Privacy
policy.

1. Who we are and what this covers

JackBirdy runs human-subject research studies for ourselves and for client organisations. Study participants (“respondents”) are typically recruited through third-party research panels and complete tasks that may include answering questions, writing, working with software, and - where a study says so and the respondent agrees - being recorded.

This policy covers:

• Our website at jackbirdy.com and any subdomains.
• Our research platform, including study entry links, the respondent flow, and the analyst and administration tools.
• Our browser extension, the JackBirdy session recorder distributed through the Chrome Web Store and other browser add-on stores.
• Our business interactions with clients, suppliers, applicants and other contacts.

For most study data we act as the controller (we decide why and how it is processed). Where we run a study strictly on a client’s documented instructions, that client may be the controller and we act as their processor; in that case the client’s own privacy notice also applies, and we will tell you which arrangement applies to a given study on request.

Relationship to the in-study consent notice

Before any study begins, respondents are shown a consent screen describing that study and a standing notice describing our data practices. That notice and this policy are intended to say the same thing. Where they differ for a particular study, the notice shown to the respondent at the time governs that respondent’s data.

2. Summary

• We collect what studies ask for: answers, written work, uploaded files, and recordings of voice, camera and screen, plus technical session detail.
• Our extension records your entire screen, screen audio, microphone and camera during an observed task - and only during one.
• We use it for research and product development, including building and evaluating AI systems, for ourselves and for clients.
• We share it with service providers, the client who commissioned the study, and research panels.
• We do not sell your personal information and do not use it to advertise to you.
• You can withdraw, request a copy, or request deletion at any time.

3. Whose information we handle

• Respondents - people who take part in a study.
• Website visitors - people who browse jackbirdy.com.
• Client and partner personnel - analysts, researchers and administrators who use our tools, and business contacts at client, panel and supplier organisations.
• Third parties who appear in captured material - people whose information is incidentally present in a recording, screenshot, document or answer. We ask respondents not to capture other people’s information, but where it happens we treat it under this policy and delete it on request where we can identify it.

4. Information we collect

4.1 Study participation

4.2 Technical and device information

We record technical detail about each session, both from your network request and from what your browser reports about itself. We use this for research context, for compatibility, and for detecting duplicate and fraudulent participation.

We deliberately do not use covert fingerprinting techniques - canvas, WebGL-render or audio hashing designed to identify people who are trying not to be identified.

4.3 Website visitors

When you browse jackbirdy.com we collect server log information (IP address, user agent, pages requested, timestamps, referrer), and information from cookies and similar technologies as described in section 12. If you fill in a form or contact us, we collect what you send.

4.4 Client and analyst users

For people who use our analyst and administration tools we collect account and access credentials, the actions taken in the tools (including review decisions and notes authored), and business contact information.

5. The browser extension

This section describes the JackBirdy session recorder extension specifically, and is intended to satisfy the disclosure obligations of the Chrome Web Store and equivalent add-on stores.

5.1 Single purpose

The extension has one purpose: to record a research session that you have been asked to take part in, and to show you the instructions and controls for that session while you work in other tabs and applications. It does nothing else.

5.2 What it captures, and when

When - and only when - you start an observed task in an active JackBirdy study session, and after your browser shows you its own sharing prompt and you choose what to share, the extension may capture:

• Your screen, including its audio. Depending on what you choose in the browser prompt this may be an entire display, which will include anything else visible on it - other websites, applications, notifications and documents.
• Your microphone, where the task involves speaking or thinking aloud.
• Your camera, where the task calls for it.
• Session status - that the extension is installed, its version, and how far the observed task progressed.

The extension does not read, log or transmit the content of the pages you visit outside of what appears in the screen recording itself. It does not run outside an active study session, it does not start recording without a browser-level prompt you must accept, and it stops when the task ends or when you stop it. You can end a recording at any time using the browser’s own “stop sharing” control or the extension’s panel, and you can remove the extension at any time from your browser’s extensions page.

Please protect yourself and others before you share a screen. Close or hide anything you do not want recorded - email, messaging, password managers, banking, medical information, other people’s personal data, and anything covered by a confidentiality obligation you owe to someone else. If something sensitive is captured by accident, tell us and we will remove it.

5.3 Permissions and why we need them

5.4 Limited use

Our use of information obtained through the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Specifically, data collected by the extension is used only to provide and improve the recording feature described above and the research that a recording was made for; it is not sold, not used or transferred for advertising or for creditworthiness or lending purposes, and not transferred to others except as described in section 13 - to our service providers, to the client who commissioned the study, where you direct it, or where required by law or in connection with a merger or acquisition following notice. Human review of recordings is limited to our research and review staff and the commissioning client, for the research purposes described here, for security and abuse investigation, and where required by law.

5.5 Uploads and storage

Recordings are uploaded to our storage as they are produced, so that a long session is not lost. They are stored with our hosting and object-storage providers, and access to playback is limited to authenticated staff and time-limited links.

6. Where we get it

• From you - what you answer, write, upload, say, and show.
• From your device and browser automatically - the technical detail in section 4.2.
• From research panels and recruiters - your respondent identifier and any screening attributes they pass, under their own privacy notices and consents.
• From clients - where a client asks us to research a population they have recruited.
• From service providers - for example approximate geolocation from an IP address, or transcription of a recording.

7. How we use information

We use personal information for the following purposes, including but not limited to:

• Running studies - delivering the flow, screening and quota management, branching, saving your progress, and returning you to the panel that referred you.
• Research and analysis - understanding how people work, write, decide, and use technology and software; producing findings, transcripts, summaries, aggregates, clips and reports.
• Product and model development - building, testing, evaluating, benchmarking, fine-tuning and improving products, features, tools, datasets and AI systems, both our own and those of the clients who commission the research.
• Client deliverables - providing findings and, where the study was commissioned on that basis, the underlying material to the client.
• Quality, integrity and fraud prevention - scoring data quality, detecting duplicate and fraudulent participation, investigating abuse, and reporting outcomes to the panel that referred you, which may affect your standing or payment with that panel.
• Incentives and reconciliation - confirming participation and adjusting transactions with panels.
• Operating and securing our services - hosting, monitoring, debugging, backup, and protecting against security incidents.
• Communication and support - responding to you, and administering our relationship with clients and partners.
• Legal and compliance - meeting our obligations, keeping records showing a study was run properly, establishing, exercising or defending legal claims, and enforcing our terms.
• New compatible purposes - any further purpose compatible with those above, or which we describe to you at the time.

We may create de-identified, anonymised or aggregated information from what we collect, and use, retain and disclose it without restriction, including for research, benchmarking, publication and product development. Where we do, we maintain it in de-identified form and do not attempt to re-identify it except to test that de-identification is effective.

8. AI, transcription and automated processing

We use automated and AI-assisted processing on material collected through studies, including automated transcription of audio, extraction of text and structure from recordings and documents, summarisation, classification, scoring, and analysis of patterns across respondents. Some of this is performed by third-party providers on our behalf.

Where a study is conducted for that purpose and the respondent has been told so, material collected may be used to build, train, evaluate and improve AI systems and datasets, ours and our clients’.

We use automated scoring to assess data quality and to flag possible duplicate or fraudulent participation. A negative outcome can mean your submission is rejected and reported to the panel that referred you, which may affect your payment. These outcomes are reviewable by a person, and you can contest one by contacting us at the address in section 22. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without a lawful basis for doing so.

9. Legal bases (EEA/UK)

10. Consent and withdrawal

Taking part is voluntary. Before a study begins you are shown what it involves and asked to agree. You can stop at any time by closing the tab, decline any individual recording prompt, and skip optional questions where a study offers that.

You can withdraw consent at any time by contacting us. Withdrawal stops further processing and, on request, leads to deletion, but it does not affect processing already carried out, and it cannot undo analysis or findings already published or delivered to a client in a form that no longer identifies you.

11. Recordings and sensitive information

Recordings of your voice, face, screen or writing can identify you whether or not they carry your name. We therefore treat all study material as personal information.

Depending on where you live, some of what we collect may be sensitive or special-category information - including voice and facial imagery, precise characteristics revealed in what you say or show, and the contents of personal communications that appear on a shared screen. Where a study collects this, we do so on the basis of your explicit consent, we use it only for the purposes described in this policy and the study’s own notice, and we do not use or disclose it for any purpose you have not been told about.

We do not collect or use biometric identifiers as defined by state biometric laws such as Illinois BIPA or Texas CUBI. We do not run face recognition, voiceprint matching or fingerprint analysis on study recordings. Where a recording contains a face or voice, it is retained and destroyed on the schedule set out in section 16.

We ask respondents not to capture other people’s personal information, credentials, payment details or confidential material. Where such material reaches us, tell us and we will delete it where we can locate it.

12. Cookies and similar technologies

We use cookies, browser local storage and similar technologies to:

• Operate the service - keep you signed in to a study session, protect a session from being hijacked, and remember your progress. These are strictly necessary and cannot be switched off.
• Recognise your browser - a random device identifier used for duplicate detection and research integrity.
• Understand usage - first-party, aggregate analytics that count page views, study starts and completions. We do not use advertising or cross-site tracking cookies.

Where required by law we ask for consent before setting non-essential cookies, and you can withdraw it at any time by writing to privacy@jackbirdy.com. You can also block or delete cookies in your browser, though strictly necessary cookies are required for a study session to work.

13. How we share information

14. Selling, sharing and targeted advertising

We do not sell your personal information, and we do not use it to advertise to you. We do not share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes other than those permitted under applicable law and described here. We have not sold or shared personal information in the preceding twelve months.

We honour Global Privacy Control signals sent by your browser, and record any such signal we receive.

15. International transfers

We operate internationally and store and process information in the United States, Canada and the European Union. These countries may not provide the same level of protection as the country you live in.

Where we transfer personal information out of the EEA, the UK or Switzerland, we rely on an adequacy decision where one applies, or otherwise on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with supplementary measures where needed. You can request a copy of the relevant safeguards using the contact details in section 22.

16. How long we keep it

We keep personal information for as long as it is needed for the purposes in this policy - which for research material means as long as the research it supports remains useful - and longer where we are required to keep it, for example to demonstrate that a study was properly conducted and consented, or to establish or defend legal claims. When it is no longer needed we delete it or strip it of identifying detail.

Our current retention periods: session recordings are deleted 12 months after a study closes; study responses and transcripts are kept for 3 years; session telemetry is kept for 13 months; incentive and payment records are kept for 7 years where tax law requires it; consent records are kept for 6 years after the study closes. De-identified and aggregated information may be kept indefinitely.

17. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls limiting recordings and responses to staff who need them, time-limited links for playback, authentication on administrative tools, and separation of identifying detail from analysis data where practical.

We also encrypt personal information at rest, require multi-factor authentication for staff and administrative access, keep audit logs of access to recordings and responses, review the security practices of our vendors before they process personal information, and maintain a documented incident response process that is tested periodically.

No system is perfectly secure. Where a breach affecting your personal information occurs, we will notify you and the relevant regulators where the law requires it.

18. Your rights and choices

Subject to local law and to verification of your identity, you may have the right to:

• Access a copy of the personal information we hold about you, and information about how we process it.
• Correct inaccurate or incomplete information.
• Delete your information.
• Port your information to another provider in a portable format.
• Object to or restrict processing, including processing based on our legitimate interests.
• Withdraw consent at any time, without affecting processing already carried out.
• Opt out of sale, sharing, or targeted advertising - although as stated in section 14 we do none of these.
• Limit the use and disclosure of sensitive personal information.
• Not be discriminated against for exercising any of these rights. We will not deny you participation, change incentives, or degrade service because you exercised a right.
• Appeal a refusal. If we decline your request, you may appeal by replying to our decision; we will respond within the period your state law requires and explain our reasoning.

How to exercise them

Contact us at privacy@jackbirdy.com. To locate your data we generally need the study you took part in, the approximate date, and the identifier from the link you used or the panel account you used - we usually do not hold your name. We will not use that information for anything other than handling your request. An authorised agent may submit a request on your behalf with proof of authorisation.

We respond within the time your law requires - one month in the EEA and UK (extendable by two further months for complex requests), 45 days in California and most other US states (extendable by 45 days).

Complaints

If you are in the EEA, the UK or Switzerland you may lodge a complaint with your local supervisory authority. Our lead supervisory authority is the Irish Data Protection Commission, and in the UK the Information Commissioner’s Office. We would appreciate the chance to address your concern first.

19. Children

Our services are not directed to children. We do not knowingly collect personal information from anyone under 18 unless a specific study is expressly open to younger participants with verifiable parental or guardian consent as required by law. If you believe a child has provided us information, contact us and we will delete it.

20. Third-party sites and services

A study may ask you to use a third-party website or application. Those services are controlled by others and governed by their own privacy policies and terms; this policy does not cover them. Your activity on them may be recorded by us as part of a screen recording, as described in section 5.

21. Changes to this policy

We may update this policy. We will change the “last updated” date above, and where changes are material we will give prominent notice and, where the law requires it, obtain your consent before applying them to information already collected. The consent notice shown inside a study is separately versioned, so the record of any study says which text that respondent agreed to.

22. Contact us