Converge LLC ("Converge," "we," "us") provides a platform for facilitated qualitative research sessions. This policy explains how we handle personal information across our website and our platform.
Our two roles
How we handle personal information depends on the context.
We are a controller for information we collect about visitors to our website, people who contact us, and the account holders of our client organizations. We decide how that information is used, and this policy governs it.
We are a processor for information processed inside a client's workspace on our platform, including everything contributed during a research session. Our client, the organization running the session, is the controller. They decide what data is collected, why, and how long it is kept. We process it only on their instructions and under our agreement with them. If you took part in a session and want to know how your data is being used, the organization that invited you is the right place to ask, and If you participated in a session below explains how we can help.
Information we collect
Website visitors. Pages visited, referring site, approximate location derived from IP address, browser and device information, and cookie identifiers.
People who contact us. Name, company name, address, email address, telephone number, and the content of your message.
Account holders. Name, email address, organization, role and permissions, authentication information, and records of activity within the platform. Where your organization uses single sign-on, we receive identity attributes from your identity provider.
Session participants. Name and email address where provided by the organizing client or at registration; your contributions during a session, including written responses, comments, votes, ratings, and any materials you upload; audio and video where the organizing client has enabled recording; and technical information such as IP address, device and browser details, and session timestamps.
We do not ask for special categories of personal information, such as health, biometric, or political data. What is discussed in a session is determined by the organization running it.
How we use information
As a controller, we use information to operate and secure our website and platform, provide and support the service, communicate with clients and prospective clients, meet legal and contractual obligations, and improve our service.
As a processor, we use client and participant information only to deliver the service to the client, and only on their documented instructions.
We do not sell personal information. We do not use client or participant data for advertising. We do not use client or participant data to train, fine-tune, or improve artificial intelligence models, whether our own or a third party's.
Legal bases
Where GDPR applies and we act as controller, we rely on legitimate interests for operating and securing our website and service and for business communications, contract performance for providing the service to account holders, consent for non-essential cookies and marketing communications, and legal obligation where the law requires it.
Where we act as processor, the legal basis for processing session data is determined by the client as controller.
AI-assisted analysis
Our platform includes AI-assisted analysis of session content, such as summarization and thematic analysis. This is performed using third-party AI providers under commercial agreements that prohibit the use of submitted content for model training. AI output is a draft input reviewed by a human facilitator or researcher, and no automated decision affecting an individual is made by these systems. Our current AI providers are listed in our sub-processor list.
Who we share information with
We share personal information with service providers who process it on our behalf, under written terms requiring them to protect it and use it only for the purposes we specify. These include cloud infrastructure and storage, network and content delivery, AI providers for in-session analysis, identity and authentication, email delivery, and customer support.
A current list of our sub-processors is available on request and, where a data processing agreement is in place, in accordance with its notification terms.
We may also disclose personal information where required by law, to establish or defend legal claims, or in connection with a merger, acquisition, or sale of assets, in which case we will notify affected clients.
International transfers
Our platform infrastructure and stored client data are located in the United States. Where we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, including Standard Contractual Clauses where applicable. Where a client agreement restricts the geographic location of processing, we configure the service accordingly.
How long we keep information
Session and account data within a client workspace is retained according to that client's instructions and our agreement with them. On termination, we return or delete client data at the client's election within the period set out in the agreement, unless retention is required by law.
Website and business contact information is retained for as long as needed for the purpose it was collected and to meet legal and record-keeping obligations.
Data may persist in encrypted backups after deletion from the live service. It is removed as those backups expire on their normal retention cycle.
How we protect information
We encrypt personal information in transit and at rest, restrict access on a least privilege basis with periodic access review, log administrative access to production systems, and separate client data by workspace. We undergo an annual SOC 2 Type II examination and annual independent penetration testing. Our full security program is described in our published security documentation, available on request.
Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Request deletion
- Restrict or object to processing
- Receive your information in a portable format
- Withdraw consent where processing is based on consent
- Not be discriminated against for exercising these rights
California residents have the right to know what personal information is collected and disclosed, to request deletion and correction, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined under California law.
To exercise a right, contact us using the details below. We will respond within one month, or within the period required by applicable law. We may need to verify your identity first.
If you participated in a session
For personal information processed inside a client's workspace, the organization that ran the session is the controller and decides how requests are handled. Contact them first. If you contact us instead, we will refer your request to them and assist them in responding.
Cookies
We use cookies that are necessary for the site and platform to function, and cookies that help us understand how our website is used. You can control cookies through your browser settings. Blocking necessary cookies may prevent parts of the platform from working.
Children
Our platform is not directed to children under 16, and we do not knowingly collect their personal information. Where a client's research design involves participants under 16, that must be addressed in our agreement with that client before the engagement begins.
Changes to this policy
We may update this policy from time to time. We will post the updated version here with a revised date, and where changes are material we will notify clients in accordance with their agreements.
Contact
Converge LLC
10040 E Happy Valley Dr, Scottsdale, AZ 85255
Privacy/General enquiries: info@startconverge.com
If you are in the EEA or UK and believe we have not handled your personal information properly, you have the right to lodge a complaint with your local data protection authority.