1. Who we are
Zone of Truthis an AI-moderated customer-discovery tool for founders and businesses. This Privacy Policy explains how we handle personal data. For the data described in Section 3 as “controller” data, the data controller is Tomasz Gancarczyk, a sole trader established in Poland, operating Zone of Truth.
2. What we collect
- Account data — your email address, name, and organization details when you create or join an account.
- Waitlist data — the name, email, company, role, and use-case you provide when you request access to the beta.
- Interview / respondent data — transcripts, answers, and any personal data collected during interviews that our customers run with their respondents.
- Technical and usage data — log data, device and browser information, and product-usage events needed to operate and secure the service.
3. Our roles: controller and processor
We are the data controller for account data, waitlist data, and technical/usage data — we decide how and why that data is processed.
For interview and respondent data that our customers collect, we act as a data processoron the customer’s behalf. The customer is the controller and is responsible for the lawful basis and respondent notices; we process that data only on their documented instructions under a data processing agreement. If you are a respondent, please contact the organization that invited you to exercise your rights over that data; we will assist them as their processor.
4. Lawful bases
Where we act as controller, we rely on the following lawful bases under the GDPR:
- Contract — to provide the service to you and administer your account;
- Legitimate interests — to operate, secure, and improve the service, and to manage our beta waitlist, balanced against your rights;
- Consent — where we ask for it, for example certain waitlist or marketing communications, which you can withdraw at any time; and
- Legal obligation — where processing is required to comply with the law.
5. How we use data
We use personal data to provide and secure the service, authenticate sign-in, run and improve AI-moderated interviews on behalf of customers, communicate with you, manage the beta waitlist, prevent abuse, and comply with legal obligations. We do not sell personal data.
6. Sub-processors
We rely on trusted service providers to run Zone of Truth. Each processes personal data on our behalf under appropriate contractual terms:
- Neon / Postgres — database hosting;
- Resend — transactional email delivery;
- Vercel — application hosting and analytics;
- PostHog (EU Cloud, hosted in Frankfurt) — product analytics and, with your consent, session replay;
- OpenAI and Anthropic — AI model providers powering the interviewer;
- Stripe — payment processing;
- Braintrust and E2B — AI evaluation and sandboxed execution.
7. International transfers
Some sub-processors may process data outside the European Economic Area. Where they do, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.
8. Retention
We keep personal data only as long as needed for the purposes above or as required by law:
- Account data — kept for the life of your account and erased within 30 days of account closure.
- Waitlist data — kept until you ask us to remove it or the beta program ends.
- Interview and respondent data — retained for the life of the relevant study or account and erased within 30 days of a verified deletion request or account closure. As controller, the customer who ran the study can request earlier deletion at any time.
Where the law requires us to keep certain records longer, we retain only what is necessary for that purpose and for no longer than required.
9. Your rights
Where the GDPR applies, you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data (“right to be forgotten”);
- receive your data in a portable format;
- object to, or restrict, certain processing; and
- withdraw consent where processing is based on it.
To exercise these rights over data for which we are the controller, contact us at contact@zoneoftruth.com. You also have the right to lodge a complaint with your local data protection authority.
10. Cookies
We use only strictly necessary and functional cookies. See our Cookie Policy for details.
11. Security
We take appropriate technical and organizational measures to protect personal data, including hashing of authentication tokens, encryption of data in transit, and access controls. No system is perfectly secure, but we work to protect your data and to respond promptly to incidents.
12. Children
Zone of Truth is not intended for children. Accounts are restricted to adults, and customers must not use the service to interview or collect data from minors, as set out in the Acceptable Use Policy.
13. Changes to this policy
We may update this Privacy Policy from time to time. We will update the “last updated” date and, for material changes, provide additional notice.
14. Contact and data protection
For privacy questions or to reach our data protection contact, email contact@zoneoftruth.com. We have not appointed a Data Protection Officer, as we are not required to under GDPR Article 37; contact@zoneoftruth.com is the point of contact for all data-protection matters.