Privacy Policy

Last updated: 22 September 2026

This Privacy Policy explains how DeepField AI SAS ("DeepField", "we", "us") processes personal data when you visit deepfield-ai.com, use the DeepField research platform at app.deepfield-ai.com (the "Platform"), take part in a study run on the Platform, or deal with us as a customer, prospect or supplier. It also explains the role we play in each case and how to exercise your rights.

1. Who we are and the role we play

DeepField AI SAS is a French simplified joint-stock company (société par actions simplifiée) with a share capital of EUR 2,001, registered with the Créteil Trade and Companies Register under number 994 497 782, with its registered office at 110 rue de Fontenay, 94300 Vincennes, France. You can reach us about privacy at contact@deepfield-ai.com. DeepField has not appointed a data protection officer; privacy requests are handled through this address.

We process personal data in two different roles.

DeepField as controller. We decide how and why personal data is processed for our website, our business relationships, the accounts of our customers' users, billing, support, the security of the Platform and the production of anonymised statistics. Section 2 describes that processing.

DeepField as processor. Our customers (research agencies, consultancies and companies, together "Customers") use the Platform to design and run studies. For study data, including participants' answers and recordings, the Customer (or the Customer's own client that commissions the study, the "Research Sponsor") decides why and how the data is processed. We act as a processor within the meaning of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), or as a sub-processor when the Customer itself acts on behalf of a Research Sponsor. We only process that data on the Customer's documented instructions, under a data processing agreement. Section 3 describes this processing.

If you take part in a study, the organisation that invited you and is named in the study's introduction or consent screen is responsible for that study. Its privacy notice applies in addition to this policy. The panel or recruitment company that invited you remains responsible for your panel membership and for paying any incentive.

2. Personal data we process as controller

  • Operating and securing the website. Personal data: IP address, browser and device information, pages viewed, date and time of access. Legal basis (GDPR): Legitimate interest in providing a secure website (Art. 6(1)(f)). Retention: Server and security logs: 12 months.

  • Website audience measurement and marketing cookies. Personal data: Cookie identifiers, browsing events. Legal basis (GDPR): Consent (Art. 6(1)(a)); see section 8. Retention: Consent choice: up to 13 months; related data: up to 25 months.

  • Answering enquiries, demo requests and managing business relationships with prospects. Personal data: Name, business email, phone number, company, job title, messages, meeting notes. Legal basis (GDPR): Legitimate interest in developing our business relationships (Art. 6(1)(f)); consent where required for electronic marketing. Retention: 3 years from the last contact initiated by the prospect.

  • Business-to-business prospecting by email or professional networks. Personal data: Name, business email, job title, company, professional profile information obtained from public professional sources and business data providers. Legal basis (GDPR): Legitimate interest (Art. 6(1)(f)). Messages relate to the recipient's professional role, and every message lets you object. Retention: 3 years from collection or from the last contact.

  • Providing the Platform to Customers and managing their users' accounts. Personal data: Name, business email, employer, role, login credentials, settings, permissions, actions performed in the Platform. Legal basis (GDPR): Performance of our contract with the Customer and our legitimate interest in managing its users' access (Art. 6(1)(b) and (f)). Retention: Duration of the Customer's agreement, then up to 12 months unless deletion is requested earlier.

  • Customer support and service communications. Personal data: Name, contact details, content of support requests, related usage information. Legal basis (GDPR): Performance of contract and legitimate interest (Art. 6(1)(b) and (f)). Retention: 3 years after the request is closed.

  • Improving the Platform through product analytics. Personal data: Pseudonymised usage events of Customer users (features used, errors, performance). Legal basis (GDPR): Legitimate interest in improving and fixing our services (Art. 6(1)(f)). Where analytics relies on cookies or similar technologies, see section 8. Retention: 25 months.

  • Invoicing, accounting and contract management. Personal data: Names and contact details of billing and signatory contacts, invoices, payment records, contracts. Legal basis (GDPR): Legal obligation (Art. 6(1)(c)) and performance of contract. Retention: 10 years for accounting records (French Commercial Code, Article L.123-22); contracts: 5 years after they end.

  • Security of the Platform and prevention of fraud and abuse. Personal data: Access logs, IP addresses, device signals, security events. Legal basis (GDPR): Legitimate interest in protecting our services, Customers and participants (Art. 6(1)(f)). Retention: 12 months, or longer where needed for an ongoing investigation.

  • Producing anonymised, aggregated statistics and benchmarks. Personal data: Study and usage data before it is irreversibly anonymised. Legal basis (GDPR): Legitimate interest (Art. 6(1)(f)) and, for Customer data, the Customer's authorisation in our contract. Retention: Personal data is deleted once anonymised. Anonymisation follows the criteria of the European data protection authorities, so that no Customer, participant or user can be singled out, linked or inferred.

  • Establishing, exercising or defending legal claims and complying with authorities' requests. Personal data: Data relevant to the matter. Legal basis (GDPR): Legal obligation and legitimate interest (Art. 6(1)(c) and (f)). Retention: Until the applicable limitation period expires.

Where we did not obtain your data from you, it comes from your employer (for Authorised User accounts), from public professional sources or business data providers (for prospecting), or from the Customer that runs a study (section 3). We do not sell personal data. We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on you.

3. Study participants: how we process data on behalf of Customers

This section applies if you answer a survey or interview hosted on the Platform. For this data, DeepField acts as a processor (or sub-processor) of the Customer that runs the study.

Data processed. Depending on how the study is designed, the Platform may process:

  • a pseudonymous participant identifier supplied by the panel or recruitment company;

  • your answers to screening questions and to the questionnaire, including open-ended text;

  • voice or video recordings and their transcripts, only if you choose or agree to answer by voice or video;

  • technical and quality-control data: timestamps, completion time, device and browser type, IP address and approximate location derived from it, answer-consistency and duplicate-participation signals;

  • professional information requested by the study (for example, a medical specialty);

  • where the Research Sponsor has a valid legal basis, which is your explicit consent under Article 9(2)(a) GDPR, special categories of data such as health information.

Customers are required not to collect your name, email address or phone number through the Platform unless the study genuinely needs them and you have been informed.

Purposes. The data is processed to administer the study, show you the questions, ask follow-up questions, check data quality, transcribe and analyse answers, and produce results for the Customer and the Research Sponsor. Results are normally reported in aggregated form.

Use of artificial intelligence. The Platform uses AI systems to ask follow-up questions (AI moderation), transcribe recordings, code open-ended answers and help researchers analyse the results. When a question is asked by an AI interviewer, the study tells you so. Quality-control checks may flag a response, but a researcher reviews the flags before a response is excluded. AI is not used to identify you. Voice or video recordings are not used for biometric identification, and the Platform does not infer your emotions or personal characteristics from your voice, face or writing.

What we send to AI model providers. We send only the content needed for the task (for example, the question and your answer), linked to pseudonymous identifiers. We do not send your name, email address or phone number. Our AI model providers act as our sub-processors under data processing agreements. They are contractually prohibited from using this data to train or improve their models. They may keep it only for the limited period set out in their terms, solely to monitor abuse, after which it is deleted. Some of these providers process data outside the European Economic Area (section 5).

Retention. Study data is kept for as long as the Customer instructs. It is deleted or irreversibly anonymised on the Customer's instruction and, in any event, when the Customer's agreement with DeepField ends, after the data-export period provided in that agreement. Backup copies are deleted automatically at the end of the backup retention cycle.

Your rights and choices. Taking part is voluntary. You can stop at any time and skip questions where the study allows it. To access, correct or delete your study data, or to object to its processing, contact the organisation named in the study's introduction or consent screen. You can also write to contact@deepfield-ai.com: we will forward your request to the relevant Customer without undue delay and help it respond. Once results have been aggregated or anonymised, they can no longer be linked to you and cannot be withdrawn from reports already delivered.

4. Who receives personal data

Personal data is shared only with those who need it:

  • authorised DeepField personnel bound by confidentiality obligations;

  • our sub-processors and service providers, in the following categories: cloud hosting and infrastructure, application delivery, AI model and speech-processing providers, monitoring and product analytics, customer support and communication tools, and business software (email, customer relationship management, e-signature, accounting). The current list of sub-processors used for the Platform is published in our Trust Center at trust.deepfield-ai.com;

  • for study data, the Customer that runs the study and, through it, the Research Sponsor;

  • panel and recruitment companies, limited to what they need to record your participation status (for example, complete, screened out or over quota) against your pseudonymous identifier;

  • professional advisers, auditors and insurers, under confidentiality obligations;

  • public authorities and courts, where required by law;

  • a buyer or successor in the event of a merger, acquisition or sale of assets, subject to the protections described in this policy.

5. International transfers

Platform data is hosted in the European Union. Some sub-processors, in particular AI model providers and certain software providers, may process personal data outside the European Economic Area, including in the United States. Where the destination country does not benefit from an adequacy decision of the European Commission, transfers are protected by the European Commission's Standard Contractual Clauses, together with additional measures where needed. Transfers to United States companies certified under the EU-U.S. Data Privacy Framework rely on the corresponding adequacy decision. You can request a copy of the relevant safeguards at contact@deepfield-ai.com.

6. Security

DeepField's security controls are audited under a SOC 2 Type II report. Measures include encryption of data in transit and at rest, role-based access controls and least-privilege access, multi-factor authentication for access to critical systems, logging and monitoring, restriction of each Customer's data to that Customer's authorised users, vendor due diligence and incident-response procedures. No system can be guaranteed to be fully secure. If a personal data breach occurs, we notify the competent supervisory authority and affected persons where the GDPR requires it, and we notify affected Customers without undue delay.

7. Your rights

Under the GDPR and the French Data Protection Act (loi n° 78-17 du 6 janvier 1978), you have the right to:

  • access your personal data and obtain a copy;

  • have inaccurate data corrected;

  • have your data erased;

  • restrict processing;

  • object to processing based on our legitimate interest, and object at any time to direct marketing;

  • receive data you provided to us in a portable format, where processing is based on consent or contract;

  • withdraw your consent at any time, without affecting processing already carried out;

  • give instructions on what happens to your data after your death.

For data we process as controller (section 2), send your request to contact@deepfield-ai.com. We may ask for information to verify your identity. We answer within one month, which may be extended by two months for complex requests; we will tell you if that happens. For study data (section 3), see "Your rights and choices" above.

You can also lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the supervisory authority of the country where you live or work.

8. Cookies and similar technologies

We use cookies and similar technologies on our website and the Platform.

  • Strictly necessary cookies keep you signed in, secure the service, save your progress in a survey and prevent duplicate participation. They do not require consent.

  • Audience measurement and marketing cookies are used on our website only if you accept them through the cookie banner, which lets you refuse them as easily as you accept them. You can withdraw or change your choice at any time through the cookie settings link at the bottom of the website.

  • On the Platform, we use only strictly necessary technologies and, where applicable, audience-measurement technologies that are exempt from consent under the guidance of the CNIL. Otherwise we ask for your consent. Quality and duplicate-participation checks read limited device characteristics solely to protect the integrity of the study you chose to take part in.

Your cookie choice is kept for up to 13 months, after which we ask again. Cookies subject to consent have a maximum lifetime of 13 months, and the data collected through them is kept for up to 25 months.

9. Children

Our website and the Platform are intended for professionals and for adult study participants. We do not knowingly collect personal data from anyone under 18 outside a study. A Customer that invites people under 18 to a study must ensure that the study is lawful, that it has the consent of a parent or guardian where required, and that it follows applicable research codes.

10. Changes to this policy

We may update this policy to reflect changes in our services or in the law. The date at the top shows the latest version. If we make material changes, we will inform Customers and, where appropriate, other affected persons before the changes take effect.

11. Contact

DeepField AI SAS, 110 rue de Fontenay, 94300 Vincennes, France. Email: contact@deepfield-ai.com.