Privacy policy

This policy explains how Candid Response, operated by Mind Measure Ltd ("we"), handles personal data under the Data Protection Act 2018 and UK GDPR. For privacy queries contact privacy@candidresponse.com or our DPO at dpo@mindmeasure.co.uk.

1. Who we are

Mind Measure Ltd
Company no. 16555431
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
ICO registration: ZC030610

2. Scope

This policy applies to candidresponse.com, the buyer hub, and related services. It covers account holders who set up campaigns and respondents who take part via a shared link. Candid Response is a separate product from the Mind Measure wellbeing app. Data is processed in separate systems.

3. What we collect

Account data. Name, work email, organisation, and billing details for the person who sets up campaigns.

Company profile. The plain-language description of your organisation that you approve during setup.

Respondent data. For anonymous and named private modes we store an AI paraphrase of each answer and a sentiment read. We do not store the verbatim transcript after extraction, and we attach no name, email, or token to any answer row.

4. How we use it

To run conversations, produce reports, manage your account, take payment, and keep the service secure. We do not sell personal data and we do not use respondent content to train third-party models outside the extraction step described here.

5. Legal bases

We rely on contract to provide the service to account holders, legitimate interests to keep it secure and improve it, consent for respondents taking part in a conversation, and legal obligation where the law requires.

6. Anonymity and respondents

Anonymity is enforced in code. No theme, slice, or sample is shown below five contributions. Because we do not retain identifiers against answers, we may be unable to locate a single respondent's individual data. That is the design that protects them. See also our Privacy by design page.

7. Processors

We use processors under contract, including AWS (hosting and AI in the London region), ElevenLabs (conversational voice during live sessions), Anthropic via AWS Bedrock (paraphrase extraction), Stripe (payments), and Vercel (application hosting). Each acts on our instructions. A current list is available on request.

8. Retention and location

Data is processed in the United Kingdom. Account data is kept for the life of your account and a reasonable period afterwards for legal reasons. Campaign paraphrases are retained for your organisation while the campaign exists unless you ask us to delete them. Verbatim transcripts are not retained.

Deleting your account. Account owners can delete their company from the Company page in the buyer hub. This permanently purges your organisation profile, campaigns, and associated data from our systems. Any unused credits are forfeited at deletion and are not refundable. We may retain minimal billing records where the law requires.

9. Your rights

Subject to law, you may ask to access, correct, delete, or port your personal data, or object to certain processing. Contact privacy@candidresponse.com. You may complain to the Information Commissioner's Office. The anonymity design may limit our ability to act on requests about individual responses.

10. Contact

Mind Measure Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Privacy: privacy@candidresponse.com. DPO: dpo@mindmeasure.co.uk.