Privacy & Terms

1. Introduction and scope

This Privacy Policy explains how Hero Research Lab Inc (“InsightsHero”, “we”, “our”, or “us”) collects, uses, discloses, and protects personal data when you use our AI-native customer research platform, including the researcher workspace, the participant survey experience, and our marketing website (together, the “Service”).

We are committed to handling personal data lawfully, fairly, and transparently. Please read this policy together with our Cookie Policy and our Subprocessor list.

2. The data we collect

From researchers and website visitors (we are the controller)

• Account data you provide when you register or are invited — name, work email, organization, and authentication identifiers (including via Google sign-in).
• Workspace content you create — studies, survey designs, interview guides, prompts, and the analysis outputs generated from them.
• Usage and device data — IP address, browser and device type, pages viewed, and feature interactions, collected through server logs and our product analytics provider.
• Communications — messages you send us (for example, demo requests or support enquiries).

From survey respondents (the researcher is the controller; we process)

• Survey answers — the free-text and structured responses a respondent gives during a conversational survey.
• Voice and video answers — if a respondent uses optional voice dictation, the audio is processed into text by our speech-to-text subprocessor (Deepgram) and is not stored. Where a researcher designates a question as voice-only or video-only, the recording itself is stored securely, is transcribed by our AI subprocessor to produce the written answer, and is accessible only to that research team and to InsightsHero staff who operate the service. By recording an answer, the respondent authorises the research team and InsightsHero to store and use that recording for the study.
• Contact and metadata — any name, email, or phone number the researcher chooses to request, plus technical metadata such as IP address and user-agent associated with a session.
• Interaction telemetry — basic usage data and a masked replay of how the survey screen behaves, used to diagnose and fix problems with the survey experience. All typed input and on-screen text are masked and images and other media are blocked — this never includes the text you type or read.

Is providing your data required?

• Survey respondents. Taking part is entirely voluntary. You are under no statutory or contractual obligation to answer any question or provide any personal data, and doing so is not a condition of any contract with us. If you choose not to answer or to stop, the only consequence is that your response may be incomplete or not recorded. (For surveys run on our platform, the researcher who created the survey is the controller of your responses; we process that data on their behalf, and their own notice may say more.)
• Account holders. To create an account and use the Service you must provide certain data (name, work email, organization). This is a requirement necessary to enter into and perform our contract with you (our Terms); it is not a statutory requirement. If you do not provide it, we cannot create your account or provide the Service. Optional fields are indicated at the point of collection.

3. AI processing disclosure

InsightsHero is an AI-native product. Respondent answers, question context, and analysis data are processed by large language models and a speech-to-text model operated by the AI subprocessors listed on our Subprocessor page (currently Google, Anthropic, OpenRouter and the models it routes to, and Deepgram). These models are used to moderate conversations, extract structured observations, and generate analysis.

We do not train our AI models on customer data, and we contractually require our AI subprocessors not to train their models on it. AI outputs are probabilistic and may contain errors; researchers are responsible for reviewing outputs before relying on or sharing them.

Automated processing and screening. We use automated tools to apply a survey’s screening and eligibility criteria (which determine whether you can take part in a given survey, and, where a survey offers a participation incentive, whether you qualify for it), to detect and remove low-quality, duplicate, or automated (bot) responses, and to extract and analyze responses for aggregate insights. These processes do not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the GDPR — for example, they do not affect your finances, employment, creditworthiness, legal rights, or access to any service. If you believe you were screened out in error, you can contact our Privacy Team at [email protected].

4. How and why we use personal data (purposes & lawful bases)

Under the GDPR and equivalent laws, we rely on the following lawful bases:

• Performance of a contract — to provide, operate, secure, and support the Service for our account holders, and to process respondent data on a researcher’s instructions.
• Legitimate interests — to keep the Service secure and free of abuse (including bot protection via Cloudflare Turnstile), to understand and improve product usage, and for limited business-to-business marketing, balanced against your rights.
• Consent — for non-essential cookies and analytics where required, and for optional voice dictation. You may withdraw consent at any time.
• Legal obligation — to comply with applicable law and respond to lawful requests.

We do not sell personal information, and we have not done so in the preceding twelve months.

5. How we share and disclose data

• Subprocessors and service providers who host, power, and help us operate the Service, under contracts no less protective than this policy and our Data Processing Agreement. See the full Subprocessor list.
• Researchers (for respondent data) — survey responses are made available to the researcher who is the controller of that survey.
• Legal and safety — to comply with law, enforce our terms, or protect rights, property, and safety.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

6. International data transfers

The Service is hosted in the United States (our database, authentication, and file storage run on Supabase in the AWS us-east-1 region, with application hosting on Railway). Where we transfer personal data of individuals in the EEA, the UK, or Switzerland to the United States, we rely on appropriate safeguards, including the EU Standard Contractual Clauses (Commission ref. 2021/914) and the UK International Data Transfer Addendum.

7. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy, to provide the Service, to comply with our legal obligations, resolve disputes, and enforce our agreements. Because longitudinal and cross-study analysis is a core part of the Service, research content (responses, transcripts, and derived insights) is retained for the life of the study or your account unless you delete it or instruct us otherwise. We do not impose a fixed deletion clock on your research. Researchers control the retention of the survey data within their workspace; account data is retained for the life of the account and a reasonable wind-down period thereafter. Specific handling by data category is maintained in our internal retention schedule.

8. Security

We protect personal data with technical and organizational measures including encryption in transit (TLS) and disk-level encryption at rest, role-based access control, authentication via Supabase Auth, audit logging, and a secure development lifecycle. Learn more on our Security & Trust page. No method of transmission or storage is completely secure, but we work to protect your data and continuously improve our controls.

9. Your data-subject rights (GDPR / UK GDPR)

Subject to applicable law, you have the following rights over your personal data:

• Access — obtain confirmation of, and a copy of, the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — request deletion of your personal data (the “right to be forgotten”).
• Restriction — request that we limit how we process your data.
• Portability — receive the data you provided in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — withdraw consent at any time, without affecting processing already carried out.
• Lodge a complaint — complain to your supervisory authority.

To exercise these rights, email [email protected]. We will verify your identity and respond within 30 days. Because the researcher is the controller of survey responses, if your request concerns answers you gave to a particular survey, we will forward your request to that researcher and assist them as their processor.

10. California privacy rights (CCPA / CPRA)

California residents have the right to know what personal information we collect, to request access and deletion, to correct inaccurate information, and to opt out of any “sale” or “sharing” of personal information. As noted above, we do not sell personal information. We will not discriminate against you for exercising these rights. To make a request, contact [email protected].

11. Cookies and tracking

We use cookies and similar technologies for essential functions, preferences, and (with consent where required) analytics. For categories, providers, and how to control them, see our Cookie Policy.

12. Children

The Service is not directed to children and is not intended for anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

13. Contact

For privacy questions or to exercise your data-protection rights, contact our Privacy Team at [email protected]. Hero Research Lab Inc

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after an update constitutes acceptance of the revised policy.

1. Acceptance of these terms

These Terms of Service (“Terms”) govern your access to and use of the InsightsHero Service. By accessing or using the Service, you agree to be bound by these Terms and by our Privacy Policy, Cookie Policy, and (where applicable) our Data Processing Agreement and Subprocessor list, each incorporated by reference. If you use the Service on behalf of an organization, you represent that you are authorized to bind that organization.

2. The Service and account registration

InsightsHero provides an AI-native research platform delivered through your web browser, including building research guides, running conversational surveys and interviews, analyzing responses, and generating summaries and reports. To use certain features you must create an account; you are responsible for safeguarding your credentials and for activity under your account.

3. License and acceptable use

We grant you a limited, non-exclusive, non-transferable, revocable license to use the Service for your internal business purposes, subject to these Terms. You agree not to:

• use the Service for any unlawful purpose or in violation of any applicable law;
• upload special-category, sensitive, or otherwise regulated personal data without a valid lawful basis and all required notices and consents;
• collect respondent data without having obtained the consent and provided the notices required of you as the controller of that data;
• attempt to re-identify individuals from, or otherwise misuse, extracted insights;
• scrape, reverse-engineer, decompile, or attempt to derive the source code of the Service, or interfere with or circumvent its security or rate limits;
• upload infringing, malicious, or harmful content, or attempt unauthorized access.

4. Customer content and responsibilities

You retain all rights to the content you upload, create, or collect using the Service (“Customer Content”). You grant InsightsHero a non-exclusive, worldwide license to host, store, and process Customer Content solely to provide and support the Service. You are the controller of respondent data you collect and are responsible for the lawful basis, notices, and consents for that data, as further described in our Privacy Policy and Data Processing Agreement. Where you enable voice-only or video-only questions, you are responsible for ensuring that the recording disclosure shown to respondents, and your use of the recordings, are lawful in your jurisdiction; recordings are stored on your behalf as Customer Content.

5. Intellectual property

The Service, including its software, models integration, design, and trademarks, is and remains the property of InsightsHero and its licensors. Except for the limited license granted to you, no rights are transferred. If you provide feedback, you grant us a perpetual, royalty-free license to use it to improve the Service.

6. Fees and billing

Where the Service is offered on a paid basis, fees are described at the time of purchase and billed in advance on a recurring basis unless otherwise agreed. You may cancel at any time; except where required by law, fees are non-refundable for partial periods.

7. Warranties and disclaimers

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR THAT AI-GENERATED OUTPUTS WILL BE ACCURATE OR COMPLETE.

8. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, INSIGHTSHERO WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, OR DATA. OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE SERVICE WILL NOT EXCEED THE AMOUNTS YOU PAID TO US FOR THE SERVICE IN THE TWELVE MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

9. Indemnification

You agree to indemnify and hold InsightsHero harmless from claims arising out of your Customer Content, your use of the Service in violation of these Terms, or your violation of applicable law or the rights of any third party.

10. Termination and suspension

We may suspend or terminate your access to the Service if you materially breach these Terms or use the Service in a way that risks harm to others or to the Service. You may stop using the Service at any time. Provisions that by their nature should survive termination — including intellectual property, disclaimers, limitation of liability, indemnification, and governing law — will survive.

11. Governing law

These Terms are governed by the laws of the State of California, without regard to its conflict-of-laws rules, and the parties submit to the exclusive jurisdiction of the state and federal courts located in San Francisco, California.

12. Changes; miscellaneous

We may modify these Terms by posting a revised version with an updated “Last updated” date. If a provision is held unenforceable, the remaining provisions remain in effect. These Terms, together with the documents incorporated by reference, constitute the entire agreement between you and InsightsHero regarding the Service. You may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets.