Privacy Policy & Terms of Use

TestCart AI Ltd is the data controller responsible for personal data processed through our platform. We are registered under applicable EU/UK data protection law.

• Company: TestCart AI Ltd
• Privacy contact: privacy@testcartai.com
• Research contact: research@testcartai.com

When a research client commissions a study, TestCart AI acts as the data controller for participant data. Research clients receive only aggregated, anonymised findings.

Depending on your role (research participant or platform client), we may collect:

• Identifying personal data (name, email): retained for 36 months from last session or until deletion is requested, whichever is sooner.
• Pseudonymised research data (behavioural, survey): retained for up to 5 years for longitudinal research purposes.
• Biometric/gaze session data: retained for up to 24 months unless earlier deletion is requested.
• Webcam calibration data: processed in real-time and not permanently stored.
• Upon a valid erasure request, all identifying data is permanently deleted within 30 days.

We never share identifiable participant data with research clients. Clients receive only aggregated, anonymised research outputs (charts, statistics, reports).

We may share pseudonymised data with carefully vetted sub-processors under strict GDPR-compliant data processing agreements, including:

• Cloud infrastructure and hosting providers (servers within the EEA)
• Data analytics and visualisation tools
• Reward fulfilment services (for participant compensation only)

Any transfer of data outside the EEA is conducted under Standard Contractual Clauses (SCCs) or equivalent GDPR safeguards. We will never sell personal data to third parties.

You have the following rights, exercisable at any time by contacting privacy@testcartai.com:

We will respond to all valid requests within 30 days. In complex cases, this may be extended by up to 2 months with notification.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure, including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Access controls and role-based permissions
• Regular security audits and penetration testing
• Pseudonymisation of all research data prior to analysis
• Staff data protection training and confidentiality obligations

In the event of a personal data breach, we will notify affected individuals and the relevant supervisory authority within 72 hours in accordance with GDPR Article 33.

The TestCart AI platform is intended for participants aged 18 and over. We do not knowingly collect data from individuals under 18. If we become aware that a participant is under 18, their data will be deleted immediately. If you believe a minor has participated, please contact us at privacy@testcartai.com.

TestCart AI conducts all research in accordance with the ESOMAR International Code on Market, Opinion and Social Research and Data Analytics and the ICC/ESOMAR International Code (2021). Key principles include:

• Voluntary participation: No participant shall be subjected to any pressure to take part or continue in a research project. Participation is always voluntary.
• No deception: The general purpose of the research will always be disclosed to participants. We will not misrepresent research as a sales or commercial solicitation.
• Anonymity: Individual participants' identities will never be revealed to research clients without explicit consent. Research findings are always presented in aggregate form.
• Research only: Data collected will be used solely for research purposes and will not be used as a basis for commercial decisions targeting individual participants.
• Protection of participants: TestCart AI will not cause harm, embarrassment, or distress to participants. Any participant may pause or stop a session immediately.
• Transparency: Participants will be informed who commissioned the research, unless this would compromise the integrity of the study (in which case they will be informed after completion).
• Data protection: All personal data will be collected, processed, and stored in accordance with applicable data protection legislation and ESOMAR guidelines.

By participating you agree to:

• Provide accurate information during onboarding and surveys
• Engage honestly and naturally with the virtual environment
• Not attempt to manipulate, reverse-engineer, or tamper with the platform
• Not share access codes or session links with third parties
• Report any technical issues or discomfort to the research team promptly
• Acknowledge that data collected is used for research purposes as described in the consent form

All virtual environments, shelf designs, product models, and platform technology are the intellectual property of TestCart AI Ltd or its licensors. Research participants are granted a limited, non-transferable licence to access the study environment solely for participation purposes. Screen recording, reproduction, or distribution of any part of the study environment is strictly prohibited.

TestCart AI takes all reasonable precautions to ensure the safety and well-being of participants. However, we cannot accept liability for:

• Pre-existing medical conditions aggravated by screen-based use
• Minor temporary discomfort (eye strain, mild nausea) as described in the consent form
• Technical failures beyond our reasonable control (internet outage, device incompatibility)

Participants are responsible for ensuring their own equipment meets the minimum technical requirements and for participating in a safe physical environment.

TestCart AI reserves the right to update this Privacy Policy and Terms of Use at any time. Material changes will be communicated to active participants by email with at least 30 days' notice. Continued participation after the effective date of changes constitutes acceptance. The current version will always be available at testcartai.com/privacy-policy.

This Privacy Policy and Terms of Use are governed by the laws of the European Union and, where applicable, the laws of the jurisdiction in which Theodoros Sofianos is registered. Any disputes shall be subject to the exclusive jurisdiction of the relevant courts, without prejudice to your right to lodge a complaint with your national Data Protection Authority.