Privacy Policy

Last Updated: October 30, 2026

We care about your privacy. This policy explains what information we collect, how we use it, and your rights, whether you're a customer with a User Sage account or a real person a customer has added to their own Audience. User Sage is operated by Chaotic Domain, LLC ("we", "us").

The Quick Version

• Free to start, with paid plans for higher usage and a separate prepaid balance in your GenPop wallet for paying GenPop Panel participants
• We only collect what we need: account info from customers, and name/email from real participants a customer recruits
• AI Panel results are entirely simulated. No real person's personal data is ever sent to an AI provider to generate them
• Real participants' answers only go to an AI provider if the customer asks for an optional AI summary of them, and never with names or email addresses
• We don't sell data. Not yours, not a workspace's participants'. Ever.
• We only share information with a small number of trusted services that help run User Sage
• If you connect Google Calendar (optional), we read only when you're free or busy and add the sessions people book with you to your own calendar. We never use it for ads or to train AI, and you can disconnect anytime
• A real participant's data can be deleted on request, including a permanent blocklist so it can't be silently re-added later
• Sensitive data, including Google user data if you connect Calendar, is protected with encryption and security procedures that keep it confidential. Full detail is under How sensitive data is protected.
• Sensitive data is protected with encrypted storage, encrypted connection tokens, and limited team access.

1. What Information We Collect

If you're a customer (you have a User Sage account)

• Email address and name, via our authentication provider
• If you're on a paid plan: billing name/address and payment method, handled entirely by our payment processor. We never receive or store your full card number
• The studies, simulated people, and panels you create, and how many credits you've used
• Your plan and credit history, including whether you've claimed the one-time Pro trial
• If you connect Google Calendar (optional, off by default): your Google account email; the names of the calendars you choose to check and to add sessions to; whether you are free or busy at specific times (never the titles or details of your other events); and the calendar events User Sage itself creates for sessions people book with you (the session title, time, the booker's name and email, and a video-meeting link). We also keep the connection tokens Google gives us so the calendar stays connected

If you're a real participant (added to a workspace's Audience, or you've taken a study)

• Your name and email: whatever the customer's workspace collected when adding you, or what you submitted yourself on a public sign-up page
• Your free-text responses to whatever study you took
• Your IP address, hashed before it's ever stored, used only to catch abuse (like the same person submitting many times). We never keep it or can use it in raw form
• Basic browser/device info (e.g. "Chrome on macOS"), shown to the customer so they can spot patterns like a bug that only shows up on one browser
• If you choose to verify your email to save your responses, or create a participant account, that email and any profile details you add. Sign-in for these accounts is handled by our authentication provider, the same as for customers
• If a study offers an incentive: the email you give on the last screen so the researcher can contact you about it, and a record of what the researcher gave you. Both are deleted or anonymized on request: a deletion keeps only what was given and when, never who it was for
• If you book a live session with a researcher: your name, email, time zone, the time you chose, and the confirmation and reminder emails we send you. You can cancel or reschedule from a link in those emails, and a deletion request removes your booking details too
• If your live session is recorded: the recording is deleted after 12 months, the transcript stays as part of the workspace's research record, and you can ask the host to delete the recording and transcript at any time.

If you're a participant sourced through GenPop Panel

• Your answers to the study, and an anonymous participant ID supplied by the research panel provider that recruited you
• We don't receive your name or email address through the provider, and you're never asked to create a User Sage account
• The same hashed IP and basic browser/device info described above

2. What Happens to Your Data, By Source

AI Panel (simulated) results

This is important, so we'll be direct about it: AI Panel responses are not from real people. When a customer runs an AI Panel study, the study and simulated panel they set up are processed by our AI providers (listed in §4) to generate simulated responses. No real participant's personal data is ever part of this. There isn't a real person on the other end of an AI Panel result.

Your Panel / Audience (real participant) responses

If you're a real person who took a study, your name, email, and responses are stored so the customer who recruited you can review them. Your responses are only processed by our AI providers if that customer asks for an optional AI summary of their study's responses, and then only your answers, never your name or email address. The summary is shown only to that customer's workspace. Real participant data and AI-simulated data are otherwise kept on separate paths, and results are always labeled by which one produced them.

GenPop Panel (real participants sourced for you)

When a customer launches a GenPop Panel study, real participants are recruited, screened, and paid through a third-party research panel provider. The provider receives the study link and the screening criteria the customer chose (for example an age range or country), so it can find matching people. The answers that come back are stored and shown to the customer like any other real-participant responses, labeled as real, and the same limits on optional AI summaries apply.

Google Calendar (if you connect it)

Connecting Google Calendar is optional and off by default. It lets people book a live session with you and puts that session on your calendar. When you connect it, Google shows you exactly what you're allowing, and you can turn it off at any time.

• What we ask Google for: permission to see when you're free or busy (not what your events are), and to create, change, and delete events on calendars you own. We use the second only for sessions people book through User Sage.
• What we do with it: work out which times to offer, check that a time is still free when someone books it, and add, move, or cancel the booked session on your calendar.
• What we don't do: we don't read the titles, descriptions, or guests of your other events. We don't use calendar data for advertising, and we don't use it to train or improve any AI model. We don't sell it, and we don't share it with anyone except the service providers in section 4. Data obtained through Google APIs and Google Workspace APIs is not used to develop, improve, or train generalized artificial intelligence or machine learning models, and is not transferred to an AI provider for that purpose.
• How it's protected: We use encryption and security procedures to protect the confidentiality of Google user data. The connection tokens Google gives us are stored encrypted, and calendar access happens only on our servers. Our team can look at this data only to fix a problem you've asked us to help with, for security reasons, or where the law requires it. See 'How sensitive data is protected' at the end of this section for the full list.
• Turning it off: disconnect Google Calendar in Settings, or remove User Sage from your Google Account permissions. When you disconnect, we delete the connection tokens we hold and stop all access. Sessions already on your calendar stay there, because they're yours.
• While Google Calendar stays connected, we store encrypted connection tokens and the booking records for sessions User Sage creates (including the Google event id for those sessions). To offer times and confirm a booking, we query free or busy times from Google when needed. We may hold those busy blocks briefly in memory for performance (about one minute), and a booking always re-checks live with Google. We do not store free or busy results in our database, and we do not keep a lasting copy of your wider calendar. We never read the titles or details of your other calendar events. When you disconnect, we delete the connection tokens and stop all access.

Participant rewards through Tremendous (if a workspace connects it)

A workspace owner can connect their own Tremendous account so the workspace can send participants a reward, such as a gift card, after a study. When a researcher sends a reward, we pass Tremendous the participant's email address and the reward they chose, and Tremendous delivers it. The reward is paid from the workspace's own Tremendous account. User Sage never holds the money, and connecting Tremendous is optional and can be turned off at any time.

How sensitive data is protected

Security procedures are in place to protect the confidentiality of your data, including Google user data we receive when you connect Google Calendar. We use encryption to protect your information in transit (HTTPS) and at rest.

Sensitive data here means the data that needs the most care: your Google Calendar connection, the free or busy times and booked sessions that come with it, participants' names, email addresses, and responses, and your account details (name, email, plan and credit history). Payment details are handled entirely by Stripe. We never receive or store your full card number.

• All traffic to and from User Sage runs over HTTPS.
• Data is stored with Supabase and Vercel, who encrypt it at rest.
• Connection tokens, including the tokens Google gives us for Calendar, are stored encrypted on our servers, and calendar access happens only on our servers.
• Study files live in private storage buckets. They are reached only through short-lived signed links, never public URLs.
• IP addresses used to catch abuse are hashed before they are ever stored. We never keep them in raw form.
• Access inside our team is limited to what a task needs. We look at a workspace's participant data only to fix a problem you have asked us to help with, for security reasons, or where the law requires it.
• The database is backed up daily to separate storage.
• We don't sell sensitive data, and we don't use calendar data for advertising or to train AI models.

Results a customer shares

A customer can share a study's results with anyone through a read-only link. In that view participants' names and email addresses are hidden (shown as "Respondent 1" and so on), but their answers can be read by anyone who has the link. The customer can turn the link off or reset it at any time. A customer can also invite a specific person, by email, to view results; that person signs in and sees the full responses, including names and emails.

3. How We Use Information

To run User Sage, we use this information to:

• Process study results and generate AI Panel simulations
• Manage your account, credits, and subscription (customers)
• Show a customer the responses recruited for their own study (participants)
• Offer times, take bookings, and put booked sessions on a customer's calendar, and email confirmations and reminders (if a customer uses scheduling)
• Handle payments, provide support, and send receipts and important account updates
• Fix bugs, improve the product, and understand how the platform is used

We don't use a real participant's data for anything beyond the study they were recruited for and the workspace that recruited them. We don't use it to improve our AI models, and we don't combine it across workspaces.

4. Who We Share With

We don't sell data. Period. We only share information with a small number of trusted service providers who help us deliver User Sage, each contractually limited to using it only for that purpose:

• Authentication: Clerk handles sign-up and account sessions for customers.
• Payments: Stripe processes all billing and subscriptions.
• AI processing: we use the following AI providers: Google, OpenAI, Anthropic, and providers of open AI models, accessed directly or through Vercel. They process study content to produce AI Panel results and optional AI summaries, and receive real participant answers only as described in §2, never names or email addresses.
• Hosting & storage: Vercel (hosting) and Supabase (database and file storage, private buckets, accessed only via short-lived signed URLs, never public).
• Prototype Testing (optional): if a customer connects Figma from Settings, we use Figma's API to read that customer's prototype screens and click targets, only to build their Prototype Test. This connection is off by default, only a customer can turn it on, it's scoped to reading prototype content and nothing else in their Figma account, and disconnecting removes it from User Sage immediately.
• Google Calendar (optional): if a customer connects it, we use Google's Calendar API as described in section 2. User Sage's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Error monitoring: Sentry, so we can catch and fix bugs. It receives technical error details, not study responses.
• Email delivery: we use email delivery services, including Brevo and a mail server we host with HostGator, to send automated emails on our behalf (such as team invitations, response verification, session confirmations and reminders, and our newsletter). They handle messages only to deliver them, and we may change providers over time.
• GenPop Panel: Prolific, our research panel provider, recruits, screens, and pays the participants for GenPop Panel studies. It receives only what's needed to run the study: the study link, the customer's chosen screening criteria, and participant payment amounts.
• Participant rewards (optional): Tremendous, if a workspace owner connects their own Tremendous account, delivers the rewards a researcher sends to their participants. We pass Tremendous the participant's email address and the reward details, and Tremendous handles delivery. The money stays in the workspace's own Tremendous account; User Sage never holds customer funds for rewards.
• AI tools you connect: if a customer connects an AI tool (such as an AI assistant or coding tool) through our MCP connector, that tool's provider receives whatever study content and results the tool reads from User Sage, under the provider's own terms. Connecting a tool is the customer's choice, and deleting its API key in Settings cuts it off.
• Bot protection: Cloudflare Turnstile screens public forms (e.g. a workspace's participant sign-up page) for automated abuse, running invisibly rather than showing a visual challenge. See Cloudflare's Turnstile Privacy Policy Addendum.
• Product analytics: PostHog, in the signed-in dashboard app, to understand product usage (which features get used, where people get stuck). It only creates a profile once you are signed in, not for anonymous visitors. If you send feedback from inside the dashboard, or rate an AI Panel result, what you write is stored with your account in PostHog so we can follow up with you.
• Marketing analytics: Google Analytics, on our marketing pages (usersage.com, outside the dashboard), to measure traffic and which pages are working, which sets its own analytics cookies. Neither analytics tool is used for advertising, and we do not sell or share this data with ad networks.
• Workspace admins: if you're a customer on a team, other admins on your workspace can see your credit usage and basic account info.
• Legal requirements: only when legally required to (e.g. a valid court order).

5. Whose Data Is This, Legally

This matters, so we'll state it plainly rather than leave it implied. If you have a User Sage account, you're a User Sage customer, and we're directly responsible for your account data the way you'd expect from any SaaS product.

If you're a real participant added to a workspace's Audience, the workspace itself decided to collect your information for their own research. In legal terms, the workspace is the data controller, and User Sage acts as a data processor: we store and protect your data on that workspace's behalf, but we don't decide why it was collected in the first place. This is standard practice for this category of software.

6. Your Privacy Rights

If you're a customer

You can see and correct your account information anytime from your dashboard settings, and delete your account whenever you choose. Deleting is immediate and can't be undone. If you're the only member of your workspace, its data is removed. If you own a team workspace, we remove your login and personal details, the workspace passes to its most recently active remaining member, and its subscription is canceled. Any unspent GenPop wallet balance that isn't reserved for a running study is refunded to your original payment method.

If you're a real participant

Email hello@usersage.com with "Data Deletion Request" and the workspace/study you were part of. Because the recruiting workspace is the data controller (§5), we'll notify them, but unlike many platforms in this space, we don't just hand off your request and stop there. We already have a real deletion tool built into the product, so we can carry out the deletion directly: your name and email are removed, your responses are anonymized (kept only as anonymous counts, so a customer's results aren't silently corrupted), and your email is added to a permanent blocklist so it can't be silently re-added to that workspace later.

7. Cookies & analytics

We use essential first-party cookies to keep customers signed in to the dashboard and to remember in-app UI preferences (for example, whether to show a one-time product offer on Home).

We also use two analytics tools, for different jobs. Our marketing pages (usersage.com, outside the dashboard) use Google Analytics to measure traffic and which pages are working, which sets its own analytics cookies. The signed-in dashboard app uses PostHog to understand product usage (which features get used, where people get stuck); it only creates a profile once you're signed in, not for anonymous visitors. Neither tool is used for advertising, and we don't sell or share this data with ad networks.

If you send feedback from inside the dashboard, or rate an AI Panel result, what you write is stored with your account in PostHog so we can follow up with you.

8. Children

User Sage is for people 18 and older, for both customers and real participants. If we discover we've collected information from someone under 18, we'll delete it.

9. International Users

Your data may be processed in a different country than the one you're in. We ensure appropriate protections are in place for any international transfer.

10. Changes to This Policy

We might update this policy as the product changes. If we make a material change, we'll email registered customers and post a notice in the dashboard. Continuing to use User Sage after a change means you're OK with the update.

11. Questions?

Email us at hello@usersage.com. We'll respond within 30 days, usually much faster.

The Bottom Line

Your privacy matters to us, whether you signed up as a customer or were recruited as a participant. We collect what we actually need to make User Sage work, we protect it carefully, and real people always keep a real way to have their data removed. Questions or concerns? Just ask.

Legal Compliance Notes

GDPR Compliance (EU/EEA)

• Legal basis: contract (to provide the service to customers), legitimate interest and/or consent (for a workspace recruiting real participants, the workspace, as data controller, is responsible for having a lawful basis of their own)
• Data subject rights: access, rectification, erasure, restriction, portability, objection
• Data retention: account data kept while your account is active; participant data purged and anonymized on a verified deletion request; studies with no activity for 12 months may be archived or deleted after we email the account owner at least 30 days ahead (see the Terms of Service). Exact retention periods may vary by subscription plan (see the Terms of Service) and may change as plans evolve; we'll always state current retention on the pricing page rather than shortening it retroactively for data you've already stored
• International transfers: appropriate safeguards in place

CCPA Compliance (California)

• Right to know: request what personal information we collect
• Right to delete: request deletion of your personal information
• Right to opt out of sale/sharing: not applicable, we don't sell or share personal information
• Non-discrimination: we don't discriminate against anyone exercising these rights

Categories of Personal Information (CCPA)