Converge LLC ("Converge," "we," "us") provides a platform for facilitated qualitative research sessions. This policy explains how we handle personal information across our website and our platform.
Our two roles
How we handle personal information depends on the context.
We are a controller for information we collect about visitors to our website, people who contact us, and the account holders of our client organizations. We decide how that information is used, and this policy governs it.
We are a processor for information processed inside a client's workspace on our platform, including everything contributed during a research session. Our client, the organization running the session, is the controller. They decide what data is collected, why, and how long it is kept. We process it only on their instructions and under our agreement with them. If you took part in a session and want to know how your data is being used, the organization that invited you is the right place to ask, and If you participated in a session below explains how we can help.
Information we collect
Website visitors. Pages visited, referring site, approximate location derived from IP address, browser and device information, and a short-lived hashed identifier used only to count visits. Our website analytics do not use cookies.
People who contact us. Name, company name, address, email address, telephone number, and the content of your message.
Account holders. Name, email address, organization, role and permissions, authentication information, and records of activity within the platform. Where your organization uses single sign-on, we receive identity attributes from your identity provider.
Session participants. Name and email address where provided by the organizing client or at registration; your contributions during a session, including written responses, comments, votes, ratings, and any materials you upload; audio and video where the organizing client has enabled recording; and technical information such as IP address, device and browser details, and session timestamps. Where the organizing client recruits participants through our integrated research panel, we also receive the profile and screener information the panel provider supplies according to the client's criteria.
Our platform does not require special categories of personal information, such as health, biometric, or political data. What is discussed in a session, and which recruiting criteria are used, is determined by the organization running it. Where a client's research design involves such data, the client is responsible for establishing a lawful basis, and we process it only on their instructions.
How we use information
As a controller, we use information to operate and secure our website and platform, provide and support the service, communicate with clients and prospective clients, meet legal and contractual obligations, and improve our service.
As a processor, we use client and participant information only to deliver the service to the client, and only on their documented instructions.
We do not sell personal information. We do not use client or participant data for advertising. We do not use client or participant data to train, fine-tune, or improve artificial intelligence models, whether our own or a third party's.
Legal bases
Where GDPR applies and we act as controller, we rely on legitimate interests for operating and securing our website and service and for business communications, contract performance for providing the service to account holders, consent for non-essential cookies and marketing communications, and legal obligation where the law requires it.
Where we act as processor, the legal basis for processing session data is determined by the client as controller.
AI-assisted analysis
Our platform includes AI-assisted features: summarization and thematic analysis of session content, transcription of recordings, live translation, and an AI session assistant for researchers. These are performed using third-party AI providers under commercial agreements that prohibit the use of submitted content for model training. AI output is a draft input reviewed by a human facilitator or researcher, and no decision with legal or similarly significant effects on an individual is made by these systems. Our current AI providers are listed in our sub-processor list.
Who we share information with
We share personal information with service providers who process it on our behalf, under written terms requiring them to protect it and use it only for the purposes we specify. These include cloud infrastructure, storage, and email delivery; network and content delivery; live audio and video conferencing, recording, and transcription; machine translation; AI providers for analysis; participant recruiting panels, where a client uses them; calendar scheduling, where a client connects a calendar; payment processing for client billing; and demo scheduling on our website.
A current list of our sub-processors is published on our Trust page. Where a data processing agreement is in place, we notify clients of changes in accordance with its terms.
We may also disclose personal information where required by law, to establish or defend legal claims, or in connection with a merger, acquisition, or sale of assets, in which case we will notify affected clients.
International transfers
Our platform infrastructure and stored client data are located in the United States by default. Where we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, and we sign a data processing addendum with clients who require one. Where a client agreement requires processing in a particular region, we can provision a dedicated deployment in that region.
How long we keep information
Session and account data within a client workspace is retained according to that client's instructions and our agreement with them. On termination, we return or delete client data at the client's election within the period set out in the agreement, unless retention is required by law.
Website and business contact information is retained for as long as needed for the purpose it was collected and to meet legal and record-keeping obligations.
Data may persist in encrypted backups after deletion from the live service. It is removed as those backups expire on their normal retention cycle.
How we protect information
We encrypt personal information in transit and at rest, restrict access on a least privilege basis with periodic access review, log administrative access to production systems, and separate client data by workspace. We undergo an annual SOC 2 Type II examination and annual independent penetration testing. Our full security program is described on our Trust page, and our SOC 2 report is available under NDA on request.
Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Request deletion
- Restrict or object to processing
- Receive your information in a portable format
- Withdraw consent where processing is based on consent
- Not be discriminated against for exercising these rights
California residents have the right to know what personal information is collected and disclosed, to request deletion and correction, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined under California law.
To exercise a right, contact us using the details below. We will respond within one month, or within the period required by applicable law. We may need to verify your identity first. Where we act as processor, we assist the client in responding within the timeframes set out in our data processing agreement.
If you participated in a session
For personal information processed inside a client's workspace, the organization that ran the session is the controller and decides how requests are handled. Contact them first. If you contact us instead, we will refer your request to them and assist them in responding.
Cookies
Our website uses privacy-preserving analytics that set no cookies. If you schedule a demo through our website, the embedded scheduling tool may set its own cookies, subject to your choices in its consent notice. Our platform sets cookies that are strictly necessary for signing you in and keeping your session secure. Content a client embeds in a session from third parties, such as a video player, may set that provider's own cookies. You can control cookies through your browser settings; blocking necessary cookies will prevent the platform from working.
Children
Account holders must be at least 18. Our platform is not directed to children under 16, and we do not knowingly collect their personal information. Where a client's research design involves participants under 16, that must be addressed in our agreement with that client before the engagement begins, and the client is responsible for any parental consent required.
Changes to this policy
We may update this policy from time to time. We will post the updated version here with a revised date, and where changes are material we will notify clients in accordance with their agreements.
Contact
Converge LLC
10040 E. Happy Valley Rd, Scottsdale, AZ 85255
Privacy/General enquiries: info@startconverge.com
If you are in the EEA or UK and believe we have not handled your personal information properly, you have the right to lodge a complaint with your local data protection authority.