Privacy Policy

01Who we are, and our role

Candor is an AI-moderated survey service operated by Candid Conversations Inc.. For researcher accounts and the waitlist, we decide how the data is used, so we act as the data controller. For study content and respondent answers, the organization running the study is the controller; Candor processes that data on their instructions as a processor.

If you answered a Candor survey, the organization that sent you the link is responsible for that study. Contact them first for questions about your answers; we support their requests.

02What we collect

• Researchers: your email address, used to sign you in with one-time emailed codes; the emails of teammates you invite; the studies and questions you create.
• Respondents: your answers (including free text), a random session token, the interview language, timestamps, and an optional source tag the researcher may add to their link. No account, no name, no email is required by Candor.
• Waitlist: your email address and which form you used.
• Landing demo: the website address or business description you type in, the demo answers you write, and your IP address (used only to rate-limit the demo). Demo sessions are anonymous: no email or account is attached to them.
• Technical: server logs and an audit trail of administrative actions, including IP addresses. Our logs strip query strings so survey tokens do not end up in them.

03How we use it

• running interviews and generating follow-up questions,
• quality-checking question phrasing before it is shown,
• synthesizing themes from open answers,
• sending alerts to your Slack workspace if your team connects it,
• emailing the waitlist about access (that is the only thing the waitlist is used for),
• running the landing-page demo: reading the website or description you point us at, drafting its questions, and generating the mini-analysis of your practice answers,
• security, abuse prevention, and debugging.
• with your permission, understanding which discovery sources lead to useful account activity.

Optional discovery attribution uses first-party browser storage only after you choose Allow. It remembers a source category (such as ChatGPT or direct), a public landing-page path and a timestamp for up to 90 days. We do not save full referrer URLs, search terms, campaign text or survey answers for this purpose. If you create an account, this attribution is attached to the new workspace and used in an owner-only aggregate report with account confirmation and non-test completion counts. It follows the account retention rules below. Missing attribution is not reconstructed. Global Privacy Control and Do Not Track disable collection.

04AI processing

Question text and respondent answers are sent to Anthropic's Claude models through a managed proxy only to run the research features you use: deciding whether a follow-up is worth asking, checking question style, grouping answers into themes, and answering the questions researchers ask about their own results. The landing demo works the same way: the page text or description you provide and the practice answers you type are processed by the same models to build the demo interview and its analysis. We do not use your data to train models, and Candor makes no automated decisions about people with legal or similarly significant effects.

05Cookies

We only set cookies the service cannot work without:

• candor_session: keeps researchers signed in for up to 30 days.
• no extra sign-in cookies: logging in uses a one-time code we email you, which expires after 10 minutes and is stored only as a hash.

There are no advertising, analytics, or cross-site tracking cookies, which is why you do not see a cookie banner. Respondents answering a survey get no marketing cookies at all.

06Where data lives, and who helps us run Candor

Data is hosted in the United States. We use a short list of subprocessors, each bound by contract:

• Replit (application hosting, file storage),
• Resend (sends the login-code emails),
• Neon (managed Postgres database),
• Anthropic (AI processing described above),
• Slack (only if your workspace connects it, and only the notifications you configure).

Where transfers from the EU or UK are involved, we rely on safeguards such as Standard Contractual Clauses. Details are available on request.

07How long we keep things

• Research data: until the researcher deletes the study or closes the workspace. Deleting a study removes its questions, conversations, and answers together.
• Sign-in sessions: 30 days.
• Waitlist emails: until public launch or until you ask to be removed.
• Landing demo sessions: deleted within 7 days.
• Server logs and audit trail: up to 12 months.

08Your rights

Under the GDPR and similar laws you can ask for access, correction, deletion, a portable copy, or restriction of your personal data, and you can object to processing based on legitimate interests. You can also complain to your supervisory authority.

• Researchers and waitlist members: email info@candor.biz and we will respond within a month.
• Respondents: the organization that invited you controls the study, so send your request to them. Candor gives them the tools to honor it: full transcript export and study-level deletion that removes answers permanently.

09Security

Traffic is encrypted in transit, data is encrypted at rest, access is limited to workspace members with role-based permissions, requests are rate limited, and administrative actions are recorded in an audit trail. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

10Children

Candor is not directed to children under 16, and researchers may not use it to knowingly survey children without the safeguards the law requires.

11Changes and contact

If this policy changes in a way that matters, we will update the date at the top and give notice in the product. Questions: info@candor.biz. The service terms live in the Terms of Use.