Privacy Policy & Terms of Use

TestCart AI, operated by Theodoros Sofianos, Greece, is the data controller for TestCart AI accounts, website visitors, our tester community, and demo and sales enquiries. The operator is established in Greece and EU data protection law (GDPR) applies.

• Contact: theo@testcartai.com

When a company runs a study with its own shoppers, that company is the controller of the study data and TestCart AI processes it on the company's behalf, under a data processing agreement available on request. The company running a study receives visit-level data under a random ID, never your name or email.

Depending on your role (research participant or platform client), we may collect:

For studies with eye tracking, webcam frames are processed in the browser and never uploaded; only gaze coordinates are recorded, and only if you allow it. You can request export or deletion of your session data at any time from theo@testcartai.com.

Each study carries a data-retention policy that a builder can adjust. The defaults below are enforced by a nightly retention job that runs against every completed or archived study.

• Raw eye-tracking and interaction logs (gaze coordinates, pick-up and navigation events): deleted after the study's raw-data period, which defaults to 365 days after the study ends, or within 24 hours of the study ending if the builder chose that option.
• Survey answers (ratings, preferences, open feedback): unlinked from the tester after the anonymisation period, which defaults to 180 days after the study ends. The tester identifier is replaced with a pseudonym so the answers stay available for research while no longer being traceable to a person.
• Aggregated study results (charts, statistics, reports): kept for the builder's account so they can revisit and compare studies over time.
• Personal details (name, email, profile): kept while the tester account is active, and deleted within 30 days of a valid deletion request.
• Webcam calibration results (only for studies with eye tracking, and only if you allow it): the calibration accuracy score, the fitted gaze model and a coarse device description are stored with the visit. Webcam video is never recorded or stored.

If you register through a study link but never start the visit, your registration is deleted after 7 days.

We never share your name or email with the company running a study. That company receives charts, statistics and reports, and visit-level data under a random ID. Anything you type into open answers is passed to the company running the study, so please do not include personal details there.

We may share pseudonymised data with carefully vetted sub-processors under strict GDPR-compliant data processing agreements, including:

• Cloud infrastructure and hosting providers (servers in the United States)
• Data analytics and visualisation tools
• Reward fulfilment services (for participant compensation only)
• Google Workspace (Google Ireland Limited), for our business email and demo bookings, as described below
• Twilio SendGrid, which delivers the emails the platform sends from testcartai.com (sign-in, study and account notices)
• AI model providers (OpenAI, Anthropic and Google) through our hosting platform, to read shelf photos, run simulated shoppers and draft report summaries. They receive study content and aggregated results, not your name or email.
• Public content delivery networks, only if our own copy of the eye-tracking model files fails to load. Your browser then fetches those files from the network, which sees your IP address but no study data.
• Google Analytics (Google Ireland Limited), only if you accept analytics cookies, as described below

Email and demo bookings: We use Google Workspace, provided by Google Ireland Limited, for our business email at testcartai.com and for demo bookings made through our Google Calendar booking page. When you email us, send us an enquiry form, or book a demo, Google processes your name, your email address and your message, and for a booking the time you choose. Google may process this data in the EU and the US under its Cloud Data Processing Addendum and the Standard Contractual Clauses.

Rewards: TestCart AI distributes rewards only to platform-recruited testers who complete a study and pass quality checks. Testers may state a preferred reward type; the platform does not promise a specific brand, a fixed amount, or a cash value on this page.

Data is stored on servers in the United States operated by our hosting provider. TestCart AI is operated from Greece and applies GDPR to all participants. Transfers rely on the safeguards in our hosting provider's data processing agreement. We will never sell personal data to third parties.

Analytics cookies: We use Google Analytics 4, provided by Google Ireland Limited, to understand which pages are useful. It loads only after you accept analytics cookies in the consent bar shown on public pages; until then no Google Analytics script runs and no Google Analytics cookie is set. It records the pages you view (with access codes, emails and share links removed from the address), your device and browser type, and your approximate location. Google signals and ad personalisation are switched off, and the data is never used for advertising. Google keeps this data for up to 14 months and may process it in the EU and the US under the Standard Contractual Clauses. You can withdraw consent at any time from the "Cookie choices" link in the footer; withdrawing switches analytics off and removes its cookies.

Usage statistics without cookies: Our hosting platform records basic usage statistics on every page: the page viewed, the device and browser type, the approximate country and the link you came from. Unless you accept analytics cookies, nothing is stored on your device for this: your visit is grouped under a random ID that exists only while the page is open. If you are signed in, the statistics are linked to your account. These statistics are kept for up to 60 days and are used only to improve the site (legitimate interests, Art. 6(1)(f)).

The demo tour: The /demo tour records anonymous usage statistics through our hosting platform: which steps were viewed, the device type, the approximate country, and the link you came from. It records no name and no email. If you choose to leave your work email at the end of the tour, we use it only to contact you about TestCart AI and keep it for up to 24 months. You can ask us to delete it at any time at theo@testcartai.com.

You have the following rights, exercisable at any time by contacting theo@testcartai.com:

We will respond to all valid requests within 30 days. In complex cases, this may be extended by up to 2 months with notification.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure, including:

• Encryption of data in transit and at rest, provided by our hosting platform
• Access controls and role-based permissions
• Pseudonymisation of survey answers after the study's anonymisation period (see Section 4)
• Access to personal data limited to the founder, with documented data protection procedures

In the event of a personal data breach, we will notify affected individuals and the relevant supervisory authority within 72 hours in accordance with GDPR Article 33.

The TestCart AI platform is intended for participants aged 18 and over. We do not knowingly collect data from individuals under 18. If we become aware that a participant is under 18, their data will be deleted immediately. If you believe a minor has participated, please contact us at theo@testcartai.com.

TestCart AI conducts all research in accordance with the ESOMAR International Code on Market, Opinion and Social Research and Data Analytics and the ICC/ESOMAR International Code (2021). Key principles include:

• Voluntary participation: No participant shall be subjected to any pressure to take part or continue in a research project. Participation is always voluntary.
• No deception: The general purpose of the research will always be disclosed to participants. We will not misrepresent research as a sales or commercial solicitation.
• Anonymity: Individual participants' identities will never be revealed to research clients without explicit consent. Research findings are always presented in aggregate form.
• Research only: Data collected will be used solely for research purposes and will not be used as a basis for commercial decisions targeting individual participants.
• Protection of participants: TestCart AI will not cause harm, embarrassment, or distress to participants. Any participant may pause or stop a session immediately.
• Transparency: Participants will be informed who commissioned the research, unless this would compromise the integrity of the study (in which case they will be informed after completion).
• Data protection: All personal data will be collected, processed, and stored in accordance with applicable data protection legislation and ESOMAR guidelines.

By participating you agree to:

• Provide accurate information during onboarding and surveys
• Engage honestly and naturally with the virtual environment
• Not attempt to manipulate, reverse-engineer, or tamper with the platform
• Not share access codes or session links with third parties
• Report any technical issues or discomfort to the research team promptly
• Acknowledge that data collected is used for research purposes as described in the consent form

All virtual environments, shelf designs, product models, and platform technology are the intellectual property of TestCart AI or its licensors. Research participants are granted a limited, non-transferable licence to access the study environment solely for participation purposes. Screen recording, reproduction, or distribution of any part of the study environment is strictly prohibited.

TestCart AI takes all reasonable precautions to ensure the safety and well-being of participants. However, we cannot accept liability for:

• Pre-existing medical conditions aggravated by screen-based use
• Minor temporary discomfort (such as eye strain or headache) as described in the consent form
• Technical failures beyond our reasonable control (internet outage, device incompatibility)

Participants are responsible for ensuring their own equipment meets the minimum technical requirements and for participating in a safe physical environment.

TestCart AI reserves the right to update this Privacy Policy and Terms of Use at any time. Material changes will be communicated to active participants by email with at least 30 days' notice. Continued participation after the effective date of changes constitutes acceptance. The current version will always be available at testcartai.com/privacy-policy.

This Privacy Policy and Terms of Use are governed by Greek law. Any disputes shall be subject to the exclusive jurisdiction of the courts of Thessaloniki, Greece, without prejudice to your right to lodge a complaint with your national Data Protection Authority.