Data Processing
Last updated: March 2026
This page provides technical and legal detail on how OpenScouter processes personal data. It supplements the Privacy Policy and is intended for data protection officers, enterprise procurement teams, and users exercising their data rights.
Data Categories
Personal Data
Standard personal identifiers collected from all users:
| Field | Users Affected | Purpose |
|---|---|---|
| Name | All | Account identification |
| Email address | All | Authentication, notifications |
| IP address | All | Security monitoring, abuse prevention |
| Browser and OS | All | Debugging, compatibility |
| Account creation date | All | Audit trail |
Sensitive Data (Special Category)
The following data is collected only from testers with explicit consent under Article 9 GDPR:
| Field | Purpose |
|---|---|
| Disability or neurodivergent condition | Matching testers to appropriate studies |
| Assistive technology in use | Matching and report context |
| Self-described accessibility needs | Enriching study context |
This data is stored in a separate, access-controlled database partition. It is never included in reports delivered to businesses in a form that identifies individual testers.
Usage and Activity Data
Generated automatically during platform use:
- Study notes, ratings, timestamps, and attachments submitted by testers
- Report generation events and report access logs
- API request logs (path, method, status code, latency)
- Authentication events (login, logout, token issuance)
Financial Data
Tester payout information is handled by Stripe Connect. We store only a Stripe account identifier. Raw bank account numbers and card details are never stored on our infrastructure.
Business billing is also managed by Stripe. We store a Stripe customer identifier and invoice history.
Retention Periods
| Data Category | Retention Period | Trigger for Deletion |
|---|---|---|
| Account data | Duration of account + 2 years | Account deletion request |
| Special category (disability, ND) | Duration of consent or account deletion, whichever is sooner | Consent withdrawal or account deletion |
| Study activity data | 3 years from study completion | Expiry or account deletion request |
| Usage logs | 90 days | Rolling deletion |
| Authentication logs | 1 year | Rolling deletion |
| Financial records | 7 years | Legal obligation (tax and accounting) |
Financial records are retained for 7 years to comply with HMRC requirements and equivalent regulations in other jurisdictions. This applies even if an account is deleted.
Account Deletion
When you delete your account:
- Your account record and profile data are removed within 7 days.
- Special category data is removed immediately.
- Study activity data linked to your account is anonymised rather than deleted, to preserve the integrity of completed reports that businesses have already received.
- Anonymised data cannot be re-linked to you.
If you require complete deletion of study activity data rather than anonymisation, contact privacy@openscouter.com with your request. We will assess it against our contractual obligations to the business that commissioned the study and respond within 30 days.
Data Export and Portability
You can request a copy of your personal data in JSON format at any time. The export includes:
- Account and profile information
- Special category data held on your profile
- Study participation history (study IDs, dates, status)
- Notes and ratings you submitted, identified by study
To request an export, email privacy@openscouter.com with the subject line “Data export request”. We will deliver the JSON file within 30 days.
Sub-Processor List
We engage the following sub-processors. Each has been assessed for GDPR compliance and is bound by a data processing agreement.
| Sub-Processor | Role | Data Transferred | Location | Basis for Transfer |
|---|---|---|---|---|
| Vercel Inc. | Hosting and infrastructure | All data processed by the platform | US (EU regions available) | Standard Contractual Clauses |
| Stripe Inc. | Payment and payout processing | Financial identifiers, payout data | US | Standard Contractual Clauses |
| OpenAI Inc. | AI analysis of study notes | Study notes (no direct identifiers) | US | Standard Contractual Clauses |
| Anthropic PBC | AI analysis and report generation | Study notes (no direct identifiers) | US | Standard Contractual Clauses |
| Google LLC (Gemini) | AI analysis and report generation | Study notes (no direct identifiers) | US | Standard Contractual Clauses |
| Amazon Web Services | File storage (S3) for note attachments | Attachments uploaded during studies | EU (eu-west-1) | Standard Contractual Clauses |
| Telegram Messenger Inc. | Optional study notifications | Username or chat ID, notification content | Various | Standard Contractual Clauses |
We review sub-processors periodically. If we add, change, or remove a sub-processor, we will update this page and notify affected users where required by law.
Data Processing Agreements
Enterprise customers may require a signed Data Processing Agreement (DPA). Contact privacy@openscouter.com to request one. We use a standard DPA aligned with the UK ICO and European Data Protection Board guidance.