Metalytiq Research & Solutions Private Limited ("Metalytiq", "we", "us") makes Metalytiq Survey Cloud, a platform that research teams use to design surveys, collect answers and analyse them. This policy explains how we handle personal data when you visit metalytiq.net, sign up for or use Metalytiq Survey Cloud, or contact us.
If you are answering a survey that someone built with Metalytiq Survey Cloud, the short Respondent privacy notice is written for you. The organisation that invited you to the survey decides what is asked and what is done with your answers; we process your answers on its behalf.
1. Who we are
Metalytiq Research & Solutions Private Limited, a company incorporated in India (CIN U70200UW2026PTC254788), Wave One, Unit 22/4, Silver Category, Sector 18, Noida 201301, Uttar Pradesh, India.
Privacy questions and requests: [email protected]. General support: [email protected].
Grievance Officer under the Information Technology Act and the Digital Personal Data Protection Act, 2023 (India): reachable at the privacy address above.
2. The two roles we play
- Controller for data about website visitors, people who contact us, and the staff of our customers who hold accounts ("workspace users"). This policy covers that data.
- Processor for everything our customers put into their workspace: survey designs, respondent answers, sample and panel lists, uploaded files, recordings and reports ("Customer Data"). Our customer is the controller. We handle Customer Data only on the customer's instructions under the Data Processing Agreement. Requests about Customer Data should go to the customer; if they reach us, we pass them on and help the customer answer.
3. What we collect, and why
3.1 Website visitors
The site at metalytiq.net sets no cookies of our own and runs no analytics. Our web host and proxy, Cloudflare, records the technical details of each request (IP address, time, page, browser) in its logs for security and to keep the site up. Fonts on the site are loaded from Google Fonts, which means your browser sends your IP address to Google when a page loads (see the Cookie Policy). Videos on the site are embedded from YouTube in its privacy-enhanced mode and load nothing until you press play.
Legal basis: our legitimate interest in running a secure website.
3.2 Workspace users (our customers' staff)
When a customer creates a workspace and invites colleagues, we hold for each user:
| Data | Why | Legal basis |
|---|---|---|
| Email address, full name, password (stored as an Argon2id hash, never readable) | To create and secure the account | Contract |
| Workspace name, legal name, the sign-up source, the plan | To provide the service and invoice it | Contract |
| The version of the Terms of Service you accepted, when, and the IP address you accepted it from | Evidence of the agreement | Contract; legitimate interest |
| IP address and browser at each sign-in; time of last sign-in | Security: spotting stolen credentials, locking accounts after repeated failures | Legitimate interest |
| The actions you take in the workspace (the audit log: who changed what, when, from which IP address) | Accountability our customers require; investigating problems | Contract; legitimate interest |
| Interface preferences (language, theme, layouts), kept in your browser | Convenience | Legitimate interest |
| Sign-in through your organisation's identity provider (OpenID Connect), when the customer sets it up | Single sign-on | Contract |
| Support emails and the messages you send us | To help you | Contract; legitimate interest |
We send transactional emails only: the sign-up code, password resets, invitations, notifications the customer configures, and links to reports. We do not send marketing email without consent.
3.3 People our customers contact through the platform
Customers may upload sample lists and panel members' contact details and send them survey invitations by email. That data is Customer Data: the customer is the controller and must have a lawful basis to contact those people. Invitation emails may carry an open-tracking image and click-tracking links; the customer chooses whether tracking is on. We do not use these contact details for our own purposes.
4. Who we share data with
We do not sell personal data. We share it with:
- Sub-processors that host and run the service, listed with their role and location at /legal/sub-processors. At the date of this policy they are our hosting provider, Cloudflare (network, TLS, DNS), Resend (transactional email) and, only for workspaces that switch on AI follow-up questions, an AI model provider.
- Our customer, when you are a workspace user: the workspace owner and admins can see the users in their workspace and the audit log.
- Authorities, when the law requires it, and professional advisers under confidentiality.
- A buyer, if Metalytiq is sold or merges; you would be told first.
Platform staff at Metalytiq can read a workspace's data to provide support and operate the service. Every such access is logged in the workspace's audit log.
5. Where data is kept and international transfers
Metalytiq is an Indian company. The production service runs on a server operated by our hosting provider, behind Cloudflare's global network. Email is sent through Resend, whose servers are in the United States.
Where personal data protected by the UK GDPR or the EU GDPR is transferred outside the UK or the EEA, we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses with our customers (in the DPA) and with our sub-processors.
6. How long we keep data
| Data | Kept for |
|---|---|
| Account details | While the account exists, then removed when the workspace is deleted |
| Sign-in records (IP, browser) | 30 days from the sign-in, the life of the session token |
| Audit log | For the life of the workspace; it is an append-only record our customers rely on |
| Email verification codes, password reset links | Minutes to an hour, then unusable |
| Support correspondence | 24 months after the last message |
| Customer Data | As the customer decides, using the deletion tools in the workspace; a deleted workspace is destroyed after a grace period of 30 days (the customer can set 1 to 180 days) |
We do not currently keep automated backups; data lives in the production database until it is deleted.
7. Security
We keep each customer's data in its own database; access to one workspace cannot reach another. Passwords are hashed with Argon2id. Accounts lock for 15 minutes after 8 failed sign-ins. Access tokens expire after 15 minutes and refresh tokens after 30 days. Contact details in sample and panel lists are encrypted in the database. Traffic is encrypted in transit (TLS). Permissions are role-based (62 permissions across 11 roles) and every change is written to an audit log that cannot be edited. Media files are served only to surveys that use them, and personal data in exports is masked unless the user holds a specific permission.
No system is perfectly secure. We do not hold a security certification such as ISO 27001 at the date of this policy. If a breach affects your data we will tell you and, where the law requires it, the authorities, without undue delay.
8. Your rights
Depending on where you live, you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; move it to another provider; and withdraw consent where consent is the basis. Write to [email protected]. We answer within one month (UK and EU GDPR) or the period the DPDP Act and its rules set (India). If you are a workspace user, some requests must go through your organisation, which controls the workspace.
You can complain to a supervisory authority: the Data Protection Board of India; the Information Commissioner's Office (UK); or your national authority in the EEA.
9. Children
Metalytiq Survey Cloud is a business tool. We do not knowingly create accounts for anyone under 18. Whether a survey may be answered by a child is the customer's decision and responsibility as controller.
10. Automated decisions
We make no decisions about you by automated means that have legal or similarly significant effects. Where a customer switches on AI follow-up questions in a survey, the AI only writes the next question; it does not decide anything about the person answering.
11. Changes
We will post changes here with a new version and effective date, and tell workspace users in the app when the change is material.
12. Contact
[email protected] · Metalytiq Research & Solutions Private Limited, Wave One, Unit 22/4, Silver Category, Sector 18, Noida 201301, India.
METALYTIQ RESEARCH & SOLUTIONS PRIVATE LIMITED · Noida, India · CIN U70200UW2026PTC254788