Privacy Policy

We hold the following about a person who uses Surdatics:

• Account details — name, email address, password (stored hashed, never readable), and your organisation.
• Profile details — date of birth, gender, city, address, profession, education and phone number, where you give them, so studies reach the right people. They are optional, but being paid or cashing out needs a complete profile and a confirmed email address.
• Survey responses — your answers, and the survey and question each belongs to.
• Video and audio — where a study asks for a video answer: the recording, its transcript, and the themes drawn from it.
• Biometric data — if you take Surdatics Verify, a set of numbers that describes your face (a "face encoding"). This is special-category data, covered in its own section below.
• Payment details — your wallet balance, payout destination (bank account or wallet address), and a record of every credit and debit.
• Technical data — IP address, device and browser information, and timestamps, for security and fraud prevention.

When you sign up, take Surdatics Verify and cash out, we also keep your network address, your browser’s description of itself, a random device id stored in your browser and, at Surdatics Verify, your camera’s name. We use these only to stop one person running many accounts, and we do not send your address to anyone to do it.

Each kind of data has a purpose and a lawful basis under the Nigeria Data Protection Act 2023 and, where they apply to you, the EU/UK GDPR:

• To run your account — performance of our contract with you.
• To match you to surveys — your consent, given when you complete your profile. Leaving a field blank simply means fewer surveys match you.
• To pay you — performance of contract, and our legal obligation to keep financial records.
• To check that you are a real person, not already verified on another account — your explicit consent (see section 4).
• To prevent fraud and protect the platform — our legitimate interest in not paying out twice for the same work, or to someone impersonating another person.

Surdatics Verify checks that a real person, not already verified on another account, is behind a response. To do it we compute a face encoding — a set of numbers derived from your face. It is special-category data under GDPR Article 9 and sensitive personal data under the NDPA, so:

• We ask for your explicit consent first, separately from the rest of your account.
• It is optional. You can answer most paid studies before verifying, but a reward is paid only once you are verified, and a few studies are open only to verified people.
• We store the encoding, not a photograph, and it cannot be turned back into a picture of your face.
• It is never sold, never included in any dataset on the Surdatics Data Marketplace, and never shared with researchers.
• You can withdraw consent and have the encoding deleted at any time, which removes your verified status.

Research teams run their own studies on Surdatics and see the answers to them, under your wallet address only, unless you were told otherwise before you started and agreed to it.

• Research teams see your answers under your wallet address, with the demographic fields their study targeted — never your name, email, phone number, address or face encoding.
• Dataset buyers receive anonymised data only. Direct identifiers are stripped before any dataset can be listed.
• Service providers — payment processors, cloud hosting, transcription. They act on our instructions and may not use your data for their own purposes.
• Nobody else. We do not sell your contact details, and we do not share data with advertisers.

Before a dataset can be listed for sale, direct identifiers (name, email, phone, address, wallet address, account ID) are removed, free-text answers are screened for them, and one person cannot be followed from one dataset to another.

No anonymisation is absolute. Buyers are barred by contract from re-identifying anyone, and doing so ends their access.

Each response carries a record of what was asked, when it was answered, whether the person was verified and what they were paid, and every answer is hashed the moment it arrives and anchored on the blockchain, so that record cannot be rewritten. Only the SHA-256 hash goes on the blockchain: it shows nothing about you and cannot be turned back into your answers.

• Account details — while your account exists, then 30 days after you delete it.
• Network address, browser description and device id kept at sign-up, Surdatics Verify and cash-out — for 12 months.
• Survey responses — indefinitely in anonymised form, because a researcher has already paid for them and buyers rely on them. The link between a response and you is severed on deletion.
• Face encodings — until you withdraw consent, or 24 months after your last verification, whichever comes first.
• Financial records — 7 years, because tax law requires it.
• Video recordings — 12 months, unless the commissioning researcher agreed a shorter period with you.

These rights are yours under the NDPA and the GDPR. They are free to exercise and we answer within 30 days.

• See it — a copy of everything we hold about you.
• Correct it — fix anything wrong.
• Delete it — remove your account and sever your answers from you. Anonymised responses already sold cannot be recalled, and we will say so plainly rather than imply otherwise.
• Take it elsewhere — your data in a machine-readable format.
• Withdraw consent — for profiling, for verification, or for both, without losing access to the rest of the platform.
• Object — to any processing we do on the basis of legitimate interest.
• Complain — to the Nigeria Data Protection Commission, or to your own supervisory authority if you are in the EU or UK.

Surdatics AI drafts survey questions for researchers, transcribes and summarises video answers, and drafts reports from results.

We do not scrape. We do not buy scraped datasets or accept them onto the Surdatics Data Marketplace, and we do not train models on your personal data or sell it to anyone who does.

No decision that affects you — whether a response is approved, whether you are paid — is made by an automated system alone without a route to human review.

• All traffic is encrypted in transit (TLS).
• Secrets, signing keys and payout credentials are encrypted at rest.
• Passwords are hashed and cannot be read by us or recovered.
• Access to production data is limited to named administrators and logged.

We do not claim certifications we do not hold. Where we are audited or certified in future, this page will say which standard and by whom, with a date.

Surdatics operates across more than one country, and our infrastructure and payment partners may process data outside your own. Where data leaves Nigeria, the EEA or the UK, we rely on the transfer mechanisms those laws provide, including standard contractual clauses with the provider concerned.

The countries, states, regions, cities and towns you choose from come from GeoNames (geonames.org), used under the Creative Commons Attribution 4.0 licence. The list of occupations is grouped by the International Labour Organization’s International Standard Classification of Occupations (ISCO-08). A place or job you type yourself under “Other” is kept exactly as you typed it and is not checked against these lists.

If we change anything that materially affects you, we will tell you by email and in the product before it takes effect, not quietly update this page and rely on you noticing.