Privacy Policy

Condulo, Inc. ("Condulo," "we," "us," or "our") provides research reports and related services to professional and institutional users. This Policy applies to the condulo.com website and related web pages operated by Condulo (the "Site") and to information we process about visitors, prospective customers, customers, and authorized users of the Site (together, "you").

This Policy covers the public Site, the research catalog where studies may be listed, purchased, or accessed, custom-study inquiry functionality, customer communications, and related account or report-access information. It does not govern third-party websites or services that we link to, which are governed by their own privacy notices.

Research participant data is handled separately. Condulo’s access-controlled research systems may process additional information in connection with interviews and research production, including, where applicable, audio, voice, transcript, and study-response information. Individuals participating in Condulo research are provided separate notices and/or participant terms applicable to that processing.

Questions about this Policy or our privacy practices may be sent to privacy@condulo.com.

A. Site, device, and technical information

When you access the Site, we and our service providers may process technical and usage information such as IP address, request and security logs, browser and device type, operating system, referring page, pages viewed, approximate location derived from IP address, timestamps, and performance or diagnostic information. Some of this information is processed automatically as part of hosting, security, fraud prevention, and operation of the Site.

B. Analytics information

We use Vercel Web Analytics and Vercel Speed Insights to understand use of the Site and measure performance. These services are designed to provide privacy-focused, aggregated analytics and performance information and are not used by Condulo to build cross-site advertising profiles. Where required by applicable law, we obtain consent before enabling non-essential analytics.

C. Information you provide to us

If you submit a custom-study request or other inquiry, we may receive the name, work email address, firm, role, message, and any other information you choose to provide. We use this information to respond to you, evaluate or provide requested services, and manage our relationship with you.

Custom-study submissions may be transmitted to us through Postmark, a product of ActiveCampaign. Postmark may temporarily process and retain message content and associated metadata in accordance with our configuration, its service terms, and its retention practices. Following delivery, Condulo may retain the submission in its business email and recordkeeping systems as described in Section 9.

D. Purchases and payment information

Purchases through the research catalog may be processed by Stripe or another payment processor. Payment credentials such as full payment-card numbers are provided to the payment processor and are not intended to be stored by Condulo. We may receive transaction and purchase information such as your name, work email address, billing information, transaction identifiers, payment status, purchase amount, the product or study purchased, and limited payment-method details. Payment processors may process additional information under their own privacy notices and applicable terms.

E. Access and communications information

If we provide access to purchased research or other restricted materials, we may process information needed to provide and secure that access, such as your email address, authentication or access credentials, access status, and security or access logs. If you communicate with us by email or otherwise, we receive the contact information, message contents, and attachments you choose to provide.

F. Sensitive information

We do not intentionally request sensitive personal information through the public Site. Please do not include sensitive personal information in free-text inquiry fields unless it is necessary for your request. If sensitive information is voluntarily provided, we may process it only as reasonably necessary to handle the communication, provide requested services, comply with law, or protect our rights and systems.

• Operate, maintain, administer, secure, troubleshoot, and improve the Site and our services;
• Provide, authenticate, and manage access to purchased research and other materials;
• Understand Site usage and measure and improve performance;
• Respond to inquiries, proposals, custom-study requests, and other communications;
• Process and fulfill purchases, provide customer support, and maintain transaction and business records;
• Develop and improve our products, services, internal processes, and customer experience;
• Detect, investigate, prevent, and respond to fraud, abuse, security incidents, unauthorized access, and other harmful or unlawful activity;
• Protect our rights, property, users, customers, personnel, and systems; and
• Comply with applicable law, regulation, legal process, and our contractual obligations, and enforce our agreements, including our Terms of Sale & Use.

Where applicable law requires a legal basis for processing, we rely on one or more of the following: your consent; performance of a contract or steps taken at your request before entering into a contract; our legitimate interests in operating, securing, developing, and improving our business and services in a manner that is not overridden by your rights; and compliance with legal obligations. Where processing is based on consent, you may withdraw that consent at any time, subject to applicable law.

We may disclose information in the following circumstances:

• Service providers and business partners. We use vendors and service providers that support our business, including website hosting, analytics, performance monitoring, email delivery, payment processing, security, infrastructure, communications, and professional services. Current or representative providers include Vercel (hosting, analytics, and performance services), Postmark / ActiveCampaign (email delivery), and Stripe (payment processing and related services). These providers may process information on our behalf or, where applicable, under their own legal obligations and privacy terms.
• Payment and financial ecosystem. Payment processors may disclose transaction information to banks, card networks, payment-method providers, fraud-prevention providers, and other parties necessary to authorize, authenticate, settle, refund, dispute, or otherwise process a transaction.
• Legal, compliance, and safety. We may disclose information where we reasonably believe disclosure is required or permitted by law, regulation, subpoena, court order, legal process, or governmental request, or is reasonably necessary to investigate or prevent fraud or unlawful activity, enforce our agreements, respond to security incidents, or protect the rights, property, safety, or security of Condulo or others.
• Business transactions. Information may be disclosed or transferred in connection with an actual or proposed merger, acquisition, financing, investment, reorganization, bankruptcy, sale of assets, due diligence, or similar corporate transaction, subject to applicable law.
• At your direction or with your consent. We may disclose information where you direct us to do so or otherwise consent to the disclosure.

We do not sell personal information for monetary consideration. We do not use personal information for cross-context behavioral advertising. To the extent any activity is treated as a "sale," "sharing," or targeted advertising under applicable privacy law, we will provide and honor applicable opt-out rights.

Depending on where you live and subject to applicable exceptions, privacy laws may give you rights regarding personal information we process about you, which may include the rights listed below.

• Access / know. Request confirmation of whether we process your personal information and obtain access to certain personal information and information about our processing.
• Delete. Request deletion of certain personal information, subject to applicable exceptions and retention obligations.
• Correct. Request correction of inaccurate personal information.
• Portability. Request a copy of certain personal information in a portable format.
• Opt out. Opt out of sale, sharing, targeted advertising, or certain other processing where applicable.
• Withdraw consent or object. Withdraw consent or object to certain processing where applicable.
• Appeal. Appeal a decision regarding a privacy request where applicable law provides an appeal right.

To exercise an applicable privacy right, email privacy@condulo.com. We may take reasonable steps to verify your identity and authority before processing a request and may ask for information reasonably necessary to do so. Authorized agents may submit requests where permitted by applicable law. We will respond within the time required by applicable law. We will not unlawfully discriminate against you for exercising applicable privacy rights.

Opt-out preference signals. We honor legally recognized opt-out preference signals, including Global Privacy Control (GPC), to the extent required by applicable law. You may also use any privacy-choice controls made available on the Site.

California disclosures

For purposes of California privacy law, depending on how you interact with the Site, the categories of personal information we may have collected during the preceding 12 months include identifiers (such as name, work email address, and IP address); professional or employment-related information (such as firm and role); commercial information (such as purchases and transaction records); Internet or other electronic network activity information (such as Site activity and device information); and communications or other information you choose to provide. We collect this information directly from you, automatically from your browser or device, and from service providers involved in operating the Site or completing transactions. We use and disclose these categories for the business and commercial purposes described in Sections 3 and 5.

Condulo does not sell personal information for monetary consideration. We do not use personal information for cross-context behavioral advertising. If an activity involving a service provider is deemed a "sale" or "sharing" under applicable law despite the absence of monetary consideration, you may exercise any applicable opt-out right by emailing privacy@condulo.com, using any available privacy-choice control on the Site, or using a legally recognized opt-out preference signal such as GPC.

Condulo does not use advertising cookies for cross-site behavioral advertising on the Site. We may use cookies, local storage, pixels, scripts, logs, or similar technologies where reasonably necessary to operate, secure, authenticate, troubleshoot, or measure the Site. Vercel Web Analytics and Vercel Speed Insights are used for website analytics and performance measurement. Where required by law, non-essential technologies are subject to applicable consent or opt-out choices.

Do Not Track. We do not use the Site to track users across unaffiliated websites for behavioral advertising purposes. Because browser-based Do Not Track signals do not have a uniform industry standard, the Site may not respond to those signals; however, we honor legally recognized opt-out preference signals, including Global Privacy Control (GPC), where required by applicable law.

Third-party services that you choose to interact with, including payment services, may use cookies or similar technologies under their own privacy notices. You may also control certain technologies through your browser settings, device settings, or privacy-choice controls made available on the Site.

We retain personal information for as long as reasonably necessary and proportionate to the purposes for which it was collected or processed, including to provide and secure our services, maintain business and financial records, manage customer and prospective-customer relationships, resolve disputes, enforce agreements, prevent fraud or abuse, establish or defend legal claims, and comply with legal, regulatory, accounting, tax, or other obligations. The applicable retention period may vary based on the nature and sensitivity of the information, the context in which it was collected, our operational needs, applicable contractual requirements, and legal requirements. Service providers may retain information in accordance with their applicable service terms and retention practices. When information is no longer reasonably required, we may delete, aggregate, anonymize, or de-identify it, subject to applicable law and legitimate recordkeeping requirements.

We maintain reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, acquisition, loss, misuse, disclosure, alteration, or destruction. Security measures are designed in light of the nature of the information and our systems and may evolve over time.

The public Site does not intentionally request sensitive personal information. Full payment-card credentials are processed by our payment processor rather than being intentionally stored by Condulo. Custom-study requests are transmitted using third-party email-delivery infrastructure and may be processed temporarily by those providers as described in this Policy.

No method of transmission over the Internet or method of electronic storage is completely secure. Accordingly, while we use reasonable safeguards, we cannot and do not guarantee absolute security. Our published description of security and governance controls applicable to Condulo research systems is available on the Security & Governance page of the Site.

The Site and Condulo’s commercial services are intended for adults and professional or institutional audiences and are not directed to anyone under 18 years of age. We do not knowingly collect personal information through the Site from anyone under 18. If you believe that a person under 18 has provided personal information to us through the Site, contact privacy@condulo.com and we will take appropriate steps consistent with applicable law.

Condulo operates in the United States, and we and our service providers may process information in the United States and other countries. If you access the Site from outside the United States, your information may be transferred to, stored, or processed in jurisdictions whose data-protection laws differ from those in your jurisdiction. Where applicable law requires safeguards for international transfers, we or our service providers may rely on legally recognized transfer mechanisms or other lawful bases for the transfer and processing of personal information.

We may amend this Policy from time to time, including to reflect changes in our practices, technology, services, vendors, legal requirements, or business operations. When we update the Policy, we will revise the "Last Updated" date above and may provide additional notice where required by applicable law.

To the maximum extent permitted by applicable law, your continued access to or use of the Site after an updated Policy is posted constitutes your acknowledgment and acceptance of the updated Policy. If applicable law requires consent to a particular material change, we will obtain that consent as required. Nothing in this Section limits rights that cannot lawfully be waived or altered by agreement.

For questions, concerns, complaints, or requests regarding this Policy or personal information, contact us at:

privacy@condulo.com

Provider privacy information

Vercel: https://vercel.com/legal/privacy-notice

Vercel Web Analytics: https://vercel.com/docs/analytics/privacy-policy

ActiveCampaign / Postmark: https://www.activecampaign.com/legal/privacy-policy

Stripe: https://stripe.com/privacy