Legal
Privacy Policy
How Elastic Tree handles personal data across our website and research products — India and international.
Last updated: 31 July 2026
1. Who we are
This Privacy Policy applies to Elastic Tree Research (“Elastic Tree”, “we”, “us”) and our digital products and services, including elastictree.com and the research studios: DataWiz, QualView, TScribe, AI Gaze, and Ethos Pulse (together, the “Services”).
Controller / Data Fiduciary: Elastic Tree Research, Chennai, India. Contact for privacy requests: sunil@elastictree.com.
2. Scope and laws
We process personal data in line with applicable law, including India’s Digital Personal Data Protection Act, 2023 (DPDPA) and Digital Personal Data Protection Rules, 2025 (as they come into force), the Information Technology Act, 2000 and SPDI Rules where still relevant, and — where we offer Services to people in the EEA/UK or otherwise process EU/UK personal data — the GDPR/UK GDPR. For California residents, we honour “notice at collection” and deletion/know-style requests on request where applicable.
This policy is an engineering and operational notice. It is not legal advice. We will update it as our processing and legal obligations evolve.
3. Personal data we process
Depending on which Service you use, we may process:
- Website & contact: name, company, email, message content, and technical logs (IP, user agent) needed to deliver the site and respond.
- Pilot / studio access: email address and access-session cookies used to unlock Soft Launch studios.
- DataWiz: uploaded survey / crosstab files (which may contain respondent or customer identifiers if you include them).
- QualView: account details; session chat; audio/video streams; transcripts; engagement / attention signals; and exports you generate.
- TScribe: uploaded audio/video; transcripts; role labels; and AI research reports.
- Ethos Pulse: organisation users; employee roster fields you upload (e.g. email, name, department); survey responses.
- AI Gaze: uploaded creative images/videos (which may depict people).
Please do not upload special-category or sensitive data (health, biometrics used for identification, children’s data, government IDs, etc.) unless we have a written agreement covering that processing.
4. Purposes and legal bases
We process personal data to:
- Provide, secure, and improve the Services you request;
- Respond to enquiries and manage Soft Launch access;
- Generate research outputs (tables, transcripts, reports, heatmaps) you ask for;
- Process payments where billing is enabled;
- Meet legal, security, and fraud-prevention obligations.
Under DPDPA we rely on consent and/or legitimate uses for providing requested Services. Under GDPR we rely on contract performance, legitimate interests (security, product improvement in a privacy-preserving way), and consent where required (e.g. non-essential cookies, certain marketing).
6. Processors and international transfers
We use carefully selected processors to run the Services. Depending on product, these may include hosting and infrastructure (e.g. Vercel, Railway, AWS/S3), email (Resend), payments (Stripe, Razorpay, or PayU when enabled), realtime media (LiveKit), speech/AI providers (OpenAI, Deepgram, Google Gemini), and related cloud tools.
Some processors are located outside India (including the United States and EEA). Where required, we use appropriate transfer safeguards (such as standard contractual clauses / equivalent contractual protections) and purpose limitation. By using AI-assisted features (transcription, summarisation, predictive gaze), you instruct us to send relevant content to those providers solely to deliver the feature.
7. Retention
Soft Launch session cookies expire on a short schedule. QualView ended and stale sessions are purged automatically after 90 days by default (configurable via QUALVIEW_RETENTION_DAYS). Account holders can also delete owned sessions and accounts in-product. Remote recording objects in object storage should use matching bucket lifecycle rules. TScribe uploads and Ethos campaign data are retained until you delete them or request erasure.
8. Your rights
Subject to applicable law, you may request access, correction, erasure, withdrawal of consent, grievance redressal, and (where GDPR applies) restriction, portability, or objection.
In-product: DataWiz, QualView, and TScribe provide export and account deletion under Privacy / data rights settings. You may also email sunil@elastictree.com with the subject “Privacy request”, naming the Service. We aim to respond within 72 hours and complete verified requests within 30 days where feasible.
If you are an employee respondent on Ethos Pulse, contact your employer (the organisation running the campaign) first; we process roster and survey data on their instructions.
9. Grievance officer
Grievance Officer (India DPDPA): Sunil Mukkath, Elastic Tree Research, Chennai. Contact: sunil@elastictree.com · +91 98408 50057. Please include “Grievance” in the subject line.
10. Security
We apply technical and organisational measures appropriate to Soft Launch risk: HTTPS, httpOnly session cookies with Secure in production, hashed passwords, access controls, and security headers on our web apps. QualView requires itemised consent before camera/microphone preview and live publish. No method of transmission or storage is 100% secure.
11. Children
Our Services are directed to business and research professionals. We do not knowingly collect personal data from children. Do not use QualView, Ethos Pulse, or other Services to process children’s data without a suitable written agreement.
12. Updates
We may update this Policy. The “Last updated” date below will change when we do. Material changes affecting Soft Launch users will be reflected on this page and, where appropriate, in-product notices.
See also our Terms of Use.