Privacy Notice

Effective · 2 April 2026  ·  Last updated · 2 April 2026

Section 1Introduction and scope

This Notice applies to:

• End Users / Interview Participants: individuals who participate in AI-led research interviews through our Platform;
• Clients (B2B Customers): companies and organisations that subscribe to Uploaded Minds, Inc’s services and whose end users participate in interviews;
• Website Visitors: individuals who visit dipio.ai or any of our subdomains; and
• Prospective Clients and Contacts: individuals who engage with us through enquiry forms, email, or other channels.

Section 2Data controller

2.1Our role

Uploaded Minds, Inc acts in a dual capacity with respect to personal data processing:

• As Data Processor: When we process personal data on behalf of our Clients for the purpose of delivering the contracted research services (including conducting interviews, generating transcripts, and producing deliverables), we act as a data processor under the instructions of the Client, who remains the data controller for such processing. This relationship is governed by the Data Processing Agreement (DPA) between Uploaded Minds, Inc and the Client.
• As Independent Data Controller: When we process personal data for our own purposes — including improving our AI models, training and developing our proprietary systems, enhancing our analytical capabilities, conducting internal research, and developing new products and features — we act as an independent data controller. In this capacity, we determine the purposes and means of processing independently of our Clients.

Section 3Personal data we collect

3.1Data collected from interview participants (End Users)

When you participate in an AI-led research interview through our Platform, we collect the following categories of personal data:

3.1.1Data you provide directly

• Identification Data: email address and, where provided, name or other identifiers.
• Voice and Audio Data: recordings of your voice during the interview, including acoustic features, speech patterns, and voice characteristics.
• Interview Responses: all verbal statements, opinions, experiences, preferences, and other information you share during the interview.
• Consent Records: records of the consents you provide (e.g., consent to participate, consent to recording, consent to model training).

3.1.2Data generated during the interview

• Transcripts: text transcriptions of the interview generated by AI systems.
• Behavioural Data: patterns, motivations, decision-making processes, psychological drivers, friction points, and other behavioural insights derived from your responses through AI-assisted qualitative analysis.
• Voice Biometric Data: voiceprints and acoustic features derived from your audio recordings that may be used for analysis purposes.
• Metadata: interview duration, timestamps, completion status, and technical session data.

3.1.3Incidental special category data

During unstructured interviews, you may voluntarily disclose information that constitutes special category data under Article 9 of the GDPR (also referred to as “sensitive personal data”), such as information about your health, religious beliefs, political opinions, ethnic origin, or sexual orientation. We do not intentionally solicit special category data. However, where you voluntarily provide such data during the interview, it will be processed as part of your interview responses. The legal basis for processing any incidentally collected special category data is your explicit consent, given by your affirmative acceptance of the End User Terms and your voluntary disclosure during the interview (Article 9(2)(a) GDPR).

3.2Data collected from Clients (B2B Customers)

• Business Contact Data: names, email addresses, job titles, and phone numbers of Client representatives and authorised users.
• Account and Subscription Data: subscription plan, billing information, payment history, and account preferences.
• Project Data: project briefs, target audience specifications, interview parameters, and brand materials provided for the purposes of configuring the Services.
• Communication Data: correspondence and records of interactions with Uploaded Minds, Inc.

3.3Data collected from website visitors

• Technical Data: IP address, browser type and version, operating system, device identifiers, and referring URL.
• Usage Data: pages visited, time spent, click paths, and interactions with the website.
• Cookie Data: information collected through cookies and similar technologies.

Section 4Purposes and legal bases for processing

The following table sets out the purposes for which we process personal data, the categories of data involved, and the legal basis under the GDPR:

4.1Legitimate interest assessment

Where we rely on legitimate interests as a legal basis, we have conducted a balancing test to ensure that our interests are not overridden by the rights and freedoms of data subjects. In particular, for the use of anonymised and aggregated data for AI model improvement and research, we have assessed that: (a) the processing is necessary for our legitimate interest in improving AI systems and developing innovative products; (b) data subjects reasonably expect that their anonymised data may be used for such purposes, as this is clearly disclosed in the End User Terms and this Notice; and (c) appropriate safeguards are in place, including irreversible anonymisation, data aggregation, and the ability of data subjects to object.

Section 5How we collect personal data

5.1Directly from you

We collect personal data directly from you when you participate in an interview, create an account, subscribe to our Services, contact us, or interact with our website.

5.2From our Clients

Our Clients may provide us with limited personal data about their end users for the purpose of inviting those individuals to participate in interviews. This typically includes email addresses. The Client is responsible for ensuring that it has the necessary legal basis (such as a pre-existing relationship with the end user) to share such data with us.

5.3Generated through the Services

We generate personal data through the operation of our AI systems, including transcripts, psychological and behavioural analyses, and derived insights. This data is generated from the content you provide during interviews.

5.4Automatically via cookies and similar technologies

We collect certain technical and usage data automatically when you visit our website.

Section 6Recipients and sharing of personal data

6.1Our Clients

We share interview-derived deliverables (insights reports, audience segmentation, behavioural analyses, and structured transcript data) with the Client who engaged us to conduct the research. We may also share email addresses and interview completion status for the purpose of enabling the Client to manage incentive payments to participants. Clients receive these deliverables in their capacity as data controllers and are bound by their own data protection obligations and, where applicable, by the Data Processing Agreement with Uploaded Minds, Inc.

6.2Sub-processors

We engage third-party service providers (sub-processors) to assist in delivering our Services. Each sub-processor processes personal data only on our instructions, under a binding data processing agreement, and subject to appropriate technical and organisational safeguards. Our current sub-processors include:

6.3Other recipients

We may also share personal data with: (a) professional advisers (legal, accounting, audit) under obligations of confidentiality; (b) public authorities, regulators, or courts where required by applicable law or to respond to lawful requests; (c) a successor entity in connection with a merger, acquisition, reorganisation, or sale of assets, provided the successor is bound by equivalent data protection obligations; and (d) any other recipient with your specific consent.

We do not sell personal data to third parties. We do not share personal data for third-party advertising purposes.

Section 7International data transfers

Certain sub-processors that are integral to our Services are located in the United States. This means that personal data collected through the Platform will be transferred to, and processed in, the United States.

7.1Transfer mechanisms

For transfers of personal data from the European Economic Area (EEA), the United Kingdom, or Switzerland to countries that have not received an adequacy decision from the European Commission, we rely on the following transfer mechanisms:

• EU Standard Contractual Clauses (2021 SCCs): We have entered into, or require our sub-processors to enter into, the Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), as supplemented by any necessary transfer impact assessments.
• EU-US Data Privacy Framework: Where a sub-processor is certified under the EU-US Data Privacy Framework, we may rely on such certification as a valid transfer mechanism.
• UK International Data Transfer Agreement / Addendum: For transfers from the United Kingdom, we utilise the UK Addendum to the EU SCCs or the UK International Data Transfer Agreement, as applicable.
• Swiss-US Data Privacy Framework / Swiss Transborder Data Flow Agreement: For transfers from Switzerland, we apply appropriate transfer mechanisms under the Swiss Federal Act on Data Protection.

7.2Transfer impact assessments

We conduct transfer impact assessments to evaluate the level of data protection in the recipient country and implement supplementary measures where necessary to ensure that transferred data receives an essentially equivalent level of protection.

Section 8Data retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention periods:

8.1Anonymisation

When retention of identifiable data is no longer necessary, we anonymise the data by removing direct identifiers (such as email addresses, name, or any other personal identifiers) and applying aggregation and other technical measures to render the data no longer attributable to an identified or identifiable natural person within the meaning of Recital 26 of the GDPR. Anonymised data is retained indefinitely for AI model training, product development, and research purposes, and is no longer subject to this Notice or the GDPR.

Section 9Your rights as a data subject

9.1Rights under the GDPR (EEA and UK)

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the GDPR / UK GDPR:

• Right of Access (Art. 15): You have the right to obtain confirmation of whether we process your personal data and, if so, to access a copy of that data together with supplementary information about the processing.
• Right to Rectification (Art. 16): You have the right to request correction of inaccurate personal data and completion of incomplete personal data.
• Right to Erasure (Art. 17): You have the right to request the deletion of your personal data, subject to applicable exceptions (e.g., legal obligations, defence of legal claims). Upon a valid erasure request, we will delete or anonymise your identifiable personal data. Data that has already been irreversibly anonymised and incorporated into aggregated datasets or derived AI models cannot be extracted or deleted, as it no longer constitutes personal data.
• Right to Restriction of Processing (Art. 18): You have the right to request that we restrict the processing of your personal data in certain circumstances (e.g., while the accuracy of data is contested).
• Right to Data Portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where processing is based on consent or contract and carried out by automated means.
• Right to Object (Art. 21): You have the right to object to processing based on legitimate interests (Article 6(1)(f)). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. In particular, you may withdraw your Model Training Consent at any time; however, data already anonymised and incorporated into models prior to withdrawal cannot be extracted.
• Right Not to Be Subject to Automated Decision-Making (Art. 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects concerning you. Our Services generate analytical outputs delivered to the Client; however, no automated decisions with legal or similarly significant effects are made about you based solely on automated processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the supervisory authority of your Member State of habitual residence, place of work, or place of the alleged infringement.

9.2Rights under the CCPA / CPRA (California, USA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”):

• Right to Know: You have the right to know what personal information we collect, use, disclose, and sell/share. You may request specific pieces of personal information collected about you.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to applicable exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: Uploaded Minds, Inc does not sell personal information as defined under the CCPA/CPRA. We do not share personal information for cross-context behavioural advertising. Therefore, no opt-out mechanism for sale or sharing is required at this time.
• Right to Limit Use of Sensitive Personal Information: To the extent we process sensitive personal information (as defined under the CCPA/CPRA), you may request that we limit its use to purposes permitted by applicable law.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

9.3Additional state privacy law rights (US)

Residents of other US states with comprehensive privacy legislation (including Virginia, Colorado, Connecticut, Utah, and others) may have similar rights to access, correct, delete, and opt out of certain processing. We will honour verified requests in accordance with the applicable state privacy law.

9.4How to exercise your rights

To exercise any of the rights described above, please contact us. We will verify your identity before processing your request. We will respond within the timeframes required by applicable law (generally 30 days under the GDPR, 45 days under the CCPA/CPRA, subject to extension where permitted).

Section 10AI transparency and automated processing

10.1AI-led interviews

Interviews conducted through our Platform are led by an artificial intelligence voice agent, not a human interviewer. The AI agent is powered by Uploaded Minds, Inc’s technology and utilises different voice synthesis capabilities.

10.2Automated analysis

Your interview recordings are transcribed and analysed using AI systems. The analysis includes psychological and behavioural pattern identification, thematic clustering, audience segmentation, and the generation of strategic insights.

10.3Model training

With your consent (obtained through the interview consent mechanism), anonymised and aggregated data derived from your interview may be used to train and improve Uploaded Minds, Inc’s proprietary AI models. This includes voice models, language models, and behavioural analysis models. When data is used for model training, it is first anonymised by removing direct identifiers and aggregating it with data from other participants. Once incorporated into a trained model, the data cannot be extracted or attributed to you.

10.4Synthetic audience replicas

Uploaded Minds, Inc is developing synthetic audience replica capabilities (“synthetic twin agents”). These are AI-generated simulations of aggregated behavioural patterns, trained on anonymised and aggregated interview data. Synthetic replicas do not reproduce any individual’s identity, voice, or likeness. They model generalised decision-making patterns and behavioural tendencies derived from large datasets.

10.5EU AI Act compliance

Uploaded Minds, Inc is committed to compliance with the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). Our AI-led interview system constitutes an AI system under Article 3(1) of the EU AI Act. We provide clear and timely disclosure to all interview participants that they are interacting with an AI system. We continuously monitor developments under the EU AI Act and will implement additional compliance measures as required, including in connection with the development of higher-risk AI capabilities such as psychometric profiling and synthetic twins.

Section 11Data security

Uploaded Minds, Inc implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption of data in transit and at rest.
• Access controls limiting data access to authorised personnel on a need-to-know basis.
• Secure cloud infrastructure with industry-standard certifications.
• Regular security assessments and monitoring.
• Sub-processor due diligence and binding data processing agreements.
• Incident response procedures for the detection, investigation, and notification of personal data breaches in accordance with GDPR Articles 33 and 34.

Section 12Children’s privacy

Our Services are not directed to individuals under the age of eighteen (18). We do not knowingly collect personal data from children. By participating in an interview, you confirm that you are at least 18 years of age or the age of majority in your jurisdiction, whichever is higher. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete such data promptly.

Section 13Cookies and similar technologies

We use cookies and similar tracking technologies on our website and Platform.

Section 14Changes to this notice

We may update this Privacy Notice from time to time to reflect changes in our processing activities, legal requirements, or business practices. When we make material changes, we will notify you by posting the updated Notice on our website and updating the “Last Updated” date. Where required by applicable law, we will provide additional notice (such as email notification or a prominent banner on our website). We encourage you to review this Notice periodically.

Section 15Supplemental notice for California residents (CCPA/CPRA)

This section applies to California residents and supplements the information provided in this Notice, as required by the CCPA/CPRA.

15.1Categories of personal information collected

In the preceding 12 months, we have collected the following categories of personal information (as defined by the CCPA/CPRA):

• Identifiers (e.g., name, email address, IP address).
• Audio, electronic, and visual information (e.g., voice recordings, interview audio).
• Internet or electronic network activity information (e.g., browsing history, interactions with our website).
• Inferences drawn from the above (e.g., behavioural profiles, preferences, psychological characteristics).
• Sensitive personal information (to the extent voluntarily disclosed during interviews): information revealing religious beliefs, health information, or other sensitive categories.

15.2Sources of personal information

We collect personal information from the following sources: (a) directly from you (e.g., during interviews, via our website); (b) from our Clients (e.g., email addresses for interview invitations); and (c) automatically through cookies and similar technologies.

15.3Business or commercial purposes

We use personal information for the purposes described in Section 4 of this Notice, which constitute business purposes under the CCPA/CPRA.

15.4Disclosure of personal information

We disclose personal information to the categories of recipients described in Section 6 of this Notice, including our Clients (for service delivery) and our sub-processors (for processing on our behalf). We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

15.5Retention

We retain personal information as described in Section 8 of this Notice.

Section 16Recording consent and wiretapping laws

The interviews conducted through our Platform involve the recording of audio conversations. We are committed to compliance with applicable recording consent laws, including:

• Two-Party / All-Party Consent Jurisdictions: In jurisdictions that require the consent of all parties to a conversation for lawful recording (including California, Illinois, and other US states, as well as various EU Member States), we obtain your explicit consent to recording before the interview begins, via the consent mechanism on the interview landing page.
• Illinois Biometric Information Privacy Act (BIPA): To the extent that our processing of voice data involves the collection of biometric identifiers or biometric information as defined under BIPA, we will comply with BIPA’s requirements, including providing a written retention and destruction policy and obtaining informed written consent prior to collection.
• ePrivacy Directive (2002/58/EC): Recording of electronic communications is conducted with your prior informed consent in compliance with the ePrivacy Directive and applicable national implementing legislation.

Section 17Contact us

If you have any questions, concerns, or requests regarding this Privacy Notice or our data protection practices, please contact us at:

We aim to respond to all enquiries within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the competent supervisory authority (see Section 9).

Section 18Supplemental notice for UK data subjects

For individuals located in the United Kingdom, references in this Notice to the “GDPR” should be read as references to the UK GDPR (the retained EU law version of the GDPR as it forms part of UK domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019). References to “supervisory authority” include the UK Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom (https://ico.org.uk).

Section 19Supplemental notice for Swiss data subjects

For individuals located in Switzerland, personal data is processed in accordance with the Swiss Federal Act on Data Protection (FADP, nDSG) and its implementing ordinance. References to “supervisory authority” include the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. Where data is transferred outside Switzerland, we rely on recognised transfer mechanisms, including the Swiss-approved Standard Contractual Clauses or adequacy decisions.