Privacy Policy v3: SuperMarketer Limited

Last Updated: [15 October 2026]

SuperMarketer Limited ("SuperMarketer", "we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our verification, matching, and synthetic research services.

We are registered with the ICO with number ZB709326.

1. Who We Are and How to Contact Us

SuperMarketer Limited is a company registered in England and Wales.

• Data Controller Role: SuperMarketer is the Data Controller for the personal data described in this policy.
• Third-Party Controllers: When you complete a survey hosted directly by one of our research clients, that research client acts as an independent data controller for your survey answers.
• Contact Information: If you have questions about this policy or wish to exercise your rights, contact us at privacy@supermarketer.co.uk or write to 215 Mitcham Lane, London, UK

2. What We Do

We provide two distinct services for market research participants:

1. Core Verification and Panel Integrity Services: We help market research panels verify that respondents are genuine and match respondents to relevant surveys.
2. Optional Synthetic Research Services: With your explicit consent, we allow you to contribute de-identified behavioral summaries and survey responses to help research clients train AI models and build synthetic research audiences.

3. Support Data, App Analytics, and Cookies

A. Information Collected When You Communicate With Us

If you contact us via email or support channels, we collect:

• Email address, communication contents, and attachments.
• Feedback, issue reports, or support submissions.
• Purpose: To resolve support tickets and improve customer service.

B. App Usage and Performance Data

To monitor app health and prevent technical errors, we automatically collect basic performance metrics:

• App launch times, IP addresses, and hang/crash rates.
• Anonymous crash reports containing basic device and hardware diagnostics.
• Statistical patterns in imported data to refine bot-detection accuracy and performance.

C. Website Cookies

We use cookies on our website and web applications:

• Essential Cookies: Necessary for site operation, security, and session management. These do not require consent.
• Analytics Cookies (Optional): We use privacy-compliant analytics tools (e.g., Google Analytics, Heap Analytics) to understand aggregated site usage and page interactions. These are set only with your consent, which you can manage or withdraw at any time via your browser settings.

4. Core Verification and Panel Integrity Services

How It Works

When you participate in a research panel, you may choose to authorize us to access data from your connected accounts.

What We Do With This Data

• Fraud Verification & Risk Scoring: We analyze your connected data to evaluate whether your activity is consistent with profile claims made to research panels (such as verifying location or professional demographic consistency).
• Survey Matching: We generate high-level interest tags (for example, identifying an interest in woodworking or gaming) to match you with relevant, paid market research opportunities.

How Data Is Shared

• We do not share your raw data. We never sell, transfer, or show your raw portability files, exact viewing history, or individual account details to anyone.
• Derived Outputs Only: We provide our research clients only with derived outputs, such as a numerical risk score or broad interest category tags without any way of tying that information back to you.

Legal Basis

We process this information based on your explicit consent given when you connect your accounts, and our legitimate interests in preventing panel fraud and improving survey matching.

5. Optional: Contributing Data for AI Model Training and Synthetic Research

In addition to verification, you may choose to participate in optional research projects that support AI model training and synthetic research.

Participation is entirely optional and requires your separate explicit consent at the time you connect your data.

When you opt in, we process your connected account activity to generate de-identified behavioral summaries. These derived summaries are provided to research partners you approve for AI model training and synthetic audience research

Connecting your data and verifying your account history also unlocks access to paid market research opportunities, including targeted surveys about your past decisions or profiling surveys. Depending on the specific project:

• Surveys hosted by SuperMarketer: SuperMarketer acts as the data controller for your survey responses.
• Surveys hosted by Research Clients: The research client hosts the questionnaire directly and acts as an independent data controller for your survey answers.

User Benefits: You gain access to niche, higher-paying survey opportunities and receive direct compensation for contributing your de-identified data to AI research projects.

6. How We Protect and De-Identify Shared Data

When you participate in AI model training or synthetic research projects, we strictly protect your privacy by de-identifying data before supplying it to research clients:

• No Raw Data: Research clients never receive raw data files, account credentials, exact dates, hotel names, or specific video titles.
• Derived and Aggregated Summaries: We provide aggregated or high-level summaries only (for example, providing travel month and year instead of exact flight details, or broad interest categories instead of specific video URLs).
• Contractual Restrictions: All research clients receiving de-identified data are legally bound by strict contract terms that forbid them from attempting to re-identify you, contacting you, or linking the data to other datasets.

7. Platform-Specific Compliance Statements

Google Data (YouTube and Google Account Data)

If you choose to verify or participate in research using Google, you connect your Google account via official Data Portability APIs.

Google User Data We Process

• YouTube activity history (titles, timestamps, searches).
• OAuth tokens necessary to execute the authorized transfer.

User-Facing Features Supported by Google Data

Google user data is processed strictly to provide and improve user-facing features:

1. Calculating bot-likelihood and risk scores based on viewing patterns.
2. Performing profile and identity consistency checks for inviting panel partners.
3. Generating interest-topic summaries for paid survey matching.
4. Unlocking access to optional, compensated synthetic research and AI model training projects.
5. Improving feature accuracy using rule-based and statistical methods on pseudonymised patterns.

How We Comply with Google’s Policies

Our use of information received from Google APIs adheres to the Google Data Portability API Policy and Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We do not use Google data for advertising, retargeting, or interest-based ads.
• We do not sell raw Google user data or transfer it to data brokers.
• We do not use Google data for credit scoring or lending determinations.
• We do not use raw Google data to train generalized AI models for independent commercial use. Where you explicitly opt in to a synthetic research project, we provide de-identified, high-level derived summaries to approved research clients solely for the specific project you authorized.
• Human staff do not read your raw YouTube activity except where explicitly requested for technical support, security/abuse investigations, or legal necessity.

Revocation & Deletion

You can revoke SuperMarketer’s access to your Google Account at any time via Google Security Settings.

You can also request data deletion by emailing privacy@supermarketer.co.uk or visiting https://cmp.supermarketer.co.uk/delete-my-data

Booking and LinkedIn

• Booking.com Data: Processed strictly in accordance with Booking.com Portability API Terms for authorized verification, survey matching, and optional travel research. Raw flight dates and hotel names are never shared; clients receive de-identified summaries.
• LinkedIn Data: Processed in compliance with LinkedIn Portability API Terms strictly to verify professional qualifications, assess claims and generate non-identifying industry interest tags.

8. Special Category Data

We do not extract, infer, or process special category data (including data concerning health, race, ethnic origin, religious beliefs, trade union membership, genetic data, biometric data, or sexual orientation) from your connected account activity.

Our interest-tagging taxonomies and risk-verification models explicitly exclude sensitive categories.

Optional Survey Collection

In specific profiling surveys, we may invite you to answer questions regarding your political opinions or voting preferences.

Lawful Basis: We process political opinion data strictly on the basis of your explicit consent, given before you answer those specific survey questions.

Protection & Usage: Any political opinion data collected via surveys is de-identified and aggregated before being supplied to research clients. It is never used to target you with political messaging or campaigns.

9. Data Storage and International Data Transfers

Where Your Data Is Stored

SuperMarketer is based in the United Kingdom. Primary hosting servers are located in the United Kingdom, and backup database infrastructure is maintained within the European Economic Area (Poland). All hosting locations comply with UK and EU data protection standards.

International Data Transfers

Because our leadership and technical teams operate internationally, and because we work with global research partners, your personal data and de-identified project summaries may be accessed from or transferred to countries outside the UK and EEA—specifically the United States:

1. Internal Technical Operations: Members of our executive teams (including our CTO) are based in the United States and access our secure systems remotely to perform technical administration, database operations, system engineering, and data analysis.
2. External Research Clients: Supply of verification outputs or de-identified datasets to international market research agencies, panel partners, and research clients based in the United States.

Safeguards for International Transfers

Whenever data is accessed from or transferred outside the UK or EEA, we ensure appropriate legal safeguards are in place to maintain UK and EU data protection standards, including:

• Transfer Contracts: Executing UK International Data Transfer Agreements (IDTA) or European Commission Standard Contractual Clauses (SCCs) governing both internal US access and external client data transfers.
• Technical Security: Enforcing strict, role-based access controls, multi-factor authentication, and end-to-end encryption for data in transit and at rest.
• Point-of-Collection Disclosures: Providing specific project disclosures (including the destination country of external research clients) on the authorization screen before you choose to connect your data.

10. Data Retention and Consent Withdrawal

Retention

We retain different categories of data only as long as necessary to fulfill the purposes described in this policy:

Raw Portability Data: Raw data fetched via connected APIs is retained for a maximum of 6 months strictly to calculate risk scores and generate derived datasets, after which raw files are permanently deleted.

Derived Risk Scores and Tags: Retained for the duration of your active panel membership plus 12 months to maintain ongoing panel integrity and prevent fraudulent re-registration.

Survey Answers (Hosted by SuperMarketer): Retained for up to 24 months to support ongoing research analysis.

De-Identified Training Datasets: De-identified datasets created for research and AI training projects are retained on SuperMarketer's secure systems for up to 36 months (or for the active duration of the project lifecycle), after which they are deleted or irreversibly anonymized

11. Your Rights

Under UK and EU data protection legislation, you have the following rights regarding your personal data:

• Withdrawal of Consent & Erasure: You can withdraw your consent or request the deletion of your personal data at any time. When you submit a request, we immediately stop processing your data, delete your stored source files from our primary and backup databases, and instruct recipient research clients to delete their copies of your stored datasets.
• Access: The right to request copies of the personal information we hold about you.
• Rectification: The right to request correction of inaccurate or incomplete data.
• Restriction & Objection: The right to restrict or object to our processing of your personal data.
• Data Portability: The right to request transfer of your data to another organization or directly to you.

How to Exercise Your Rights

To exercise any of your rights, you can:

• Revoke SuperMarketer's access permissions directly within your connected data’s account security settings.
• Email our privacy team at privacy@supermarketer.co.uk
• Request deletion directly by visiting cmp.supermarketer.co.uk/delete-my-data
• Submit a request through your originating market research panel.

Upon receiving a request, we will process your request within 30 days.

Technical Note on Pre-Trained AI Models

Deleting dataset files removes all stored source data from active databases. However, because trained AI models integrate generalized mathematical parameters across large datasets, an AI model that has already completed training cannot be edited to remove individual historical learning inputs.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk or your local European Data Protection Authority.

12. Third-Party Service Providers

We share data with trusted service providers who process information on our behalf under strict contractual obligations, including:

• Secure cloud hosting providers [CONFIRM: e.g., AWS / Google Cloud].
• Survey platform providers [CONFIRM: List any survey tools used].