Privacy Policy

1. Who We Are

Qualitati ("we", "our", "us") operates the Qualitati research platform (qualitati.com). MimiTalk and Qualitati are the same service, operated by the same organisation. Registered address: 47 rue Vivienne, 75002 Paris, France Privacy contact: [email protected] For the purposes of applicable data protection legislation (including the EU General Data Protection Regulation 2016/679 and the UK General Data Protection Regulation), Qualitati is the data controller for the personal data described in this policy.

2. What Data We Collect and Why

We collect and process the following categories of personal data:

• Account information (email address, username, password hash): collected when you register. Legal basis: Performance of a contract with you (GDPR Article 6(1)(b)).
• Interview data (audio recordings, transcripts, participant responses): collected when researchers conduct interviews through Qualitati. Legal basis: Consent of the research participant, obtained by the researcher before each interview (GDPR Article 6(1)(a)). The researcher acts as the data controller for participant data; Qualitati acts as a data processor.
• Analysis outputs (themes, codes, summaries): generated when researchers use ThemeLens or other analysis tools. Legal basis: Performance of a contract (GDPR Article 6(1)(b)).
• Technical logs (IP address, browser type, device information, timestamps): collected automatically when you use the platform. Legal basis: Legitimate interest in maintaining security, preventing fraud, and improving the service (GDPR Article 6(1)(f)). We look up the IP country locally to suggest a site; no IP address is sent to the geolocation provider.

3. Where Your Data Is Stored

All primary data is stored on DigitalOcean servers in Amsterdam, Netherlands (EU). Backups are also stored within DigitalOcean's EU region. DigitalOcean's data centre security includes 24/7 monitoring, biometric access controls, and environmental protections.

4. Third-Party Service Providers (Sub-processors)

We use the following third-party services to operate Qualitati. Data processing agreements are in place with each provider:

• DigitalOcean: Cloud hosting, storage, and hosted open-model inference (Gradient), Netherlands (EU)
• Google Cloud Speech: Speech-to-text transcription, EU processing region
• ElevenLabs: Speech-to-text transcription and AI interviewer voice for voice interviews, United States (SCCs)
• OpenAI: LLM inference for AI interviews, United States (SCCs)
• Anthropic: LLM inference for AI interviews, United States (SCCs)
• Google (Gemini): LLM inference for analysis tools, United States (SCCs)
• Amazon Web Services (Bedrock): EU-resident LLM inference for the EU-only AI processing option, European Union
• Mistral AI: EU-resident LLM inference for the EU-only AI processing option, France (EU)
• Scaleway: EU-resident LLM inference, France (EU)
• Xiaomi (MiMo): AI interviewer voice (text-to-speech) for Chinese-language interviews, China (contractual safeguards; never used for EU-only AI processing)
• Google Analytics: Website usage analytics, United States (SCCs)

5. International Data Transfers

Some of our sub-processors are located outside the European Economic Area (EEA). When personal data is transferred outside the EEA, we ensure appropriate safeguards are in place: - United States (OpenAI, Anthropic, ElevenLabs, Google Analytics): Transfers are protected by Standard Contractual Clauses (SCCs). - China (Xiaomi MiMo): Used only to voice the AI interviewer in Chinese-language interviews. Only the interviewer's spoken text is sent (it may paraphrase participant answers); participant audio is never sent. Transfers are governed by contractual safeguards. Global AI is the default for all users. All accounts can choose optional EU Assurance for EU-only AI processing in Profile. The saved choice stays fixed until manually changed. When enabled, interview transcripts and participant responses are processed exclusively by EU-resident AI providers (Amazon Web Services Bedrock EU, Mistral AI, Scaleway) and are not transferred to US-based AI providers. Recorded audio is transcribed within the EU by Mistral AI (France), and live voice interviews run on Amazon Nova via AWS in the EU where available; when unavailable, participants are offered the text interview.

6. Data Security

We implement the following technical and organisational measures:

• Encryption in transit: All connections use HTTPS with TLS 1.2 or higher.
• Encryption at rest: AES-256 encryption at the storage layer. Database connections use SSL.
• Access control: Production systems are accessible only to authorised team members via SSH key authentication.
• Dependency management: Automated scanning for known vulnerabilities. Critical security patches applied within 48 hours.
• Credential storage: API keys and secrets are stored as environment variables, never in source code.

7. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of an account deletion request.
• Interview data: Retained while your account is active. You may export or delete interview data at any time. If no activity occurs for 3 years, we will contact you before any deletion.
• Anonymised research data: Fully anonymised data may be retained indefinitely for service improvement.
• Technical logs: 90 days.
• Permanent deletion: You can permanently delete an individual interview or an entire project at any time. Permanently deleted data is removed from the production database immediately and ages out of rotating encrypted backups automatically.

8. Your Rights Under GDPR

To exercise any of these rights, email [email protected]. We will respond within 30 days.

• Right of access: Request a copy of all personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your personal data.
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Receive your data in a structured, commonly used format (CSV, JSON).
• Right to object: Object to processing based on legitimate interest.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (GDPR Article 33). Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay (GDPR Article 34).

10. Cookies

• Essential cookies: Session cookies required for the platform to function. These do not require consent.
• Analytics cookies: Google Analytics to understand how visitors use our site. These cookies are only set with your consent.

11. Researchers as Data Controllers

When researchers use Qualitati to conduct interviews, the researcher (or their institution) acts as the data controller for participant personal data. Qualitati acts as a data processor. Researchers are responsible for obtaining informed consent, securing ethical approval, and ensuring compliance with applicable data protection laws.

12. API Access and AI-Assistant Integrations

You can allow external software to act on your account in two ways: personal API keys that you create in your profile, and AI assistants (for example ChatGPT, Codex, Claude Code or Cursor) that connect through our Model Context Protocol (MCP) server after you approve them on a consent page showing the application's name and the permissions requested (read, or read and write). A connected application can read and, with write permission, create or update your projects, interview guides, interviews, transcripts, analysis results, surveys and survey responses, and can start analyses that consume your credits. We return only the data needed for the requested operation and never disclose your password, payment details or API keys to it. The provider of the connected application (for example OpenAI or Anthropic) processes what it receives under its own privacy policy, so please review it before connecting. Access tokens expire after one hour and refresh tokens after 30 days without use; you can delete an API key in your profile at any time, disconnect the application in its own settings, or email [email protected] to have an authorisation revoked immediately. Participant data accessed this way remains subject to the researcher's obligations described in Section 11.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email to registered users.

14. Contact Us

Email: [email protected] Website: qualitati.com