Privacy policy

Last updated 16 October 2026

1. Who we are

CleverX is a research platform operated by BluMatter, Inc., a Delaware corporation ("CleverX," "we," "us"). Our address is 131 Continental Drive, Suite 305, Newark, DE 19713.

Companies use CleverX to run research studies: surveys, AI-moderated interviews, live video interviews, unmoderated usability tests, and video diaries. Professionals join those studies as participants and earn rewards.

This policy explains what personal data we collect, why, who we share it with, and the choices you have.

Two roles. For data we collect to run the platform (accounts, payments, fraud prevention, analytics), we are the data controller. For study content that a researcher collects through our platform (your survey answers, interview recordings, test sessions), the researcher is typically the controller and we process that data on their behalf under our Data Processing Addendum. Where this policy says a researcher "receives" your data, that researcher has their own privacy obligations to you.

2. Who this policy covers

This policy covers three groups of people. What we collect depends on which group you are in.

Link-only panelists. Some participants reach a study through a direct link from an external research panel without creating a full CleverX account. For these participants we collect the study responses, recordings where the study includes them, device and fraud-prevention data, and a panel identifier so the panel can pay you. Your relationship with the panel is governed by the panel's own terms and privacy policy.

3. Data we collect

3.1 Data you give us directly

Researchers: name, work email, company, role, password or single sign-on details, billing information, the studies you create, and messages you send through the platform or to our support team.

Participants: name, email, password or single sign-on details, your professional profile (job titles, employers, work history, education, skills, industries), LinkedIn profile URL if you provide one, screener answers, survey responses, messages, and payout account details (handled by our payout providers, see Section 7).

Study responses: everything you submit inside a study, including survey answers, open-text responses, uploaded files, and demographic questions a researcher chooses to ask.

3.2 Data collected automatically

• Device and usage data: IP address, browser and device type, operating system, pages viewed, actions taken in the app, and timestamps. We use third-party analytics tools for this (see our Subprocessor List for current providers).
• Approximate location: we derive your country from your IP address.
• Device fingerprint: we use device-fingerprinting technology to generate an identifier for your device. We use it to detect duplicate accounts, VPN or virtual-machine use, and fraud rings. See Section 12 on automated decisions.
• Cookies and similar technologies: see Section 14.

3.3 Data we collect from third parties

We want to be direct about this because it is unusual and you may not expect it.

LinkedIn-sourced profile enrichment (participants). When a participant provides a LinkedIn profile URL, or when we verify a profile, we obtain data about that profile from third-party professional-data providers (named on our Subprocessor List). These providers compile data from publicly available sources and their own partner sources. The data we receive can include:

• name, headline, photo, and location
• full work history, job titles, employers, and education
• skills, languages, and certifications
• personal email addresses and phone numbers
• an inferred salary estimate

If these providers include sensitive fields such as gender or date of birth, we discard them; we do not store them.

We use this data to verify that participants are who they say they are, to match participants to studies, and to build the professional profile researchers see. Because this data does not come from you directly, this section serves as the notice required by GDPR Article 14. If you want this data corrected or deleted, contact us (Section 17).

Panel providers. When you arrive from an external research panel, the panel sends us a participant identifier and, depending on the panel, basic demographic attributes for matching.

Sign-in and connected services. If you sign in with Google or connect an integration (for example, a video conferencing, calendar, design, or survey tool), we receive your basic account details and the access tokens needed to run the integration. We use data from Google APIs only to provide the connected feature and in line with the Google API Services User Data Policy, including its Limited Use requirements.

AI tools. If you connect an AI tool to CleverX, we receive the requests it makes on your behalf, and sign-in runs through our authentication provider, WorkOS (Section 15).

Payment providers. Our payment and payout providers send us confirmation and status data about payments and payouts. We do not store full card numbers.

4. Recordings, transcripts, and AI processing

This section matters most for participants. Read it before joining a study that involves audio or video.

Recording is automatic. All live video sessions on CleverX are recorded, including human-moderated interviews and AI-moderated interviews. AI-moderated interviews also capture your voice, and video where the study uses your camera. Unmoderated tests and video diaries record your screen, voice, and camera as the study specifies. Recordings are stored as video and audio files on our servers.

You will be asked to consent before a recorded session starts. If you do not consent, you cannot take part in that session. You can stop a session at any time; what was recorded up to that point is retained under Section 9 unless you ask us to delete it.

Observers. Members of the researcher's team may observe a live session, and observers may not be visible to you in the call. The researcher's team can also watch the recording afterward.

Transcription and AI processing. Recordings are transcribed automatically. Transcripts and recordings are processed by AI systems to moderate interviews, generate summaries, extract themes, and produce analysis for the researcher. This processing uses third-party transcription and AI model providers, listed on our Subprocessor List. AI outputs (summaries, labels, suggested skills or industries, embeddings used for matching) are stored alongside your data. We do not permit the AI providers CleverX uses for this processing to use your recordings or transcripts to train their models. That commitment covers CleverX's own providers; AI tools a researcher chooses to connect to CleverX for their own use are covered in Section 15.

5. Why we use your data, and our legal bases

For people in the EEA, UK, or Switzerland, GDPR requires a lawful basis for each use. Here is the mapping.

We do not seek out special-category data, and we discard sensitive fields (such as gender or date of birth) if enrichment providers include them. Where a researcher's study asks you sensitive questions (for example, health or demographic questions), answering is voluntary and that processing is based on your explicit consent given within the study.

CleverX does not enter into HIPAA business associate agreements and is not designed to hold protected health information. Researchers may not use CleverX to collect protected health information as defined by HIPAA.

6. What researchers see

If you participate in a study, the researcher running it receives:

• your professional profile as shown on CleverX (including enrichment-derived fields)
• your screener answers and study responses
• recordings and transcripts of your sessions for that study, plus AI-generated summaries and analysis

Researchers do not receive your payout details, your device fingerprint, or your fraud-prevention data. Researchers agree to use participant data only for their research purposes, but once they receive it they are responsible for it under their own policies.

Researchers may also analyze study data with AI tools they choose, including AI assistants they connect to CleverX (Section 15). Those tools receive your name only as CleverX shows it to the researcher (first name and last initial, or a pseudonym), and never your contact details.

7. Who else we share data with

Service providers (subprocessors). We use third-party providers to run the platform, in these categories:

• Hosting and storage (United States)
• Video session infrastructure and recording
• Transcription and AI model providers
• Payment processing and reward payouts
• Analytics and product improvement
• Email, SMS, and customer support
• Fraud prevention and device fingerprinting
• Professional-profile data providers
• External research panels
• Sign-in for AI tools and API access (WorkOS)

The current list of named providers is always at our Subprocessor List; we update that page when providers change. Each provider is bound by contract to process data only on our instructions.

Researchers, as described in Section 6.

AI tools researchers connect. Data a researcher requests through an AI tool goes to that tool's provider under the researcher's terms with it (Section 15). These providers are not our subprocessors.

Legal and safety. We disclose data when the law requires it, to enforce our terms, or to protect the rights and safety of users and others.

Business transfers. If we are acquired or merge, your data may transfer to the new owner under this policy's protections, and we will notify you.

We do not sell personal information. No one pays us for your data. Under some US state laws, using third-party analytics cookies can count as "sharing" personal information for cross-context advertising. To be safe and honest: our analytics tools receive usage data about you, and we treat opt-out requests as covering this (Section 11). We do not run advertising networks or ad targeting on personal data.

8. International transfers

Our servers are in the United States. We do not currently offer EU data residency. If you are in the EEA, UK, or Switzerland, your data is transferred to the US. We rely on the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss recognition where applicable, for these transfers.

9. How long we keep data

We keep personal data only as long as we need it for the purposes in this policy. Apart from the logs marked below, which expire automatically, we do not delete the data in this table on a schedule: we delete or de-identify it when you ask us to (for study data, together with the researcher who controls it), when a researcher asks us to delete their study data, and when the law requires it.

What account deletion does today. When you delete your account, we close it: your email and public identifiers are replaced with an anonymized placeholder, so researchers and other users can no longer identify you. Your profile is kept in this closed, anonymized state — and remains reversible if the deletion was a mistake — until we permanently delete it when you ask us to erase your data at sharekh@cleverx.com, which we honor where the law allows. Permanent deletion also removes your name and contact details from the studies you took part in. The responses and recordings themselves belong to those researchers' studies; we pass requests to delete them to the researcher, who controls that data. Records we must keep (payments, fraud signals, legal holds) are retained in restricted form.

10. Your rights (EEA, UK, Switzerland)

You have the right to:

• Access the personal data we hold about you (Art. 15)
• Correct inaccurate data (Art. 16)
• Erase your data (Art. 17)
• Restrict processing (Art. 18)
• Portability: receive your data in a machine-readable format (Art. 20)
• Object to processing based on legitimate interests, including enrichment and analytics (Art. 21)
• Not be subject to solely automated decisions with significant effects, and to obtain human review (Art. 22, see Section 12)
• Withdraw consent at any time, including consent to recording, without affecting past processing

To exercise these rights, email sharekh@cleverx.com. We respond within one month. You can also complain to your local supervisory authority.

11. Your rights (US states)

If you live in California, Colorado, Connecticut, Utah, Virginia, or another state with a comprehensive privacy law, you have the right to:

• Know and access the personal information we collect about you
• Delete it (see Section 9 for what deletion does)
• Correct inaccurate information
• Opt out of "sharing" or targeted-advertising uses. We honor the Global Privacy Control (GPC) browser signal as an opt-out.
• Non-discrimination for exercising your rights
• Appeal a refused request: reply to our decision and a different reviewer will reconsider within the timeline your state's law sets

California residents: the categories we collect are identifiers, professional and employment information, education information, commercial information, internet activity, approximate geolocation, audio and visual data (recordings), inferences, and characteristics of protected classifications only where you choose to provide them in a study. Sources, purposes, and recipients are as described in Sections 3 to 7. We do not sell personal information and we do not knowingly collect data from anyone under 18.

Submit requests to sharekh@cleverx.com or support@cleverx.com. We will verify your identity before acting.

12. Automated decision-making

We use automated fraud detection. Device fingerprinting links devices and accounts; accounts that match fraud patterns (for example, clusters of linked accounts, VPN or virtual-machine signals, or links to a banned account) may be automatically restricted or removed from studies. This can affect your ability to earn rewards.

If you are in the EEA or UK and an automated decision significantly affects you, you can request human review, express your point of view, and contest the decision. Email sharekh@cleverx.com. We extend the same review to all users on request.

13. Children

CleverX is for professionals aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has an account, contact us and we will delete it.

14. Cookies

We use cookies and similar technologies for sign-in, security, preferences, and analytics. Details, including how to manage them, are in our Cookie Policy at /cookie-policy.

15. AI tools and API access

Researchers can connect CleverX to an AI assistant or other application they choose, for example Claude (made by Anthropic) or ChatGPT (made by OpenAI), through our MCP server at mcp.cleverx.com or with an API key. We call these "AI tools". This section explains what data moves, who handles it, and what we keep.

Who can connect. Only a researcher whose workspace is on a paid plan can connect an AI tool, by signing in to CleverX from it and choosing one workspace: their personal workspace or a team in which they are an Owner, Admin or Researcher. Team Observers can't connect AI tools. An AI tool sees only what that researcher can see in that workspace. Sign-in for AI tools runs through WorkOS, our authentication provider: when you connect, we send WorkOS your CleverX user ID, email address, first and last name, and the names of the workspaces you can choose from, and WorkOS keeps a record of you and of the AI tools you have authorized.

What an AI tool can receive. When the researcher asks it to, an AI tool can receive:

• studies and their setup: titles, descriptions, questions, screeners, tasks, targeting, status, recruitment progress and schedules;
• study results: survey and screener answers, usability task results (including the addresses of web pages participants reached in website tests), transcripts, highlights, and CleverX's AI analysis (themes, quotes and findings);
• participants, labelled as the researcher sees them in CleverX: first name and last initial where the study shows participants' names, otherwise a pseudonym such as "Participant_4821"; plus status, recruitment source and, on request, industry, skills and languages;
• study activity: what happened in a study and when, with teammates and participants named the same way;
• for workspace Owners and Admins, or in your own personal workspace: credit and wallet balances, plan, study costs, incentive totals and payout counts;
• your own account: your name, email address and workspace.

Answers, transcripts and other free text are passed on as participants wrote or said them, so they can contain anything a participant chose to share.

What an AI tool never receives. Participants' email addresses, phone numbers, LinkedIn profiles, employer or location fields, and payout details; recordings and other media files; passwords, access tokens and API keys; device fingerprints and fraud-prevention data.

What an AI tool can do. Read the data above, and create and edit draft studies. It can't buy credits, change account or team settings, or contact participants. Where CleverX has given a researcher early access and their workspace has turned it on, a separately connected AI tool can also launch a study and approve responses, each after a confirmation step. These actions work exactly like the same actions in CleverX, and the approval step shows the payout for each response.

Other services involved. Some drafting steps use the same services CleverX itself uses: location searches go to Mapbox; consumer audience estimates and filter checks go to Prolific, which may hold an unpublished draft of the study; and business audience counts use Typesense. As with any study you create in CleverX, creating a draft notifies our team and records a product-analytics event. These providers are listed on our Subprocessor List.

Where the data goes, and who is responsible for it. Data an AI tool requests from CleverX is sent to that AI tool's provider and is handled under the researcher's agreement with that provider and the provider's privacy policy (for example Anthropic's or OpenAI's). The researcher chooses and controls the AI tool. Its provider is not our subprocessor, and we don't process data on the provider's behalf. Copies of CleverX data in a researcher's AI conversations are outside CleverX's retention and deletion: deleting data in CleverX doesn't delete what an AI tool already received. Researchers should check their AI tool's data settings, including whether the provider may use their conversations to train its models; our Customer Terms require settings that don't allow that for participant data unless participants have agreed.

What we receive from an AI tool. The requests it makes on the researcher's behalf: which tool it used and the details of the request (for example a study ID, a search term, or the content of a draft it was asked to create). We don't ask for or receive the researcher's conversation history, the AI tool's memory, or files uploaded to it, and we don't store locale or location details an AI tool may include in a request.

What we keep.

We don't sell this data, use it for advertising, or use it to train AI models.

Your controls. You can disconnect an AI tool at any time in CleverX (Settings → AI tools) or in the AI tool itself. When you disconnect in CleverX, the AI tool loses access within five minutes, when its current access token expires. You can disable or delete API keys at any time. Deleting your account ends AI-tool access, and permanently deleting it also deletes your WorkOS sign-in record. To ask us to delete AI-tool records before they expire, email sharekh@cleverx.com.

If you are a participant. Researchers may use AI tools they choose to analyze study data (Section 6). Those tools receive your name only as CleverX shows it to the researcher, and never your contact details.

16. Changes to this policy

We will post changes here and update the date at the top. For material changes, we will notify you by email or in the app before they take effect.

17. Contact us

• Privacy requests: sharekh@cleverx.com
• Security issues and general support: support@cleverx.com (see /security)
• Mail: BluMatter, Inc., 131 Continental Drive, Suite 305, Newark, DE 19713