Privacy & legal

Everything an ethics board, a data protection officer or a curious participant might want. Last updated 1 September 2026.

Privacy policy

What we collect, who controls it, where it lives, how long we keep it, and how to get a copy or have it removed.

Terms of service

The agreement covering accounts, running studies, taking part, ownership of your work, and payment.

Cookie policy

Everything stored in your browser, and the switch to accept or refuse analytics. No analytics ever runs inside a study.

Acceptable use policy

The rules for running a study here — in particular which direct identifiers you may not ask participants for.

Security overview

The controls actually deployed, and the ones that are not yet. Written for an IT security review.

Data processing agreement

Our Article 28 processor terms with EU Standard Contractual Clauses, ready to countersign.

Subprocessors

Every third party that can receive personal data, what they get, and where they process it.

For institutional reviews

If your university needs more than the pages above, email [email protected] and we will send:

  • A completed HECVAT
  • A countersigned data processing agreement with Standard Contractual Clauses
  • Our transfer impact assessment for data sent to India
  • Answers to your own security or accessibility questionnaire

If your review needs an accessibility conformance report (VPAT), a penetration test summary, or hosting in a particular region, tell us early — each of those we arrange for an institution rather than hold on the shelf, so they need lead time.

We do not currently hold SOC 2 or ISO 27001 certification, and have not yet commissioned an independent penetration test. The security overview says which controls are in place and which are not, so a reviewer does not have to ask.

Who to contact

For anything about your own data, or to report a study that is asking for information it should not be: [email protected].

If you took part in a study and want your responses deleted, contact the researcher named on that study's consent form — they decide what happens to their research data, not us.

VibeMyExpt is operated by ALPHAKHOJ LLP, Hyderabad, Telangana, India.