces
Respondent answers, when they are read into findings
Your feedback on what the agent produced

We do not use your study data or respondent answers to train third-party AI models without your explicit consent.

How We Use Your Information

We process your personal data based on:

Contract performance: To run the study you commissioned and to deliver its findings
Legal obligations: Bookkeeping, fraud prevention, data breach notifications
Legitimate interests: Service improvement, security, customer support, research quality control
Consent: Marketing communications, non-essential cookies, participation in an interview

Specific Purposes

Study Delivery: Plan the study, write the questionnaire, run the field, and read the results into findings
Billing: Invoice the commercial terms agreed for a study
Customer Support: Respond to inquiries, troubleshoot issues, provide assistance
Service Improvement: Analyze usage patterns to enhance features and user experience
Security: Detect fraud, prevent unauthorized access, maintain data security
Research Quality: Apply screening and quality flags so that suspicious records are reviewed rather than silently removed
Legal Compliance: Meet accounting and regulatory obligations
Communications: Send service updates, security alerts, and promotional content (with consent)

Third-Party Service Providers

We share data with trusted partners who assist in providing Services:

Cloud Infrastructure:

Cloud hosting providers: For secure data storage and computing
CDN providers: For content delivery and performance

Communication Services:

Email service providers: For transactional email, including interview invitations sent for a study
SMS providers: For authentication and notifications

Analytics & Monitoring:

Analytics platforms: For usage insights and service optimization
Error tracking tools: For monitoring and debugging

AI & Machine Learning:

AI model providers: For the research agent's planning, questionnaire writing, and analysis steps

Study Sponsors:

The sponsor of a study receives the results and findings of that study. Where the sponsor supplied the contact list, the sponsor already holds those contact details as its own controller.

Legal Requirements

We may disclose information when required to:

Comply with legal obligations, court orders, or government requests
Enforce our Terms & Conditions
Protect our rights, property, and safety
Prevent fraud or illegal activities
Respond to data protection authority requests

Business Transfers

If Verbalab undergoes a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.

We may share data for other purposes with your explicit consent.

We do not sell personal data, study data, or respondent data to third parties.

Data Retention

Account Information: Retained while your account is active, and afterwards only as long as needed for our legal and accounting obligations
Study Data and Findings: Retained for the life of the study and afterwards as agreed with the sponsor of that study
Respondent Answers: Held in an append-only record for the study they belong to. Because the record is append-only, a correction is stored as a new entry and the superseded answer stays in history rather than being erased in place
Records Marked by Quality Flags: Kept for review; a flag marks a record, it does not delete it
Usage Analytics: Aggregated and anonymized data may be retained indefinitely
Support Communications: Retained for as long as needed for quality assurance and to answer follow-up questions
Marketing Data: Retained until you unsubscribe or request deletion

Retention periods for a specific study are set in the terms agreed for that study. You can request earlier deletion subject to legal and contractual obligations.

Your Data Protection Rights

Under GDPR and other data protection laws, you have the following rights:

1. Right of Access

Request copies of your personal data and information about how we process it.

2. Right to Rectification

Request correction of inaccurate or incomplete personal data.

3. Right to Erasure (Right to be Forgotten)

Request deletion of your personal data, subject to legal retention obligations.

4. Right to Restriction of Processing

Request that we limit how we use your data.

5. Right to Data Portability

Receive your data in a structured, machine-readable format and transfer it to another controller.

6. Right to Object

Object to processing based on legitimate interests, including direct marketing.

Withdraw consent at any time for processing based on consent (for example, marketing emails, or continuing an interview).

8. Right to Lodge a Complaint

File a complaint with a data protection supervisory authority.

How to Exercise Your Rights

We will respond to your request within:

30 days under GDPR (EU/EEA/UK)
45 days under other applicable laws

If You Are a Survey Respondent

If you answered a study at survey.verbalab.ai, write to [email protected] and tell us which study you took part in. Where the study sponsor supplied the contact list that reached you, the sponsor is the controller of that list, and we will pass your request on to the sponsor and tell you that we have done so.

Note that answers are held in an append-only record: correcting an answer adds a new entry and the earlier answer stays in the record's history. An erasure request is therefore handled by acting on the record itself, not by rewriting its history.

International Data Transfers

Verbalab operates globally and may transfer data to countries outside your country of residence, including Turkey and countries within the European Economic Area (EEA).

When transferring data internationally, we ensure adequate protection through:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions by the European Commission
Data Processing Agreements with all third-party processors
Encryption and security measures during transfer and storage

If you have questions about international transfers, contact us at [email protected].

Data Security

We implement comprehensive security measures:

Technical Measures

Encryption in transit: TLS for traffic between browsers, the customer panel, the survey site, and our systems
Signed transfer of sponsor data: contact lists and sample context supplied by a sponsor reach us in cryptographically signed form
Access Controls: Role-based access, so a study's data is reachable only by the accounts entitled to it
Append-only answer records: answers are written, never overwritten in place, so changes are visible in history rather than silent
Backups: Backups of study records and platform data
Monitoring: Error logging and technical diagnostics to detect faults and abuse

Organizational Measures

Employee Training: Regular data protection and security awareness programs
Confidentiality Agreements: All employees and contractors are bound by confidentiality obligations
Incident Response Plan: Documented procedures for data breaches
Internal Oversight: Data protection practices are reviewed internally before a study goes to field

Early Access Security Note: While we implement industry-standard security practices during early access, please be aware that no system is 100% secure. We recommend keeping independent copies of material that matters to you.

Data Breach Notification

In the event of a data breach affecting your personal data, we will:

Notify you within 72 hours of becoming aware of the breach (as required by GDPR)
Report to relevant supervisory authorities as required by law
Provide information about the nature of the breach and steps taken to mitigate harm
Recommend protective actions you can take

Children's Privacy

Verbalab is not intended for individuals under 18 years of age. Neither the customer panel at app.verbalab.ai nor the survey site at survey.verbalab.ai is meant to be used by children, and we do not knowingly collect personal information from them. If you believe we have inadvertently collected information from a minor, contact us immediately at [email protected] and we will promptly delete it.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

Changes in legal or regulatory requirements
New features or services
Improvements in data protection practices
Feedback from users, sponsors, or supervisory authorities

When we make material changes:

We will update the "Last updated" date at the top of this policy
We will notify you via email (if you have an account)
We will display a prominent notice on our website
You will be asked to review and accept the updated policy upon your next sign-in to the customer panel

Continued use of Services after changes constitutes acceptance of the updated policy.

General Data Protection Regulation (GDPR) for users in the EU/EEA
International data protection laws for users in other jurisdictions

If you are a consumer in the EU/EEA, you retain the protections afforded by mandatory consumer protection laws in your country of residence.

Last updated: August 16, 2026

For the most current version of this policy, visit: https://verbalab.ai/privacy-policy