Data processing agreement

Stroop is the all-in-one research and testing platform. Run usability tests, prototypes, surveys, tree tests, diaries and IATs in one study, and get results back transcribed, scored and charted, with every finding linked to the session it came from.

To keep a copy, print this page or save it as a PDF from your browser's print dialog. If your procurement team needs a copy with your organisation's name on it, email [email protected].

1. Parties and roles

This agreement is between Never Before Seen Ventures Limited (“Stroop”, “we”), which operates Stroop, and the organisation that holds a Stroop account (“the customer”, “you”). It forms part of the terms of service and meets Article 28 of the UK GDPR and the EU GDPR.

You are the controller of the personal data you process in Stroop, or a processor acting for your own client. We are your processor, and so your client's sub-processor. You may name Stroop as a sub-processor to your clients and pass this agreement's commitments on to them.

For data we decide about ourselves (your researchers' accounts, billing and this website), we are the controller, and the privacy policy applies instead.

2. Subject matter and duration

We process personal data to provide Stroop to you: to run your studies, store what participants give, and produce your results. We do it for as long as your account exists, and then for as long as deletion takes under section 10.

3. Nature and purpose

Hosting, storage, transmission, transcription, analysis (including AI analysis when it is on for the workspace), display, export and deletion, each only as needed to provide the features you use.

4. Data subjects and data

• Participants in your studies: contact details you add, consent records, answers, clicks and paths, reaction times, screen, camera and voice recordings, transcripts, diary entries and their media, and anything else your study asks for.
• Your researchers and guests: names, email addresses, and what they do in the app.
• People who appear in material you upload, such as stimuli or recordings of sessions held elsewhere.

Special category data appears only if your study collects it. Studies that do should be marked sensitive, and you are responsible for having a lawful basis and the right consent for it.

5. Our obligations

• We process personal data only on your documented instructions, which are these terms, your settings and what you do in the app. If we think an instruction breaks data protection law, we'll tell you.
• Everyone at Stroop who can access personal data is bound by confidentiality.
• We keep the security measures in section 9 in place.
• We use sub-processors only as section 6 allows.
• We help you answer data subject requests, mainly through the app's tools for finding, exporting and deleting one participant's data.
• We help you with security, breach notification, data protection impact assessments and consultations with a regulator, as far as our part of the processing allows.
• We delete or return personal data at the end, as section 10 sets out.
• We give you the information you need to show this agreement is being kept, and allow audits under section 11.

6. Sub-processors

You give us general authorisation to use the sub-processors on the sub-processor list. We bind each one to data protection terms at least as protective as these, and we remain responsible to you for them.

We give you 30 days' notice before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we can't resolve it, you can close your account before the change, and you won't be charged for anything after that.

7. International transfers

Your database and files are stored in the EU. Some sub-processors work outside the UK and EEA: Anthropic (AI analysis, United States, only when AI is on), Stripe (billing contacts, no participant data), Twilio (SMS, only when used) and, depending on its region, Resend (email). These transfers are covered by the EU Standard Contractual Clauses (Commission Decision 2021/914, module two or three as the case requires) and the UK International Data Transfer Addendum, which are incorporated into this agreement by reference, or by an adequacy decision where one applies.

8. Personal data breaches

We tell you of a personal data breach affecting your data without undue delay and within 48 hours of becoming aware of it, with what we know and what we're doing about it. That leaves you time to meet your own 72-hour duty to the regulator.

9. Security measures

• TLS 1.2 or higher for all traffic. Encryption at rest for the database and file storage.
• Files are private and served only through signed links that expire within an hour.
• Every customer's data is separated by organisation and workspace in every query, with automated tests that try to cross that line.
• Participant contact details are stored apart from their responses.
• Sign-in tokens for connected services and two-step secrets are encrypted in the application with AES-256-GCM.
• Staff reach production data only through a support access grant you approve, or a logged emergency procedure. Staff accounts use two-step verification.
• Database backups with 7 days of point-in-time recovery and daily snapshots kept for 35 days.
• An audit log of who did what in your organisation.

10. Deletion and return

You can export everything at any time. Study data is deleted when its retention setting says (by default 12 months after the study closes), when you delete a participant, study or workspace, or when you close your account, which deletes everything. Deleted data leaves backups within 35 days. We keep only what the law requires us to keep, such as invoices.

11. Audits

We answer reasonable security questionnaires, and our security page sets out what we have and what we don't. If you need more, you or an independent auditor bound by confidentiality may audit our processing once a year, on 30 days' written notice, at your cost, or sooner after a breach or when a regulator asks.

12. Liability and law

The limits of liability in the terms of service apply to this agreement. Where the Standard Contractual Clauses require a particular law or court, that requirement wins.

Contact

Data protection questions: [email protected]. Security issues: [email protected].