Privacy Policy

Draft — last updated 2026-07-28

DRAFT for review. Placeholders in [brackets] need the operator's (Olga's) legal details before publication.

Who we are

The Idiodynamic Research Platform is operated by [legal name / entity, address, contact email]. Data is hosted on servers in the European Union (OVH, EU).

Two kinds of people, two roles

• Researchers (account holders): we are the data controller for your account data — email, name, password hash, credit history.
• Participants: your study data belongs to the researcher who invited you. The researcher is the data controller; we process the data on their behalf as data processor. Questions about a study or requests concerning your study data should go to the researcher who invited you.

What we store

• Researcher accounts: email, name, initials, hashed password, credit and payment history, uploaded stimulus media, experiment configurations.
• Participants: a researcher-chosen label (e.g. "PO01"), an email address used solely to deliver the invitation, and session data (keypress reaction timings, questionnaire answers, written background answers, consent timestamp). We do not collect participant names, and no audio or video of participants is recorded.
• Technical: the participant browser's user-agent string (for compatibility support) and standard server logs retained for 30 days.

What we do NOT do

• Platform administrators do not access study content — reactions, answers, or media — except with the researcher's explicit request (e.g. support) or where required by law. Administrative monitoring is limited to aggregate metadata: counts, storage sizes, and timestamps.
• We do not sell or share data with third parties, run advertising, or use tracking beyond what is technically necessary. No third-party analytics.

Third parties we rely on

• Brevo — delivers invitation and account emails (recipient address and message content pass through them).
• Stripe — payment processing, once enabled; card details never touch our servers.
• Google Fonts and jsDelivr CDN serve fonts and open-source scripts to your browser.

Retention and deletion

• Study data is retained until the researcher deletes it or closes their account.
• Backups are kept for 14 days, after which deleted data is unrecoverable.
• Researchers can delete experiments (including all participant data) from the dashboard; account deletion can be requested at hello@idiodynamic.com and is completed within 30 days.
• Participants may ask the researcher to delete their session; researchers can revoke and delete individual participants.

Your rights

Under the GDPR you may request access, rectification, erasure, restriction, or portability of your personal data, and you may complain to your supervisory authority ([IDPC Malta / relevant authority]). Contact: hello@idiodynamic.com.

← Back to the Idiodynamic Research Platform