Privacy Policy

Autograph is an AI-native market research platform. We help teams design studies, specify audiences, generate questionnaires, and surface insights — all in one place.

If you have questions about this policy, contact us at hi@autograph.team.

When you create an account, join our waitlist, or use Autograph, we collect:

• Account information — your name, work email, and company name.
• Research data — study objectives, audience specifications, questionnaire content, and uploaded assets you create or provide.
• Usage data — pages visited, features used, and interactions with the platform.
• Authentication data — if you sign in with a third-party provider, we receive your name, email, and profile picture from that provider.
• Waitlist details — if you join our waitlist, the email address you give us, and your name and company where you provide them. Only the email address is required.

We do not collect payment card details directly — payments are processed by our payment provider and we receive only a confirmation.

• To provide and operate the Autograph platform.
• To power AI features — your research inputs are processed by AI models to generate recommendations, questionnaires, and insights.
• To generate study tile images using your study description as a prompt.
• To send transactional emails — account confirmation, password resets, and study status updates.
• To email people who joined our waitlist about our launch and what we build after it. You can unsubscribe at any time, and unsubscribing from these does not affect the transactional emails above.
• To improve the platform based on aggregated, anonymised usage patterns.
• To build and maintain industry norms and benchmarks, and to improve our methodologies and models, from de-identified and aggregated survey data — described in full below.

Market research is far more useful when a result can be compared against something. We therefore retain survey response data and the metrics derived from it in de-identified, aggregated form, and use it to build industry norms and benchmarks, to improve our questionnaires, sampling and data-quality controls, and to develop and evaluate our statistical and machine-learning models. This use continues after a study ends.

De-identified means the data carries no identifier of an individual respondent, and no identifier of the client, brand, product or concept the study was about. We do not attempt to re-identify anyone, and we require the same of anyone we share norms with.

What we never do with it: publish anything attributable to a particular client or a particular study; publish a norm drawn from fewer than five studies or a cell of fewer than thirty respondents, so no single study can be picked out of an aggregate; or reuse a client's uploaded creative — concepts, artwork, packaging, brand assets — in any form.

Clients: the full terms are in Sections 7.3 and 7.4 of our Master Service Agreement. Respondents: the answers you give may contribute to these aggregates, and never in a form that identifies you.

We use trusted third-party services for infrastructure, authentication, hosting, analytics, and AI processing. These providers may process your data solely to deliver the services we use. We work only with providers that maintain appropriate data protection standards.

We retain your account data and research studies for as long as your account is active. If you delete your account, your personal data and studies are permanently deleted within 30 days. Backups may retain data for up to 90 days following deletion. De-identified and aggregated data already incorporated into norms and benchmarks is not deleted, because it no longer identifies you or your account and cannot be traced back to either.

You have the right to:

• Access your personal data.
• Correct inaccurate information via Settings.
• Delete your account and associated data.
• Export your research data — contact us and we'll provide a copy.
• Opt out of non-essential analytics by using a browser with tracking protection.

To exercise any of these rights, email hi@autograph.team.

We use a single authentication cookie to keep you signed in. We do not use advertising or tracking cookies. Our analytics use anonymised, cookieless measurement that does not identify individual users.

All data is encrypted in transit (TLS) and at rest. Passwords are never stored in plain text — authentication is handled securely by our auth provider. We support two-factor authentication for added account security.

If we make material changes we'll update the effective date above and, where appropriate, notify you by email. Continued use of Autograph after changes take effect constitutes acceptance of the updated policy.