Privacy Policy

1. Who we are

UXTap is a user research platform operated by Qualitap Soluções e Serviços Ltda. (QualiTAP), CNPJ 59.701.681/0001-68, headquartered in Osasco/SP. This policy explains what data we process, for what purpose, on what legal basis, for how long, and with whom we share it.

1. 1.1Data protection officer: contact by email at contato@paineltap.com.br.
2. 1.2Data subject channel: the same email, or the public form available at uxtap.app/privacidade/meus-dados.
3. 1.3Response time: confirmation of existence or access in simplified format, immediately; full statement within 15 days of the request, as required by article 19 of the Brazilian General Data Protection Law.

2. Two different roles, and why it matters

The distinction below is the backbone of this policy. It defines who decides what happens with each piece of data and to whom the data subject should appeal.

1. 2.1We are controllers of the data of those who contract: user registration, workspace, billing data, usage and support logs. Here, we define the purposes.
2. 2.2We are operators of the data of those who participate in studies. The client who created the study is the controller: they decide the questions, who is invited, whether there will be recording, and for how long the data will be used. We process this data according to their instructions and the Data Processing Agreement.
3. 2.3If you participated in a study and want to exercise your rights, you can contact us: we forward it to the client controller and, when the request can be directly fulfilled by us, we perform the deletion.

3. Data of those who contract, and for what purpose

1. 3.1Registration: name, email, password stored only as a cryptographic hash (bcrypt), preferred language, and role in the workspace. Purpose: create and operate the account. Legal basis: contract performance.
2. 3.2Acceptance of documents: date, time and version of the Terms of Use and Privacy Policy accepted at sign-up. Purpose: to prove the contract. Legal bases: performance of contract and regular exercise of rights.
3. 3.3Corporate authentication (SSO), when your workspace uses it: identifier provided by the identity provider and the email it reports. Legal basis: performance of contract.
4. 3.4Platform usage: studies created, dashboard actions, technical access and error logs. Purpose: to operate, support and improve the service, and for security. Legal bases: performance of contract and legitimate interest. We also keep UXTap’s own usage events (which screen was opened, which action was taken) for up to eighteen months, always with identifiers and short metadata, never with study content or participant responses.
5. 3.5Application access logs: date, time and IP address of each access, linked to the account. Purpose: to comply with article 15 of the Brazilian Internet Civil Framework and protect the account. Legal basis: compliance with a legal obligation.
6. 3.6API keys and AI tool connections (MCP): record of keys, granted scopes and usage trail, including IP address. Legal bases: performance of contract and legitimate interest, for security.
7. 3.7Billing: name, email, document, and payment data processed directly by Stripe. We do not store card numbers. Purpose: invoicing. Legal bases: contract performance and compliance with legal and tax obligations.
8. 3.8Recruitment credits: orders, payments and workspace wallet transactions. Legal bases: performance of contract and compliance with a legal obligation.
9. 3.9Communication: transactional emails for invitation, quota, password reset, and summaries. Purpose: operate the service. Legal bases: contract performance and legitimate interest. Summaries can be turned off in the settings.
10. 3.10Figma integration, when you connect your account: we store an access token encrypted with AES-256-GCM, used only to import the screens you indicate.
11. 3.11Data subject requests: email, reference, IP address and browser of the sender, kept for 5 years as proof of handling. Legal bases: compliance with a legal obligation and regular exercise of rights.
12. 3.12Visits to the public website, with your permission: random identifiers, pages, clicks and scrolling; sessions for up to 30 days and aggregates for up to 90 days.
13. 3.13Contact through the website: name, email, company, WhatsApp and message, to reply to you, kept for 12 months; IP address and browser, to prevent abuse, kept for 30 days. Basis: legitimate interest/preliminary procedures to a contract. Data submitted through the form is also recorded in the Painel TAP group’s CRM.

4. Data of those who participate in a study

What is collected depends on how the client set up the study. The list below is the maximum the platform is capable of collecting.

1. 4.1Responses to study questions, including open questions written by the participant.
2. 4.2Behavior during the task: clicks with coordinates, screens visited, scrolling, time per screen, path taken, and abandonment.
3. 4.3Technical data: device type, browser, system, language, and screen dimensions. We do not use tracking cookies on the response screen.
4. 4.4When the study comes from a recruitment panel: an opaque identifier sent in the URL and the variables configured by the client, such as age range or state. This identifier is provided by the panel and does not, by itself, contain name or contact information.
5. 4.5When recruitment is done by a partner panel: the participation status (completed, screened out, quota closed) and, where applicable, the coded reason the recording is unavailable, sent to the panel.
6. 4.6Screen recording of the study tab, when the participant specifically consents.
7. 4.7Camera image, when the study or moderated interview requests it and the participant consents.
8. 4.8Microphone audio, when the study asks the person to think aloud or when there is a voice interview, always with specific consent.
9. 4.9In scheduled interviews: name, email, time zone and answers to the screening questions defined by the customer. The participant receives the confirmation and invitation by email.
10. 4.10In moderated interviews: audio and video of the conversation, shared screen and the name shown in the room. Members of the customer’s team may watch as observers.
11. 4.11In real website studies: pages visited, clicks, scrolling, and screenshots of the indicated website. We never capture typed keys or content from text fields.
12. 4.12Surveys on the customer’s website and behavior measurement: source page, pseudonymous visitor identifier, approximate country inferred from the network and, in the behavior collector, pages, clicks and scrolling, without typed text or form content.

Voice, camera image and screen image deserve extra care because they can reveal more than the question asked for. That is why they require separate consent, are kept in private storage accessible only via short-lived signed links, and are deleted at the end of the plan’s retention period. Sharing excerpts via a public link is the controller customer’s decision, and the customer declares it has the participant’s authorization to use their image and voice beyond the research purpose.

5. Participant consent

1. 5.1Before starting, the participant sees a clear notice about what will be collected, by whom, and for what purpose, with a link to this policy and to the list of subprocessors.
2. 5.2Screen, camera and microphone recording require a second, explicit and separate consent, with the option to refuse and continue without recording, unless the study requires recording: in that case, this is shown prominently before the start, and the person may choose not to participate, with no consequence other than not receiving the participation incentive, if any.
3. 5.3The participant can interrupt at any time, including stopping sharing through the browser's own interface, without prejudice to the answers already given.
4. 5.4Consent is recorded with date and time and with the version of the text presented.

6. Children and adolescents

1. 6.1UXTap is not intended for people under 18.
2. 6.2If the customer conducts research with minors, it declares that it has obtained the specific and highlighted consent of at least one parent or legal guardian, as required by article 14 of the Brazilian General Data Protection Law, and is responsible for obtaining, proving and keeping it.
3. 6.3If we become aware of data collection from a minor without such consent, we may suspend the study and delete the data.

7. With whom we share

1. 7.1With service providers necessary for operations, listed on the subprocessors page with purpose, data processed and country. Artificial intelligence providers are grouped by function; the complete list of names is provided to the controller customer on request.
2. 7.2With the study's client controller, regarding the data of their participants.
3. 7.3With the recruitment panel chosen by the customer, to the extent necessary to confirm participation.
4. 7.4With tools the customer itself connects via API or MCP, on its instruction.
5. 7.5With authorities, when there is a legal request or court order, to the strict extent of the request.
6. 7.6In case of corporate reorganization, with the successor, maintaining the conditions of this policy.
7. 7.7We do not sell personal data and do not use it for third-party advertising.

8. Artificial intelligence

1. 8.1We use contracted artificial intelligence providers to transcribe audio, synthesize the interviewer’s voice, identify themes, generate reports, analyze screen images and run the automated interviewer. They are grouped by function on the subprocessors page.
2. 8.2We send only the content necessary for the task: excerpts of responses, transcriptions, images of study screens, and, in real-time voice mode, the audio of the conversation.
3. 8.3We contract these providers under paid business terms and do not authorize the use of the data sent for model training.
4. 8.4The results are probabilistic and may contain errors. We do not make automated decisions with legal effect on participants.
5. 8.5The participant is informed when conversing with an automated interviewer.

9. International transfer

1. 9.1Some providers process data outside Brazil, in the United States and the European Union, as shown on the subprocessors page. Since September 29, 2026, the application servers and the database are located in the United States (Virginia region).
2. 9.2These transfers are carried out under article 33 of the Brazilian General Data Protection Law, subject to the contractual data protection safeguards offered by each provider.
3. 9.3QualiTAP will adopt the standard contractual clauses approved by CD/ANPD Resolution No. 19/2024 within the regulatory deadline and explains, to anyone who asks through the data subject channel, how each transfer is carried out.

10. How long we store data

1. 10.1Screen, camera and audio recordings: according to the customer’s plan. On the free plan, 30 days; on Starter, 90 days; on Pro, 180 days; on Business, 365 days; or a different period agreed by contract. When the period ends, the file is deleted from storage and the recording is marked as expired.
2. 10.2Responses, navigation events, and aggregated results: as long as the study exists in the client's account, unless deletion is requested.
3. 10.3Recording transcripts and interview turn audio follow the recording’s retention period. The text of AI interview answers, being responses to the study, remains while the study exists.
4. 10.4Registration and billing data: during the contractual relationship and, after it, for the legal terms of fiscal retention and statute of limitations.
5. 10.5Application access logs: 6 months, as per Article 15 of the Brazilian Civil Rights Framework for the Internet.
6. 10.6Data subject requests: 5 years, as proof of handling. UXTap’s own usage events: up to 18 months.
7. 10.7Messages from the website contact form: 12 months; then they are deleted automatically, together with the emails that reproduce them. The sender’s IP address and browser: 30 days.
8. 10.8Backups may retain data for a limited additional period and are deleted within 30 days.
9. 10.9Free accounts with no access for 24 months will be notified by email and, if there is no response within 30 days, deleted along with their data.
10. 10.10Cancelling the subscription does not delete data: the account moves to the free plan. Account closure follows the Cancellation and Refund Policy.

11. Security

The measures below are implemented today. The Information Security Policy, on its own page, provides the details and what is still evolving.

1. 11.1Encrypted traffic in transit via HTTPS, with HSTS so that the browser never attempts an unencrypted connection.
2. 11.2Passwords stored only as cryptographic hash with bcrypt; never in plain text.
3. 11.3Recordings and audio in private storage, without a public URL, accessible only via a signed link valid for 1 hour.
4. 11.4Third-party integration tokens encrypted with AES-256-GCM before being stored.
5. 11.5Role-based access control within the workspace, verified on the server with each request.
6. 11.6Limitation of requests per address and per session on public routes, and daily resource usage caps per account.
7. 11.7Error monitoring with removal of request body and response content before sending to the provider.

12. Security incidents

1. 12.1We maintain an internal incident response plan, with responsible parties, deadlines, and record-keeping.
2. 12.2When we act as operators, we communicate with the client controller without undue delay as soon as we become aware of an incident that may affect the data under their responsibility.
3. 12.3When we act as controllers, we notify the ANPD and data subjects, where required, within 3 business days of learning that the incident affected personal data, or within the different period applicable to small-scale processing agents, where applicable, under CD/ANPD Resolution No. 15/2024.

13. Cookies and browser storage

1. 13.1In the dashboard, we use a session cookie, strictly necessary to keep you signed in, and a technical tab identifier, in the browser’s session storage, to measure use of product features, without study content. Without the session cookie, sign-in does not work.
2. 13.2On the response screen, we use local browser storage only to allow resuming the survey from where it stopped and to store events while the connection is unstable.
3. 13.3On public pages, with your permission, UXTap measures visits, clicks and scrolling using random browser identifiers, without typed text or URL parameters.
4. 13.4With permission separate from website analytics, we use Google Ads to measure accounts with completed registration, professional activation after publishing a study, and demo requests attributed to ads, without personalization.
5. 13.5Google Ads loads only after your specific permission. It receives the conversion type, an opaque identifier to prevent duplicates, ad click identifiers and technical connection information such as IP and browser. We do not send names, email addresses, typed text, study content or private URLs.
6. 13.6Signup and professional activation conversions take place in a separate, empty document, only when opening the dashboard home page without URL parameters or fragments. Signup requires completed registration and an account created within the past 24 hours; activation requires professional intent declared during registration and a published study in the original workspace within 90 days of account creation. Creating an example draft is not enough. We do not enable enhanced conversions or ad personalization.
7. 13.7Ad permission is stored in the browser for up to 180 days. Click identifiers and first-party attribution cookies last up to 90 days; opaque deduplication receipts, up to 180 days. Refusing or revoking stops measurement and deletes this local data. Google processes data already received according to its privacy policy (policies.google.com/privacy), including outside Brazil.
8. 13.8You can allow or refuse each measurement separately and revoke your choice in Privacy preferences in the footer. DNT and GPC prevent ad measurement.
9. 13.9You can decline or revoke analytics under Privacy preferences in the footer. Sessions are retained for up to 30 days and aggregates for up to 90 days; DNT and GPC are respected.
10. 13.10When the customer installs the UXTap tag or collector on its own website, it is the controller of that website’s visitor data, as described in the Cookie Notice.

14. Your rights

The General Data Protection Law ensures data subjects the rights below, exercised free of charge.

1. 14.1Confirmation of data processing existence and access to data.
2. 14.2Correction of incomplete, inaccurate, or outdated data.
3. 14.3Anonymization, blocking, or elimination of unnecessary, excessive, or unlawfully processed data.
4. 14.4Data portability and information about sharing.
5. 14.5Revocation of consent and information about the possibility of not consenting and the consequences.
6. 14.6Opposition to processing based on legitimate interest.
7. 14.7To exercise these rights, use uxtap.app/privacidade/meus-dados or write to contato@paineltap.com.br. We respond within 15 days. When the request refers to data from a client's study, we forward it to the controller and technically support the fulfillment.

15. Changes to this policy

1. 15.1We may update this policy. Relevant changes are communicated by email or on the panel 30 days in advance.
2. 15.2The current version is always on this page, with version number, date, and history.