Privacy Policy

How Flock Hub collects, uses, and protects your personal data

Effective Date: 5 May 2026

Version: 1.3 — Corporate entity: Flock Hub Ltd; registered office (Bristol)

Flock Hub Ltd (company no. 17199622)  |  support@flockhub.ai

Registered office: 33 Cleeve Park Road, Bristol, BS16 6DW, England

1. Who We Are

The Flock Hub platform is operated by Flock Hub Ltd, a company registered in England and Wales (company number 17199622). References to “Flock Hub”, “we”, “us”, or “our” in this policy refer to Flock Hub Ltd.

Registered office: 33 Cleeve Park Road, Bristol, BS16 6DW, England.

We operate the Flock Hub platform, an AI-powered user research tool that enables clients to conduct automated conversational interviews with research participants.

For the purposes of UK GDPR and the Data Protection Act 2018, Flock Hub Ltd is the Data Controller in respect of personal data collected via the Flock Hub platform.

Contact: support@flockhub.ai

2. Who This Policy Applies To

This Privacy Policy applies to three distinct groups of individuals:

  • Clients — businesses and individuals who subscribe to Flock Hub and use the platform to conduct research

  • Participants — individuals who are invited by Clients to complete AI-powered research interviews

  • Visitors — individuals who visit our website at flockhub.io

Where this Policy applies differently to each group, this is clearly stated.

3. Data We Collect

3.1 Client Data

When you register for and use Flock Hub as a Client, we collect:

  • Account information: name, email address, company name, job title

  • Billing information: billing address, payment method details (processed securely by our payment provider; we do not store card numbers)

  • Platform usage data: studies created, interviews configured, sessions run, feature usage

  • Communications: support requests, feedback, and correspondence with us

  • Technical data: IP address, browser type, device information, login timestamps

3.2 Participant Data — General

When a Participant completes a research interview on Flock Hub, we may collect:

  • Conversation transcripts: the full text of the AI-conducted interview

  • Structured responses: answers to defined questions within the interview

  • Metadata: session duration, completion status, timestamps

  • Inferred data: sentiment analysis, themes, and patterns extracted by our AI analysis engine

Participants do not need to create an account to complete an interview. Interview links are shared by Clients directly.

3.3 Participant Email Addresses — Participant ID Feature

Where a Client has enabled the Participant ID (Email) feature on their interview, participants will be asked to provide their email address before or at the start of the interview.

This feature is optional for Clients and must be deliberately enabled per interview. It is designed solely to allow Clients to verify which specific individuals have completed an interview, for the purpose of distributing research incentive payments outside the Flock Hub platform.

What we collectEmail address provided by the participant at the point of interview entryPurposeParticipation verification: to associate a completed interview session with a specific individual, enabling the Client to confirm completion and process incentive paymentsLegal basisLegitimate Interests (Article 6(1)(f) UK GDPR): the processing is necessary for the legitimate interests of the Client and Flock Hub, and these interests are not overridden by the participant's rights given the limited, clearly communicated purpose of collectionRetention90 days following the closure or deletion of the associated study, or upon deletion of the Client account — whichever occurs first. After this period, email addresses are permanently deleted.

Participant email addresses are not used for marketing, profiling, or any purpose beyond participation verification. They are not shared with any third party other than the Client who initiated the interview.

Participant notice at point of collection

“Your email address is collected by [Client Name] using Flock Hub to verify your participation and arrange your research incentive payment. It will not be used for marketing. To exercise your data rights, contact support@flockhub.ai.”

4. How We Use Personal Data

PurposeLegal BasisApplies ToProviding the Flock Hub platform and contracted servicesContract performance (Art. 6(1)(b))ClientsProcessing subscription paymentsContract performance (Art. 6(1)(b))ClientsParticipant interview analysis and insight generationLegitimate interests (Art. 6(1)(f))ParticipantsParticipation verification for incentive distributionLegitimate interests (Art. 6(1)(f))Participants (where feature enabled)Platform security, fraud prevention, and abuse detectionLegitimate interests (Art. 6(1)(f))AllCustomer support and communicationsContract performance / Legitimate interestsClientsImproving and developing our platformLegitimate interests (Art. 6(1)(f))AllLegal compliance and regulatory obligationsLegal obligation (Art. 6(1)(c))All

5. Data Sharing and Disclosure

We do not sell personal data. We share personal data only in the following circumstances:

5.1 Between Clients and Flock Hub

Clients access participant interview data (transcripts, analysis, and — where enabled — participant email addresses) through their Flock Hub dashboard. This data sharing is inherent to the service and is subject to Clients' own obligations under UK GDPR as data controllers.

5.2 Service Providers (Data Processors)

We use carefully selected third-party service providers who process data on our behalf. All processors are contractually bound to process data only on our instructions and to apply appropriate security measures. Current processors include:

  • Cloud infrastructure and database hosting: Supabase

  • AI processing: OpenAI / Anthropic (interview conversation engine and analysis)

  • Payment processing (billing and subscription management): Stripe Technology Company, Limited — Ireland (EU)

  • Email delivery (transactional emails and notifications): Sendinblue SAS (Brevo) — France (EU)

5.3 Legal Disclosure

We may disclose personal data where required to do so by law, court order, or regulatory authority, or where we believe in good faith that disclosure is necessary to protect our legal rights or prevent harm.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business assets, personal data may be transferred to the relevant third party, who will be required to handle it in accordance with this policy.

6. International Data Transfers

Some of our service providers (including AI processing providers) may process data outside the UK and European Economic Area. Where such transfers occur, we ensure they are subject to appropriate safeguards, including:

  • UK International Data Transfer Agreements (UK IDTAs) or equivalent addenda

  • EU Standard Contractual Clauses (SCCs) where applicable

  • Transfer to countries or territories covered by UK adequacy regulations (including the EU)

Payments (Stripe): Transfers in connection with payment processing by Stripe Technology Company, Limited are safeguarded by the UK International Data Transfer Addendum (UK IDTA) incorporated into Stripe's Data Processing Addendum.

Email (Brevo): Transactional email delivery by Sendinblue SAS (Brevo) in France relies on the UK's adequacy decision for the European Economic Area; no additional transfer mechanism is required for that processing.

7. Data Security

We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, or alteration. These include:

  • Encryption in transit (TLS) and at rest

  • Access controls and authentication requirements

  • Regular security reviews and vulnerability assessments

  • Incident response procedures

No method of transmission over the internet is 100% secure. In the event of a personal data breach that poses a risk to individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours and affected individuals as required by law.

8. Data Retention

Data CategoryRetention PeriodBasisClient account dataDuration of subscription + 6 yearsLegal / contractual obligationsInterview transcripts and analysisDuration of Client subscription + 90 daysContract performanceParticipant email addresses (Participant ID feature)90 days from study closure or account deletionLegitimate interests (time-limited)Billing records7 yearsUK tax and accounting lawTechnical logs90 days rollingSecurity and fraud preventionSupport communications3 years from last contactLegitimate interests

9. Your Rights

Under UK GDPR, individuals have the following rights in relation to their personal data:

  • Right of access: to request a copy of the personal data we hold about you

  • Right to rectification: to request correction of inaccurate or incomplete data

  • Right to erasure: to request deletion of your personal data in certain circumstances

  • Right to restriction: to request that we limit how we use your data in certain circumstances

  • Right to data portability: to receive your data in a structured, machine-readable format (where processing is based on consent or contract)

  • Right to object: to object to processing based on legitimate interests

  • Right not to be subject to solely automated decision-making with legal or similarly significant effects

How to Exercise Your Rights

Submit requests to: support@flockhub.ai

We will respond within one month. We may need to verify your identity before processing your request. There is no charge for exercising your rights, except where requests are manifestly unfounded or excessive.

Right to Complain

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at any time. You can contact the ICO at: ico.org.uk or by telephone on 0303 123 1113.

10. Cookies

Our website uses cookies to ensure the platform functions correctly and to understand usage patterns. We use:

  • Strictly necessary cookies: required for the platform to operate (no consent required)

  • Analytics cookies: to understand how visitors use our website (consent required)

You can manage cookie preferences via the cookie banner displayed on your first visit to our website, or by adjusting your browser settings.

11. Children's Data

Flock Hub is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at support@flockhub.ai.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify Clients by email and update the “Effective Date” at the top of this document. Continued use of Flock Hub after the effective date of any change constitutes acceptance of the updated policy.

Version history: v1.0 — Initial publication. v1.1 — Added Section 3.3 (Participant Email Address / Participant ID Feature) and updated Sections 4 and 8 accordingly. v1.2 — Company number and registered address; named Stripe and Brevo with locations and transfer mechanisms in Section 6. v1.3 — Data controller and operator: Flock Hub Ltd (17199622); registered office at 33 Cleeve Park Road, Bristol, BS16 6DW, England.

13. Contact Us

For any questions about this Privacy Policy or how we handle your data:

  • Email: support@flockhub.ai

  • Post: Flock Hub Ltd (17199622), 33 Cleeve Park Road, Bristol, BS16 6DW, England