Research privacy

Privacy Notice

Last updated: 15 October 2026

This notice applies to the work-phone research study. It explains how information is used before you decide whether to take part. It deliberately does not describe any product concept that may be shown later in the study.

Who is responsible for your information?

Data controller: Mehdi Rezaee

Privacy contact: medhirezaee@gmail.com

What we collect

• Your answers about how you use smartphones for work and keep work and personal activity separate.
• Any optional open-text answers you choose to provide.
• Study-integrity information such as questionnaire version, timing, acquisition source, consent records and non-PII quality signals.
• A random browser visitor identifier with a fixed, non-sliding 30-day lifetime.
• If you later choose Yes to follow-up research, contact information is collected through a separate form and kept outside normal analytical survey answers.

Please avoid entering unnecessary sensitive, confidential or identifying information in open-text boxes.

Why we use it

We use the information to understand current work-phone behaviour and problems, test research hypotheses, protect the integrity of the study and produce aggregated market-research evidence.

The intended UK GDPR lawful basis for this commercial product and market research is legitimate interests, balanced against participants’ privacy rights. The participation checkbox records your voluntary agreement to take part; it is separate from the UK GDPR lawful basis and separate from any optional marketing choice.

Research integrity

We use security and quality controls such as Turnstile, rate protection, honeypot fields, duplicate signals and predefined completion-time checks. Suspicious submitted evidence is flagged or excluded from standard analysis where appropriate rather than silently rewritten or deleted to improve the results. Raw IP addresses are not stored in the research database merely for analytics or duplicate detection.

Service providers

The study is designed to use Cloudflare for hosting/security, Supabase for the research database, PostHog’s EU ingestion endpoint for a restricted non-PII journey-event taxonomy, and Resend for transactional email where separately requested. Raw survey answers and open text are not sent to PostHog.

Before genuine collection, the controller must ensure appropriate contracts and any required UK international-transfer safeguards are in place for relevant providers.

How long we keep information

• The random browser visitor identifier expires after 30 days and is not extended by return visits.
• Research answers, consent evidence and research-integrity records are retained for up to 24 months for validation, reproducibility and due diligence, then deleted or irreversibly anonymised unless a longer period is legally required.
• Separately supplied follow-up contact information is retained for up to 24 months unless you ask for deletion sooner, subject to legal requirements.

Your choices and rights

Taking part is voluntary. You may stop before submitting a section. Depending on the circumstances, UK data-protection law may give you rights of access, correction, erasure, restriction, portability and objection. Where processing relies on legitimate interests, you can object and the controller must consider your circumstances.

Contact the privacy address above to exercise a right or ask a question. You can also complain to the UK Information Commissioner’s Office.

Automated decisions

Quality rules can flag or exclude a research response from standard analysis, but they are not used to make legal or similarly significant decisions about you.