SortedResearch

Data protection & privacy

Last updated: 7 August 2026.

SortedResearch is built around a simple principle: collect as little personal data as possible. This page summarizes how we protect it and how we support your compliance obligations. The authoritative documents are our Privacy Policy and Data Processing Agreement.

Participants are anonymous by default

The platform does not ask study participants for names, email addresses, or any contact details. A participant's contribution is their card sorts, choices, screener answers, and timing/quality metadata, and nothing more, unless the researcher deliberately adds a screener question requesting identifying information (in which case the researcher, as controller, is responsible for it).

Participant-facing study pages are white-label, set no advertising or tracking cookies, and use only a functional one-response-per-device cookie to prevent duplicates.

Who controls what

Privacy law distinguishes the controller (decides why and how data is processed) from the processor (acts on the controller's instructions):

Data Controller Processor
Researcher account, billing, usage, and support/Graham data SortedResearch n/a
Participant study data collected through your studies You (the researcher / your organization) SortedResearch

Our processing of participant data on your behalf is governed by our DPA, which incorporates the EU Standard Contractual Clauses (Module Two, Controller-to-Processor) and the UK International Data Transfer Addendum for transfers from the EEA, UK, and Switzerland to the US. For CCPA/CPRA purposes we act as a service provider and do not sell or share personal information.

GDPR and CCPA operations are built into the product

These are working features, not policy promises:

  • Participant data access: export any single participant's complete raw data from the study dashboard, to answer a data-subject access request.
  • Workspace portability: admins can export their organization's full data set.
  • Deletion: closing an account starts a 30-day grace period (during which you can export), after which data is permanently purged by an automated daily job.
  • Retention schedule (from the Privacy Policy): account data up to 12 months after closure; billing data as required by tax law (typically 7 years); usage and Graham/support data up to 24 months; participant study data per the researcher's instructions.
  • Breach notification without undue delay, per the DPA.
  • Sub-processor change notice: at least 30 days' advance notice before adding or replacing a sub-processor.

Data minimization in practice

  • Participant survey pages set no advertising or tracking cookies — only a functional duplicate-prevention cookie. Advertising and analytics tags never run on the white-label participant flows.
  • On our marketing site and researcher app, analytics (Google Analytics 4) and advertising measurement (Google Ads) run only if the visitor accepts them. They are off by default via Google Consent Mode, and rejecting them costs no functionality. We also use cookie-free page analytics (Vercel Web Analytics). See the Cookie Policy.
  • Payment card numbers are never stored on our systems (Stripe handles all card data).
  • Panel-recruited participants are identified to us only by an opaque panel transaction code, never a name or contact detail.

Where data lives

Data is processed and stored in the United States by us and our sub-processors. International transfers from the EEA, UK, and Switzerland are protected by SCCs and the UK Addendum.

Your responsibilities as a researcher

Because you are the controller of your participant data, you remain responsible for having a lawful basis for what you collect, especially if you choose to collect identifying or sensitive information through screeners. Our Terms of Service and DPA set this out in detail.

Contact

Related: Privacy Policy · Terms · DPA · SLA · Cookies · Status