Privacy Policy

If you create a brand account, we collect your name, work email, company, and — via Stripe, our payment processor — billing details needed to process payment. We never store your card details ourselves; Stripe handles and stores that data directly. We use this information to operate your account, process payment, deliver your reports, and respond to support requests.

If you apply to and join the panel, we collect your name, work email, role, company, LinkedIn profile URL, and the industries/expertise you self-select. This is used to match you to relevant studies and to pay you per accepted response via Stripe Connect. Your responses are shared with the brand who commissioned a study anonymised by role and company type only — your name and contact details are never shared with the brand.

Self-serve studies let a brand invite their own contacts to respond, either by sharing a link directly, or by adding a response themselves on a respondent's behalf. Where a brand shares a link with someone, we deliberately do not collect that respondent's name, email, or any other identifying information — the response form only asks for a short, self-chosen label (e.g. “Head of Product”) and the structured response itself. We never see who the brand invited, and the brand is responsible for how they obtain and share that link with the people they invite.

A brand's self-serve responses and reports are visible only to that brand's own account. We do not pool, share, or expose one brand's study data to any other brand or user.

To operate the accounts, studies, and payments described above; to detect abuse of public, unauthenticated pages (such as rate-limiting shared study links); and, in aggregated or anonymised form only, to understand overall product usage and inform future development. We do not use an individual brand's study questions, responses, or reports for any purpose beyond delivering that brand's own report, except where aggregated and anonymised so no individual study or respondent can be identified.

• Supabase — database and authentication.
• Stripe — payment processing and panel-member payouts.
• Resend — transactional email (confirmations, reports, invitations).
• Google (Gemini) — AI synthesis of study responses into reports.
• Vercel — hosting and analytics.

These providers may process data outside the UK or EEA; where this occurs we rely on appropriate safeguards such as standard contractual clauses.

Under UK GDPR you have the right to be informed, the right of access, rectification, erasure, restriction of processing, data portability, and the right to object. To exercise any of these, contact hello@blocinsights.com. Because self-serve invite-link responses carry no identifying information by design, we may not be able to locate or erase a specific response without the inviting brand's help identifying which study and response it relates to.

Questions about this policy: hello@blocinsights.com.