Privacy Policy

v1.1 — effective 14 August 2026

uxearchAI is an AI-powered UX research platform that connects product teams with testers, runs studies, and generates AI-assisted insight reports. Running that means handling personal data — including voice recordings — so this page sets out exactly what we collect, the lawful basis for each category, who sees it, and how long we keep it. We are the personal information controller for that data under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).

uxearchAI is in early access. This policy describes the service as it works today, and we will update it as the product changes.

Who we are

uxearchAI is operated as a sole proprietorship by its founder, who acts as the personal information controller and, during early access, personally handles data protection enquiries. Business registration is in progress; this section will name the registered entity once it completes.

Personal information controller: Clarence Cedric Lee, sole proprietor, trading as uxearchAI.
Business address: San Juan City, Metro Manila, Philippines.
Data protection contact: uxearchai@gmail.com. We have not yet appointed a separate Data Protection Officer; while early access continues, this address reaches the controller directly.
Supervisory authority: the National Privacy Commission of the Philippines, with whom you may file a complaint at any time.

Who can use uxearchAI

During early access, taking part in studies is open to residents of the Philippines aged 18 or older. We do not currently offer the service to testers in the EU, the UK, or other jurisdictions with their own data protection regimes, and this policy is written to the Data Privacy Act alone. If we open eligibility further, we will publish the additional terms that come with it before doing so.

What sessions record

We do not record your screen. uxearchAI does not capture your screen, any window you have open, or still images of either. Nothing in a session watches what is on your display.

Some studies record your microphone, so the researcher can hear you think aloud as you work. This is off by default and switched on per study. The session tells you which kind you are in before you begin, and where a study records audio we ask for your explicit consent first.

What we collect

Each category below names its lawful basis under the Data Privacy Act. Where a category is sensitive personal information under section 3(l), we rely on your consent under section 13(a), and you may withdraw it as described under Your rights.

Everyone with an account. Your email address, and which parts of the product your account may use. Basis: necessary to perform our contract with you, section 12(b).

Everyone, as you use the site. Which pages you visit and what you click, and a replay of how you moved through uxearchAI's own screens — rebuilt from the page itself rather than filmed. It never includes your microphone or anything you type into a form. Basis: our legitimate interest in understanding and fixing where the product confuses people, section 12(f). See Analytics and replay below for how to opt out.

Testers, on your profile. Your full name, mobile number, gender, nationality, country and area of residence, industry and occupation, employment status, household composition (whether you have children, your living situation), the languages you speak, your comfort with technology and video calls, the devices, operating systems and browsers you use, whether you have taken part in research recently, and a short bio. Basis: necessary to perform our contract with you — matching you to studies is the service you signed up for — section 12(b).

Testers, sensitive categories. Your age range, marital status, education, and nationality are sensitive personal information under section 3(l), because they describe age, marital status, education and ethnic origin. We collect them because researchers recruit by these characteristics and a study is matched on them. Basis: your consent, section 13(a), given when you complete your profile and recorded with the date. We do not collect health data, religious or political affiliation, genetic or sexual-life information, government-issued identifiers, or any record of offences.

Testers, during a session. On a study that records audio: a recording of your microphone and its transcript. On every study: your answers and difficulty ratings for each task, any notes you write, and how long each task took. A record of your consent — the date and the version of this policy and the terms you agreed to — is stored separately. Basis: your consent for the recording, section 12(a) and, where what you say aloud discloses sensitive information, section 13(a); contract for the task answers and ratings, section 12(b).

Testers, incentive payments. Where a study offers an incentive, we ask for the payment details needed to send it — the name on the account and the e-wallet or mobile number to pay. During early access we collect these directly from you at the time the incentive is agreed, and we do not ask for them on your profile. Some profiles created before August 2026 still hold a mobile-money number from an earlier version of the profile form; it is not shown to researchers, is not used by any part of the product today, and you can have it erased on request. We never collect card numbers or bank credentials. Basis: necessary to pay you what we agreed, section 12(b), and to meet tax and accounting obligations, section 12(c).

Researchers. The address of the product you want tested, your description of it, and your description of the testers you are looking for. Basis: necessary to perform our contract with you, section 12(b).

Everyone, technical logs. Basic server and error logs, kept to keep the service running and secure. Our error monitoring is configured not to attach personal data to reports, though a log line can still incidentally contain something you submitted. Basis: our legitimate interest in a secure, working service, section 12(f).

How we use it

To match testers to studies they fit, and to run sessions.
To transcribe session recordings and generate AI-assisted findings reports for the researcher whose study it was.
To pay incentives, where a study offers them.
To contact you about a study you are part of, or about your account.
To diagnose faults and keep the service secure.

We do not sell personal data, and we do not use it for advertising.

Automated processing

Several parts of uxearchAI are automated, and we would rather say so plainly than leave you to infer it:

Matching. When a study is created, software scores every eligible tester profile against what the researcher asked for and produces a ranked shortlist. This is profiling: it uses your profile answers, including the sensitive categories above, to decide who is invited to a study.
Study content and reports. Task lists, findings, and severity ratings are generated by automated analysis of what a session captured.

No decision that affects you is made by software alone. A shortlist is an invitation list, not a gate: a researcher decides who to invite, you decide whether to accept, and whether an incentive is paid is decided by a person reviewing the completed session against the criteria in our Terms of Service. Your match score is never shown to researchers.

You have the right to object to processing for profiling. If you object, email uxearchai@gmail.com — we will remove your profile from matching, which in practice means you stop being invited to studies.

Who sees your session data

Your task answers, ratings and notes — and, on a study that records audio, the recording and its transcript — are shared with the researcher who created the study you took part in. That is the purpose of the session, and it is what you consent to before it starts.

Your name, contact number, payment details and exact location are never shown to researchers. Neither is our internal assessment of how well you match a study.

Because a study can record what you say aloud, treat your commentary the way you would treat anything else you are sending a researcher, and avoid naming other people or reading out anything private. If something private ends up in a recording, tell us and we will delete it — see Your rights for how quickly.

Researchers are bound by the data protection obligations in our Terms of Service: they may use session data only for the research you consented to, must keep it secure, must delete it when we tell them you have asked for erasure, must tell us within 24 hours if they suffer a breach affecting it, may not attempt to identify or contact you outside uxearchAI, and must impose the same duties on anyone they share it with inside their organisation.

Service providers we use

We share data with the following providers strictly to operate the service. Several process data outside the Philippines, mainly in the United States and the European Union.

Supabase — accounts, database, and storage of recordings.
Vercel — application hosting.
Inngest — queueing the background jobs that process recordings.
OpenAI — transcribing session audio, and generating parts of study content and reports.
Anthropic — generating study tasks, findings reports, and tester matching.
ScreenshotOne — capturing images of researcher-submitted pages. This handles no tester data.
Sentry — error monitoring.
PostHog — usage analytics, and replays of how people move through uxearchAI's own pages, so we can find the parts of the service that confuse people. This is not the session recording described above and is never shared with researchers: it captures only uxearchAI's own screens and never your microphone. Anything you type into a form is hidden before it leaves your browser, as are your email address, your recordings and transcripts, and anything you wrote about yourself.

Transfers outside the Philippines. Under section 21 of the Data Privacy Act we remain accountable for your data when a provider processes it abroad. Each provider above is engaged under its standard data processing agreement, which binds it to process data only on our instructions, to keep it confidential and secure, to impose equivalent terms on its own sub-processors, and to delete or return it when our contract ends. We do not authorise any of them to use your data for their own purposes.

Training of AI models. Our Terms of Service forbid researchers from using session data to train machine-learning models. We are separately confirming the training commitments in our own API agreements with OpenAI and Anthropic, and will state the position here once we have done so rather than assert it now. If this matters to your decision to take part, email us and we will tell you where it stands.

How we keep it safe

Data is encrypted in transit (HTTPS/TLS across the site and every provider connection) and at rest by our database and storage provider.
Access is scoped per account at the database level, so one account cannot read another account's rows, and recordings are served only through short-lived signed links.
Administrative access is limited to the controller, protected by multi-factor authentication on every provider account that offers it.
Session recordings are stored in a private bucket that is never publicly listable or readable.

No system is perfectly secure, and early access means the product is still changing. If you find a security problem, please tell us at uxearchai@gmail.com before disclosing it elsewhere.

If something goes wrong

If a security incident affects your personal data in a way that is likely to put you at risk, we will notify the National Privacy Commission and the people affected within 72 hours of becoming aware of it, as the Data Privacy Act and its implementing rules require. Our notice will say what happened, what data was involved, what we are doing about it, and what you can do.

How long we keep it

Session recordings: deleted 90 days after the session, automatically.
Transcripts, task answers and reports: kept while the researcher keeps the study, and in any case deleted no later than 30 days after that researcher's account closes. Deleting a study deletes its sessions, recordings and transcripts.
Profile data: kept while your account is open, and erased within 30 days of you closing it.
Incentive payment details: kept only until the incentive is paid and any tax or accounting obligation attaching to it has been met.
Consent records: kept after the thing they authorised is deleted, since they are the evidence that it was made with your permission. These hold the date and the document version, not the recording.
Technical and error logs: kept no longer than 12 months.

Your rights

Under the Data Privacy Act you have the right to be informed, to object, to access, to correct, to erase or block, to damages, to data portability, and to complain to the National Privacy Commission. In practice:

You can view and correct your profile at any time from your dashboard.
You can withdraw from a study you have accepted, and you can ask us to delete a recording you have already made.
You can object to automated matching, which stops you being invited to studies.
You can ask us to close your account and erase your data, or to send you a copy of it, by emailing uxearchai@gmail.com.

How quickly we respond. We acknowledge a request within 5 working days and complete it within 15 working days. If a request is complex and will take longer, we will tell you why and when to expect it. Where you ask us to remove something private from a recording, we delete it within 5 working days and confirm when it is done. There is no charge for any of this.

Where a researcher already holds a transcript or recording covered by your erasure request, we instruct them to delete their copy and they are contractually required to do so. We will tell you when we have passed the request on, and what the researcher confirmed.

Withdrawing consent does not affect anything already lawfully done with your data before you withdrew it, and we may keep the minimum needed to meet a legal obligation.

Analytics and replay

We use PostHog to understand how people move through uxearchAI's own pages, as described above. It is on by default and it never sees your microphone, a session recording, or anything you type. If you would rather not be included, email uxearchai@gmail.com and we will exclude your account — this has no effect on your ability to take part in studies or to be paid an incentive.

Children

uxearchAI is for adults. You must be 18 or older to take part in a session, and we confirm this before every session that records. We do not knowingly collect data from children.

Changes to this policy

If we make a material change we will tell account holders by email. Every version carries a version label and an effective date, and consent records store the version you agreed to, so a consent record always resolves to a specific document.

v1.1 — 2026-08-14. Corrected the Privacy Policy to match what sessions actually capture (audio only, no screen); added incentive payment data, lawful bases, controller and security details, retention limits, automated-processing disclosure, and researcher data-protection obligations.
v1.0 — 2026-07-31. First published version.

Contact

For anything about your data, including a request to access or delete it, contact uxearchai@gmail.com. You may also complain to the National Privacy Commission at privacy.gov.ph.