Data & Privacy

PREDICTEDBY.ME LTD, registered office 66 Paul Street, London, England, EC2A 4NA, company number 17558239, ICO registration [NUMBER]. Contact: hello@predictedby.me

When you answer a survey for a retailer, that retailer decides why your answers are collected and is responsible for them. We run the survey platform on its behalf.

If you agree, your phone camera is used while you look at a picture or advert. The camera image is analysed on your phone only. No video or photo is recorded, saved or sent to us.

Only these numbers leave your phone:

• how many moments your gaze was in each of nine areas of the screen (an approximate estimate, not exact eye tracking);

• a timeline of facial movement signals, such as smile strength or brow movement;

• a calibration accuracy percentage;

• your answer to any follow-up question, and basic device information.

We do not use this to identify you, and we do not draw conclusions about your health, personality or emotions as facts. Results are estimates and are shown to the retailer as combined patterns.

To avoid repeating set-up every time, your phone keeps a small calibration file in its own browser storage (valid for 180 days, same device only). We keep a simple record that you completed calibration and your accuracy score. The calibration file is never uploaded.

• Attention studies: your explicit consent (UK GDPR Art 6(1)(a) and, as a precaution, Art 9(2)(a)). You can say no and still use the app. You can withdraw at any time by closing the study or contacting us.

• Other surveys and accounts: contract (Art 6(1)(b)) and the retailer's legitimate interest in market research (Art 6(1)(f)).

• Voice and video interviews: consent.

The retailer who asked you the questions. Our service providers, who only act on our instructions: [If required you can ask to see the sub-processor list in the records-of-processing document]. We do not sell your data.

The attention page loads software from two third-party servers (jsdelivr and Google Cloud Storage), so those servers see your IP address and browser details when the page loads.

Some providers are outside the UK. Where so, we rely on the UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to EU standard clauses. [Providers outside of the UK are listed our sub-processors document]

• Attention study numbers and calibration records: 180 days after the study closes, then deleted automatically.

• Survey answers: are kept for up to 12 months or shorter as defined by the retailer..

• Account data: while the account is open plus [6] years for accounting where needed.

You can ask to see, correct, delete, restrict or move your data, to object to processing, and to withdraw consent. Contact hello@predictedby.me ; we reply within one month. If the retailer is the controller we will pass your request on. You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Attention studies and surveys are for people aged 18 or over. We do not knowingly collect data from children.

We would like to use your camera to estimate which parts of the picture you look at and how your face reacts. Your video is analysed on your phone and is never recorded or sent. Only simple numbers are sent. You must be 18 or over. You can stop at any time.

Draft attachment to the Retailer DPA Outline, assembled from the Privacy notice and Attention Studies DPIA. It requires review against the service’s actual operation and the retailer’s instructions before it is agreed.

This schedule covers personal data processed on the retailer’s behalf. Retailer user account data, for which predictedby.me acts as controller, is outside this processor schedule.

Draft attachment supplied by predictedby.me. These statements describe the supplied security measures and require review against actual platform operation and provider configuration before agreement. Cryptographic standards, hosting locations and compliance arrangements below have not been independently verified.

The supplied reference to penetration testing and Cyber Essentials is a plan for 2026, not evidence of completed testing or certification. EU region pinning and regional routing capabilities do not establish that those configurations are enabled.

• Each customer's data is separated at the database level. Every request is scoped to the signed-in retailer, and database row-level security is switched on for our tables. Customers can't query each other's data.

• The database service key is held only in the server-side worker and is never sent to a browser or app.

• Sign-in uses expiring sessions. Passwords are stored only as salted PBKDF2 hashes, and session tokens are stored as SHA-256 hashes, not in readable form.

• Super admin access is a separate login and session type, used only by named PREDICTEDBY.ME staff. Staff access is limited to what their role needs. MFA on admin and infrastructure accounts

• Requests are rate-limited, and the platform sets standard browser protections, including HSTS, a content security policy and frame blocking.

• Spend and service health are monitored, so unusual usage is flagged.

• Data in transit uses TLS (HTTPS) across the app, the API and every sub-processor connection.

• Data at rest in the database and file storage is encrypted by our hosting providers (Supabase and Cloudflare).

• Supabase compliance artifacts: Both a signed Data Processing Addendum (DPA) and Standard Contractual Clauses (SCCs) are legally integrated into their terms to govern international data flows. Data can be pinned strictly to EU-based AWS regions (e.g., Frankfurt or Stockholm) to preserve regional compliance.

• Cloudflare compliance artifacts: Supported by the standard Cloudflare Security Exhibit and regional routing rules (Data Localization Suite) to limit where payloads are evaluated.

• Respondents are identified by an ID, not by name. Names and contact details are not sent to AI providers.

• Retention periods are configurable. For example, attention-study numbers are deleted automatically after a set period (default 180 days), and old question-log rows are deleted where a retention is set.

• On a customer's request, or when a contract ends, we delete or return customer data within 30 days. Individuals can ask us to erase their data at hello@predictedby.me. There is no self-serve delete button today, so this is a manual process

• Backups are kept for 365 days and then expire.

• We keep an incident log and investigate any suspected breach straight away.

• We tell affected customers without undue delay, and within 48 hours of becoming aware of a personal data breach affecting their data. This lets them meet their own 72-hour duty to notify the ICO.

• If we are the controller, we notify the ICO within 72 hours where the breach is likely to risk people's rights, and tell the individuals affected where the risk is high.

• Our notice covers what happened, what data is affected, the likely impact, and what we are doing about it.

• Sub-processors are recorded in our sub-processor register, are bound by written agreements, and customers get at least 30 days' notice of changes.

• We review security measures annually. Penetration testing is planned for later this year 2026 as Cyber Essentials certification.

What: a respondent views a picture or advert on their phone. On-device software estimates which of nine screen regions they look at and facial movement signals. Only numbers are sent to our server.

Who: retailers (controller) commission studies; PREDICTEDBY.ME LTD processes. Respondents are adult customers of the retailer.

Data sent: gaze counts per region, expression signal timeline, calibration percentage, optional answer, device info. Not sent or stored: video, photos, face images, the landmark data, the calibration model (kept in the phone's browser for 180 days).

Scale: 100 respondents per study, 50 studies a year.

The numbers cannot identify a person and are not used to recognise anyone. Special category treatment under Art 9 applies only to biometric data processed to uniquely identify. As a precaution we still obtain explicit consent.