1. Who we are
Zone of Truthis an AI-moderated customer-discovery tool for founders and businesses. This Privacy Policy explains how we handle personal data. For the data described in Section 3 as “controller” data, the data controller is Tomasz Gancarczyk, a sole trader established in Poland, operating Zone of Truth.
2. What we collect
- Account data — your email address, name, and organization details when you create or join an account.
- Waitlist data — the name, email, company, role, and use-case you provide when you request access to the beta.
- Interview / respondent data — the profile a respondent provides (name, work email, role, organization), their answers, optional voice recordings and their transcripts, and the AI-generated interview summaries and research-fit assessments derived from them, collected during interviews that our customers run with their respondents.
- Technical and usage data — log data, device and browser information, and product-usage events needed to operate and secure the service.
3. Our roles: controller and processor
We are the data controller for account data, waitlist data, and technical/usage data — we decide how and why that data is processed.
For interview and respondent data that our customers collect, we act as a data processoron the customer’s behalf. The customer is the controller and is responsible for the lawful basis and respondent notices; we process that data only on their documented instructions under a data processing agreement. If you are a respondent, please contact the organization that invited you to exercise your rights over that data; we will assist them as their processor.
4. Lawful bases
Where we act as controller, we rely on the following lawful bases under the GDPR:
- Contract — to provide the service to you and administer your account;
- Legitimate interests — to operate, secure, and improve the service, and to manage our beta waitlist, balanced against your rights;
- Consent — where we ask for it, for example certain waitlist or marketing communications, which you can withdraw at any time; and
- Legal obligation — where processing is required to comply with the law.
5. How we use data
We use personal data to provide and secure the service, authenticate sign-in, run and improve AI-moderated interviews on behalf of customers, communicate with you, manage the beta waitlist, prevent abuse, and comply with legal obligations. We do not sell personal data, and we do not use interview or respondent data to train AI models.
6. AI processing and profiling
Interviews are conducted by an AI interviewer, and respondents are told this before they start and throughout the interview. If a respondent records audio, the recording is transcribed by an automated speech-to-text service; we do not analyze voice characteristics, infer emotions from audio, or use voice data to identify anyone.
After an interview, an AI system generates a structured summary for the research team that ran the study. It includes a research-fit category (how well the respondent matches the study’s target profile), an assessment of the strength of the evidence gathered, and verbatim quotes from the respondent’s own answers. These summaries are produced from the interview transcript and the study brief; they are research decision-support for a human reader, and our Terms prohibit customers from using them for decisions with legal or similarly significant effects (such as employment, credit, or eligibility decisions). Every AI-generated summary is marked as AI-generated. Respondents may ask the organization that invited them (the controller) for a copy of their interview data and summary, for an explanation of how the summary was produced, for correction, or for deletion — and we assist that organization as its processor. Respondents can also stop an interview at any time and discard their answers, which deletes them, including any recordings.
7. Sub-processors
We rely on trusted service providers to run Zone of Truth. Each processes personal data on our behalf under appropriate contractual terms:
- Neon / Postgres — database hosting;
- Resend — transactional email delivery;
- Vercel — application hosting, analytics, and audio file storage;
- PostHog (EU Cloud, hosted in Frankfurt) — product analytics and, with your consent, session replay;
- OpenAI and Anthropic — AI model providers powering the interviewer and insights features;
- ElevenLabs — speech-to-text transcription of voice answers;
- Stripe — payment processing;
- Braintrust and E2B — AI evaluation and sandboxed execution.
The current list, what each provider processes, and how we notify customers of changes are maintained on our Sub-processors page.
8. International transfers
We host product analytics in the EU (PostHog EU Cloud, Frankfurt) and configure EU processing regions for our infrastructure providers where they offer them. Some sub-processors (for example Stripe, Resend, and — depending on configuration — our AI providers) process personal data in the United States or other countries outside the European Economic Area. Where they do, we rely on the European Commission’s adequacy decisions (including the EU-US Data Privacy Framework for certified providers) and on Standard Contractual Clauses as a fallback, supported by transfer impact assessments. Details per provider are on the Sub-processors page.
9. Retention
We keep personal data only as long as needed for the purposes above or as required by law:
- Account data — kept for the life of your account and erased within 30 days of account closure.
- Waitlist data — kept until you ask us to remove it or the beta program ends.
- Interview and respondent data — retained while the relevant study and account remain active, subject to an automatic retention limit (by default, interviews and their audio recordings are deleted 24 months after they finish), and erased within 30 days of a verified deletion request or account closure. Deleting an interview also deletes its audio recordings. As controller, the customer who ran the study can delete individual interviews or studies at any time, and respondents who discard an interview have their answers and recordings deleted immediately.
Where the law requires us to keep certain records longer, we retain only what is necessary for that purpose and for no longer than required.
10. Your rights
Where the GDPR applies, you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data (“right to be forgotten”);
- receive your data in a portable format;
- object to, or restrict, certain processing; and
- withdraw consent where processing is based on it.
To exercise these rights over data for which we are the controller, contact us at contact@zoneoftruth.com. You also have the right to lodge a complaint with your local data protection authority.
11. Cookies
We use only strictly necessary and functional cookies. See our Cookie Policy for details.
12. Security
We take appropriate technical and organizational measures to protect personal data, including hashing of authentication tokens, encryption of data in transit, and access controls. No system is perfectly secure, but we work to protect your data and to respond promptly to incidents.
13. Children
Zone of Truth is not for anyone under 18. Accounts are restricted to adults (18+), respondents confirm they are 18 or older before starting an interview, and customers must not use the service to interview or collect data from minors, as set out in the Acceptable Use Policy.
14. Changes to this policy
We may update this Privacy Policy from time to time. We will update the “last updated” date and, for material changes, provide additional notice.
15. Contact and data protection
For privacy questions or to reach our data protection contact, email contact@zoneoftruth.com. We have not appointed a Data Protection Officer, as we are not required to under GDPR Article 37; contact@zoneoftruth.com is the point of contact for all data-protection matters.