Privacy Policy

Trooly ("we" or "us") values our users and respects their privacy. This privacy policy ("Privacy Policy") governs our collection and use of data in connection with our website (the "Site"), our web-based applications, our automated interview platform, and any services we offer (collectively, the "Services").

Terms capitalized but not defined in this Privacy Policy shall have the meaning ascribed to them in our Terms of Use and, where applicable, in our Consent to Participate and Data Use Agreement (the "Consent Form").

This Privacy Policy sets forth the nature, purpose, use and sharing of any information that identifies or can be used to identify you, the visitors to the Site, and users of our Services ("Personal Information"). This Privacy Policy does not govern privacy practices associated with offline activities, websites other than ours, or practices of third parties that we do not own or control, such as our partners, third party service providers featured on the Site or in the Services, or advertisers.

This Privacy Policy is intended to work together with our Consent Form. In the event of any inconsistency between this Privacy Policy and the Consent Form with respect to your participation in a specific research interview, the Consent Form will control.

If you have objections to the Privacy Policy, you should immediately discontinue use of the Services and follow the procedure described in the section entitled "Opting-Out or Updating Your Personal Information and Privacy Preferences."

We do not knowingly collect any Personal Information from anyone under 16 years of age. If you are under age 16, please do not provide any Personal Information about yourself to us. If we learn that we have collected Personal Information from a child under age 16, we will delete that information as quickly as possible. If you believe that we might have any Personal Information from a child under the age of 16, please contact us immediately.

Any Personal Information that we collect and maintain will be subject to this Privacy Policy, as amended from time to time. We may change the Privacy Policy at our sole discretion. However, if at any time we make material changes to the Privacy Policy, we will notify you of those changes on the Services and through the publishing of an updated Privacy Policy. We will highlight any material changes to the Privacy Policy (for example, changes to the information we collect, how we use it, or why) at the top of the Privacy Policy.

If as the result of such changes you want to alter the ways in which we are allowed to use your Personal Information, you can do so by following the procedure described in the section entitled "Opting-Out or Updating Your Personal Information and Privacy Preferences."

As of January 1, 2020, the California Consumer Privacy Act of 2018 ("CCPA"), as amended by the California Privacy Rights Act (CPRA), is in full effect. The CCPA, together with the EU's and UK's General Data Protection Regulation ("GDPR"), may apply to the collection and processing of Personal Information of certain users of our Services, depending on their location and circumstances of the processing.

This Privacy Policy describes how we collect, use, and share Personal Information and the rights that may be available to users under applicable data protection laws. Your continued use of the Site and Services constitutes acceptance of this Privacy Policy.

Generally, this means that we will collect and process your Personal Information as described in this Privacy Policy and, where applicable, in the Consent Form, including for legitimate business purposes and to provide the Services.

We do not sell your Personal Information as that term is defined under CCPA/CPRA. However, we may use, share, license, or sell aggregated, anonymized, or de-identified data that cannot reasonably be linked to you as an individual, as described in more detail below.

If you wish to exercise any rights available to you under applicable data protection laws, you may do so in accordance with the procedures described in this Privacy Policy. We take data protection and security seriously and will notify users of material changes to our data practices or this Privacy Policy as required by law.

We collect Personal Information from you in several ways, as described below.

We collect the Personal Information you give us when you register with the Site or use the Services, including name, email address, and other Personal Information you choose to provide in connection with your use of the Site or the Services. Payment-related information (such as billing address or payment method details), where applicable, is processed by our payment service providers and not stored by us.

As part of account creation and screening for research participation, and where relevant to a specific research study, we may ask you to provide demographic and background information, which may include:

• age;
• gender;
• country or region;
• occupation (optional);
• LinkedIn profile or similar professional information (optional);
• other information about your experience or interests that you choose to provide.

We may collect Personal Information through your LinkedIn or other third-party account if you choose to link or register with such account on our Site. This may include information relating to your professional background and experience, subject to your account settings and authorizations.

Where permitted by applicable law and with your explicit consent, we may collect certain sensitive demographic information for research purposes, such as age, race, or ethnicity, where relevant to a particular study. You are not required to provide this information, and your decision not to do so will not prevent you from using the Services.

When you use the Site or the Services, we automatically collect certain technical information, such as device and browser type, operating system, referring or exit webpages, IP address, and usage patterns. We use cookies or similar techniques to collect this information.

We may supplement or correct the Personal Information you provide using information from internal systems or third-party sources for purposes such as user authentication, fraud prevention, abuse prevention, and maintaining data accuracy.

We may also collect information about how the Site and Services are used, such as pages accessed, number of visits, and time spent on the Site. We use cookies or similar techniques to collect this information. This information is generally collected in aggregate form and is not intended to identify individual users, although IP addresses and session identifiers may be retained in connection with security, fraud prevention, or abuse detection activities.

Except as described in this Privacy Policy and the Consent Form, we collect and use Personal Information for purposes related to providing and operating the Services, conducting research activities, and supporting our legitimate business operations. We may use Personal Information in the following ways:

• To provide the Services, including sharing your personal data with our customers in connection with research studies. Our matching and recommendation systems match respondents with suitable research studies based on the personal information we process.
• To share certain demographic or sensitive attributes (such as race or ethnicity, where legally permitted) with our customers for the purposes of ensuring that you receive suitable research study opportunities and that our customers reach appropriate target audiences. We will only share such information with your explicit consent, which we request at the time of collection.
• To conduct automated or software-mediated interviews and generate research data. Where our Services provide AI- or software-mediated interview experiences (rather than human moderators), we use your responses (including audio, video, screen content, and text, as described in the Consent Form) to generate transcripts, summaries, and other research outputs for our customers. You are responsible for the content you choose to provide during such interviews.
• To conduct routine business operations, such as billing, identification, authentication, communications, analytics, hosting, storage, and payment processing. In connection with these activities, we may share Personal Information with third-party service providers that perform services on our behalf and are contractually obligated to protect such information and use it only for providing services to us.
• To operate, analyze, and improve the Services, including through the use of analytics tools such as Google Analytics and PostHog, and to communicate with you about the Services and related updates.
• To enhance and improve the Services, including by improving platform functionality, matching accuracy, and user experience based on information you provide.
• To train, test, and improve our automated and AI systems. Consistent with the Consent Form, we may use de-identified data derived from your use of the Services (including interview content that has been de-identified) to train, fine-tune, validate, or evaluate our algorithms and AI models. We do not use your identifiable Personal Information for AI model training where the Consent Form or applicable law requires de-identification. Once data has been de-identified and used for model training, it may not be possible to remove its contribution from trained models.
• To generate reports or insights based on aggregated or de-identified data, which we may use internally or share with third parties. Data that has been aggregated or de-identified so that it cannot reasonably be linked to you may not be removable from such reports or disclosures.
• To use and transfer information received from Google APIs (where applicable) in accordance with the Google API Services User Data Policy, including the Limited Use requirements.
• To comply with applicable laws, regulations, legal processes, or governmental requests, and to enforce our Terms of Use.

We may request your separate consent for additional processing activities, such as providing promotional communications, where required by applicable law.

In order to operate, analyze, and improve the Site and Services and provide relevant user experiences, we and our service providers may use cookies, web beacons, and similar technologies to collect information about your interactions with the Site and Services.

Most web browsers accept cookies by default. You can typically configure your browser settings to manage cookies or notify you when a cookie is placed on your device. Please note that disabling cookies may affect the functionality of certain features of the Services. At this time, the Services do not respond to browser "Do Not Track" signals.

We use reasonable administrative, technical, and physical safeguards designed to protect Personal Information, including encryption, access controls, and authentication measures. You are responsible for maintaining the confidentiality of any login credentials or secure access links provided to you in connection with the Services.

We retain Personal Information for as long as reasonably necessary for our business purposes, including providing the Services, complying with legal obligations, resolving disputes, and enforcing our agreements. Where required by applicable law, you may request deletion of your Personal Information, subject to applicable legal and contractual retention requirements.

Information that has been de-identified or aggregated so that it cannot reasonably be linked to you is not considered Personal Information and may be retained and used indefinitely, including for analytics, research, and improvement of the Services and AI systems, consistent with the Consent Form.

We may share your Personal Information with third parties in the circumstances described below:

• We may share your Personal Information with third party service providers that perform services on our behalf for the purposes described in the section entitled "How Your Information is Used."
• We may share your Personal Information with our customers in connection with research studies, including to facilitate participant matching and to provide research outputs (such as interview content and related data) that you have agreed to provide pursuant to the Consent Form.
• We may share Personal Information as required by applicable law, regulation, legal process, or where we reasonably believe such disclosure is necessary to protect our rights, the Services, or the safety of others.
• In the event of a merger, acquisition, reorganization, or sale of assets, Personal Information may be transferred as part of that transaction, subject to applicable law. We may provide notice of such transactions on the Site as required.

We do not sell Personal Information. However, we may use, share, license, or sell aggregated, or de-identified information that cannot reasonably be linked to an individual.

You may opt out of certain uses of your Personal Information, such as receiving non-essential communications, as described in the section entitled "Opting-Out or Updating Your Personal Information and Privacy Preferences." Please note that if you choose not to provide information that is required to provide the Services, certain features of the Services may be unavailable to you.

You may opt out of receiving non-essential communications from us. However, you will continue to receive transactional or service-related communications, such as notices related to your account, participation in research studies, or other important service updates.

You may configure your browser settings to manage cookies, including some or all cookies or receiving alerts when cookies are placed. Please note that disabling cookies may affect the availability or functionality of certain features of the Site.

To exercise any rights available to you under this Privacy Policy or applicable law with respect to your Personal Information, or to request additional information about our data practices, you may contact us using the methods described below. We will respond to verified requests within the timeframes required by applicable law.

You may email us at privacy@trooly.ai (or another email address we designate for privacy matters). In your email, please include your name, account email address, and a description of your request. Requests may include seeking access to, correction of, or deletion of your Personal Information, or exercising other rights available under applicable law.

Please note that requesting deletion of, or restricting processing of, Personal Information that is necessary to provide the Services may result in your inability to access some or all of the Services. In addition, we may be unable to delete or modify the following categories of information:

• Personal Information that has already been shared with our customers as part of a completed research study;
• Personal Information that we are required to retain to comply with legal obligations; or
• Information that has been de-identified or aggregated so that it cannot reasonably be linked to you, including AI models trained on such data.

You may update certain Personal Information associated with your account at any time through your account settings, where available.

We will not discriminate against you for exercising any rights available to you under this Privacy Policy or applicable law. However, if you request deletion of or opt out of processing of Personal Information that is necessary to provide the Services, we may be unable to continue providing some or all of the Services to you.

If you are located in the European Union or the United Kingdom and the General Data Protection Regulation ("GDPR") applies to our processing of your Personal Information, you may have certain rights with respect to your Personal Information, including the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing. These rights apply only in specific circumstances and are subject to applicable limitations and exceptions.

If you submit a request to exercise your GDPR rights, we will respond within the timeframes required by applicable law, which generally require a response within one month, subject to permissible extensions. If an extension is required, we will notify you as required by law. Certain information may not be subject to erasure or restriction, including information that has already been shared with customers in connection with completed research studies or information that has been de-identified so that it cannot reasonably be linked to you.

Personal Information we collect may be transferred to, stored in, accessed from, and processed in the United States or other jurisdictions in which we or our service providers operate, for the purposes described in this Privacy Policy and the Consent Form. These jurisdictions may have data protection laws that differ from those in your country of residence.

Where required by applicable law, we implement appropriate safeguards for cross-border transfers of Personal Information, such as standard contractual clauses approved by relevant authorities. If you have questions about international transfers of your Personal Information, you may contact us at privacy@trooly.ai.

We have designated a privacy contact responsible for overseeing compliance with this Privacy Policy and responding to inquiries regarding our data protection practices.

You may contact us regarding data protection matters at: privacy@trooly.ai.