Privacy policy
Last updated 15 October 2026.
The short version
- If you are taking part in a study, the researcher running it decides what happens to your responses. We hold them on their behalf.
- Platform account names and email addresses are not included in researcher dashboards or study-data exports. Studies may separately collect identifiers when disclosed in their consent materials.
- We do not sell data, and we do not use your study responses to train AI models.
- Our standard service is hosted in India with appropriate transfer safeguards for EEA and UK data.
- Institutions that need EEA or US data residency can contact us about a dedicated regional deployment.
Who we are
VibeMyExpt is operated by ALPHAKHOJ LLP, Hyderabad, Telangana, India. For anything in this policy, contact [email protected].
Grievance and data-protection queries under Indian law: [email protected].
Our two different roles
We act in two capacities, depending on the data:
We are the processor
For everything a study collects — responses, timings, recordings, device details, consent signatures. The researcher and their institution are the controller.
We are the controller
For accounts on this platform — researcher accounts, participant portal accounts, wallet balances and payouts, billing, and our own service emails.
Universities signing with us should also sign our data processing agreement.
What we collect
| Whose | What | Why | Lawful basis |
|---|---|---|---|
| Researchers | Name, email, institution, department, bio, profile picture, Google account ID if you sign in with Google | Running your account and studies | Performance of our contract with you |
| Researchers | Billing name and address, GSTIN, payment records, invoices | Taking payment and meeting Indian tax law | Contract, and our legal obligations |
| Participants (portal accounts) | Email, name, participation history, wallet balance, payout bank or UPI details | Letting you find studies, take part, and be paid | Performance of our contract with you |
| Participants (in a study) | Responses and timings you produce, plus browser and device details (browser, operating system, screen and window size, timezone, language). Researchers see a session identifier — not your platform account name or email. | Delivering the study and letting the researcher analyse valid data | The researcher's lawful basis — we process this on their instructions |
| Participants (in a study) | Voice or video recordings, where the study collects them | The study design requires them | The researcher's lawful basis, with consent shown before the study starts |
| Participants (in a study) | Typed consent signature, where the study requires it | Recording informed consent as required by the study design | The researcher's lawful basis, with consent shown before the study starts |
| Everyone | IP address, used transiently for rate limiting | Preventing abuse | Our legitimate interest in keeping the service available |
We do not store your IP address against your account or study responses. It is used only in memory for rate limiting.
How study data is separated from your account
Researchers see a session identifier in dashboards, live monitoring, and exports — not your platform account name or email. Payout identity for portal participants is handled separately inside the platform's payment flow and is not shown in study data views.
Some study designs may ask you for identifying information directly in the task materials, where the researcher's ethics approval and consent form cover that. What a study collects beyond the platform defaults is disclosed in that study's own consent materials.
AI features and your data
- Building experiments sends the researcher's prompts and code only.
- Analysing results runs analysis in the researcher's browser. The AI provider receives column names, types, completeness, summary statistics, and — for low-cardinality categorical columns only — the list of distinct values. Participant free-text answers are described statistically (counts and lengths), never quoted.
- Researchers can disable AI analysis per study. When disabled, no dataset description is sent to a model.
Providers are listed on the subprocessors page. We do not train models on your data.
Where your data is held
| Files, stimuli, recordings and exports (AWS S3) | India (AWS ap-south-1, Mumbai) |
| Outbound email (AWS SES) | India (AWS ap-south-1, Mumbai) |
| Application servers and in-memory cache (Redis) | India |
| Database (Amazon RDS for PostgreSQL) | India (AWS ap-south-1, Mumbai) |
Standard managed service. Hosted in India. Transfers from the EEA or UK are covered by Standard Contractual Clauses and a transfer impact assessment.
Dedicated EEA deployment. For institutions whose policy requires participant data to remain in the EEA, we can scope a dedicated regional deployment. Scope, subprocessors, and timelines are agreed during onboarding.
Dedicated US deployment. For institutions that require US data residency, we can scope a dedicated regional deployment under an institutional agreement.
Institutional self-hosting. Under licence, the platform can run on your infrastructure with your object storage, mail relay, and AI provider credentials.
EEA and UK transfers from the standard service rely on Standard Contractual Clauses and a transfer impact assessment available to institutions on request. Some subprocessors process data in the United States.
How long we keep it
| Your account | Until you delete it |
| Study responses and recordings | Set by the researcher per study. Where no period is set, kept until they delete it. A deleted study can be restored for 90 days, then its responses and recordings are deleted |
| Generated data exports | 7 days, then deleted automatically |
| Analysis datasets | 7 days |
| Sign-in sessions | Up to 30 days |
| Payment webhook records | 180 days |
| Invoices | Kept as long as Indian tax law requires |
| Audit log | Retained for research-integrity and IRB reporting |
Your rights
- Access and portability. Download your data from account settings (JSON). Exports are capped at 500 sessions and 5000 trial batches; larger histories may be truncated. The download does not include study recordings, which are held for the researcher (ask them, or email [email protected]), or wallet and payout history (email [email protected]).
- Correction. Edit your profile or email us.
- Deletion. Delete your account in settings. Study responses remain with researchers but are de-linked from your account: internal account identifiers are replaced and device details removed. Retained responses may still be personal data in the researcher's dataset if the study collected identifying information.
- Objection and restriction. Email [email protected].
- Marketing email. Opt in at registration; withdraw anytime in account settings or via unsubscribe links.
Transactional emails (password resets, receipts, study-related notices) are not marketing and cannot be disabled.
If you are in the EEA or UK
Where EU or UK law requires a local representative, contact details are provided in your institutional agreement before onboarding. You may complain to your supervisory authority. We encourage you to contact us first at [email protected].
If you are in India
We process personal data under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. You have rights of access, correction, erasure, grievance redressal, and nomination of another person to exercise your rights on death or incapacity. Email [email protected] or use account settings where available.
Cross-border transfers to countries without an adequacy decision rely on contractual safeguards and your consent where required. We will notify affected individuals and the Data Protection Board of India of personal-data breaches as the law requires.
Children
Platform accounts are for people aged 18 and over. Studies involving minors may run via researcher-controlled links when the researcher documents ethics approval and a verifiable parental or guardian consent process. Minors cannot create portal accounts.
If you are in the United States
Where state privacy laws apply (including California), we provide notice at collection, do not sell or share personal information for cross-context behavioural advertising, honour Global Privacy Control signals for analytics cookies, and do not discriminate against you for exercising your rights.
Sensitive categories may include payout bank or UPI details for participants. We do not accept protected health information and will not sign a HIPAA business associate agreement.
Studies involving children under 13 must comply with COPPA; the researcher is responsible for parental consent when minors participate via external study links.
To appeal a decision on a privacy request, email [email protected] with "Privacy appeal" in the subject.
Security
See the security overview for implemented controls and our honest roadmap.
Changes
Material changes are posted here and, for significant changes, communicated by email where appropriate.