Hootology Inc. Privacy Policy

Last Updated: March 9, 2026

This Privacy Policy describes how Hootology Inc. (“Hootology,” “we”) collects, uses, discloses, and protects personal information in connection with:

• Our website at http://hootology.ai (the “Website”);

• Our HOOQZ research platform (the “Platform”);

• Interactive discussion groups, feedback communities, and research studies conducted through the Platform (collectively, “Research Activities”); and

• Certain communications between you and Hootology.

By accessing or using our Website or Platform, or by participating in our Research Activities, you acknowledge that you have read and understood this Privacy Policy.

If you have questions about this Privacy Policy, contact us at stefanie@hootology.com. 

1. Information We Collect

1.1 Information You Provide to Us

Website Visitors and Prospective Clients If you contact us through our Website, request information about our services, or otherwise communicate with us in connection with a potential engagement, we may collect your name, email address, phone number, company name, and the content of your communications. This section applies to pre-engagement and general inquiries only. The collection and use of personal information shared in the context of an existing client relationship is governed by the applicable services agreement between Hootology and the client.

Research Participants. If you participate in our Research Activities through the Platform, you may provide demographic and other information relevant to the applicable study, including: (i) age, gender, race or ethnicity, household composition, and similar demographic information; (ii) title, seniority level, division, industry, and similar professional information; and (iii) responses, feedback, comments, and ideas shared during research discussions

Research participants typically access the Platform through a third-party research panel provider using a unique participant link and identifier. We generally do not collect participants’ names, email addresses, or other direct contact information through the Platform, except as may be necessary for specific research purposes or legal compliance. Participation is linked to a pseudonymous identifier assigned by the panel provider.

1.2 Information We Receive from Third Parties

Research Participants. We work with third-party research panel providers (such as Prodege) to recruit participants for our Research Activities. These providers may share limited participant information with us, such as a pseudonymous participant identifier and basic demographic information relevant to study eligibility. These panel providers maintain their own privacy policies governing their collection and use of your information, and we encourage you to review them. We are not responsible for the privacy practices of these third-party panel providers.

1.3 Information Collected Automatically

When you visit our Website or use our Platform, we may automatically collect:

• Device and browser information (browser type, operating system, device identifiers)

• IP address and network information

• Usage and access data and times (pages visited, time spent, referring URLs, clickstream data)

• Information collected through cookies, web beacons, and similar tracking technologies

• Universally unique identifiers (“UUID”) and advertising identifiers

• Carrier and approximate geographic location

We use the following analytics and verification tools in connection with our Website and Platform:

• Google Analytics, to evaluate and aggregate visitor data, including time spent on certain pages, which areas of the Website receive the most traffic, general geographic location of visitors, and the source of referred traffic

• Microsoft Clarity, to verify participant legitimacy and monitor Platform interactions

• Real-time source IP analysis, for security and quality assurance purposes

For more information about cookies and tracking, see Section 4.

1.4 Information Derived Through AI Analysis

During Research Activities, we use artificial intelligence tools to analyze participant responses for the purpose of summarizing and classifying information to facilitate conversation progression and deeper engagement. These AI-generated summaries and classifications are presented to participants for accuracy confirmation during the research session. For more information, see Section 5.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve our Website and Platform

• To conduct Research Activities, including analyzing participant responses using AI tools

• To generate aggregated research insights and reports for our clients

• To respond to your inquiries and provide information about our services

• To communicate with you about Hootology, our services, or updates to this Privacy Policy

• To verify participant identity and eligibility for Research Activities

• To detect and prevent fraud, bot infiltration, and other security threats

• To comply with applicable law and enforce our rights

• To protect the safety and security of our users and third parties

• To fulfill our legal and contractual obligations to you 

We do not share individual participant-level data with our clients, except where required by law or with explicit participant consent. Clients receive only aggregated and de-identified research insights and reports that cannot reasonably be used to identify individual participants.

3. How We Share and Disclose Your Information

We do not sell your personal information.

We may disclose your information to the following categories of recipients:

Hootology Clients. We share aggregated, de-identified research insights and reports with the clients on whose behalf Research Activities are conducted. These reports do not contain individual participant-level data and cannot reasonably be used to identify any individual participant. We do not share raw participant responses or direct personal information with clients except where required by law or with explicit participant consent

Service Providers. We disclose information to third-party service providers that perform services on our behalf, subject to confidentiality and data protection obligations, including:

• Cloud infrastructure and hosting (Amazon Web Services)

• Customer relationship management (HubSpot)

• AI-powered analysis (OpenAI, under their Business Plan, which contractually prohibits the use of customer data for model training)

• Research panel recruitment (Prodege)

• Analytics and verification services (Google Analytics, Microsoft Clarity)

Research Panel Providers. If you access our Platform through a third-party research panel provider, we may share limited information with that provider as necessary to confirm your participation and facilitate compensation through their platform.

Professional Advisers. We may share your information with professional advisers, including lawyers, auditors, and insurers, who provide consultancy, legal, insurance, and accounting services, and to the extent we are legally obliged to share or have a legitimate interest in sharing your information.

Legal and Safety Disclosures. We may disclose your information if we believe in good faith that disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or governmental request; (b) enforce our agreements and policies; (c) protect our rights, property, or safety, or the rights, property, or safety of others; or (d) detect, prevent, or address fraud, security, or technical issues.

Business Transfers. In connection with a merger, acquisition, reorganization, sale of assets, bankruptcy, liquidation, or similar transaction, your information may be transferred to a successor entity, subject to this Privacy Policy or a privacy policy that provides substantially similar protections. 

With Your Consent. We may disclose your information for purposes not described in this Privacy Policy with your consent.

4. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies on our Website to analyze usage patterns and improve functionality. On our Platform, we use session monitoring tools, including Microsoft Clarity, for participant verification, quality assurance, and fraud prevention purposes, not for general analytics or advertising. The following describes the technologies used and how you can manage your preferences.

The term “cookies” refers to files with small amounts of data that a website stores on your computer or mobile device so that certain information about your visit and preferences are recognized upon a return visit. Technologies we use include:

• Session and persistent browser cookies

• Web beacons and pixel tags

• Local storage objects

Managing Your Preferences. Most web browsers automatically accept cookies, but you can edit your browser options to block them. The Help section of your browser toolbar will tell you how to prevent your computer from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. Please note that disabling cookies may limit your ability to use certain features of our Website or Platform. For additional information, visit www.allaboutcookies.org.

Google Analytics. We use Google Analytics to collect and analyze Website usage information. Google Analytics may collect information about your use of our Website and share it with Google. For information about how Google uses data collected through Google Analytics, please visit “How Google uses information from sites or apps that use our services” at www.google.com/policies/privacy/partners/. You may opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on available at https://tools.google.com/dlpage/gaoptout. For more information on Google Analytics, visit https://www.google.com/analytics.

Microsoft Clarity. We use Microsoft Clarity to understand how participants interact with our Platform. For more information, see Microsoft’s Privacy Statement.

Global Privacy Control. We honor Global Privacy Control (GPC) signals as valid opt-out-of-sharing requests where required by applicable law. For more information about GPC, visit https://globalprivacycontrol.org.

5. AI and Automated Processing

We use artificial intelligence tools, including generative AI and machine learning algorithms, in connection with our Research Activities.

• Purpose. AI tools are used solely to summarize and classify participant responses to facilitate conversation progression and deeper engagement during research sessions. AI is not used to make decisions that produce legal or similarly significant effects on participant.

• Participant Confirmation. At each instance of AI-driven summarization and classification, participants are asked to confirm the accuracy of the AI output.

• No Model Training. We transmit participant conversation responses to OpenAI for processing via their API. While we cannot guarantee or independently verify OpenAI’s data handling practices, we use OpenAI under their Business Plan, which contractually prohibits OpenAI from using customer data submitted through the API to train or improve its models. 

• Personal Information. We do not input direct personal identifiers (such as names or email addresses) into AI tools. AI processing is performed on conversation responses linked to pseudonymous participant identifiers.

If you are a resident of a state that provides the right to opt out of profiling or automated decision-making, you may exercise that right by contacting us as described in Section 8. Note that opting out of AI processing may affect your ability to participate in Research Activities, as AI summarization is integral to the Platform’s functionality.

6. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and the length of time thereafter during which we may have a legitimate need to retain your personal information, such as to manage and protect our business, to address issues or defend claims that may arise; 

• Whether there is a legal, tax, reporting, or auditing obligation to which we are subject, that requires us to keep records of your transactions for a certain period of time before we can delete them; and 

• The nature and sensitivity of the information and the purposes for which it was collected. 

In general, we retain personal information collected from research participants for up to two (2) years following the conclusion of the applicable research study, after which it is deleted or de-identified. Aggregated and de-identified research reports that cannot reasonably be used to identify individuals may be retained indefinitely. We may retain information for longer periods where required by applicable law or where necessary to resolve disputes or enforce our agreements.

7. Data Security

7.1 Use Caution When Sharing Information Online

When you voluntarily make your personal information available online in an environment shared by third parties, including via email, on message boards, or on blogs, that information can be viewed, saved, collected, heard, and/or used by others outside of Hootology. We are not responsible for any unauthorized third-party use of information provided in these contexts. Please be mindful whenever you share any information online.

7.2 Security of Your Information

We implement technical, administrative, and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption of data in transit and at rest

• Virtual desktop infrastructure for Platform delivery

• Secure APIs for data transmission

• Data segmentation and access controls

• Token-based authentication and encrypted access controls for research participants

• Real-time source IP analysis and monitoring

• AWS cloud infrastructure with enterprise-grade firewall and data center security

• Participant verification through Microsoft Clarity and unique identifiers

• Bot detection through a combination of narrative and quantitative response modalities, device fingerprinting, and participant quality monitoring

7.3 Children Under 16

Our Services are not designed for children under 16. We do not knowingly collect information from children under 16. If we discover that a child under 16 has provided us with personal information, we will delete such information from our systems. If you believe we may have collected information from a child under 16, please contact us at stefanie@hootology.com.

7.4 External Websites

While we have carefully chosen those vendors with whom we work, especially those involved in the transmission of data on behalf of our business, we do not control and are not responsible for the privacy practices or content of third-party websites, including those of affiliates, business partners, sponsors, advertisers, or other websites to which we may link from time to time. When visiting any third-party websites, you are responsible for reviewing the privacy policy and terms of use applicable to each site. They may be different than those that you see here.

8. Your Privacy Rights

Depending on where you reside, you may have certain rights regarding your personal information.

8.1 Rights Available to All Users

• Access. Request information about the personal data we hold about you

• Correction. Request correction of inaccurate personal information

• Deletion. Request deletion of your personal information, subject to certain legal exceptions

• Opt-Out of Communications. Opt out of marketing communications at any time

8.2 California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”):

• Right to Know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we have disclosed your information.

• Right to Delete. You may request that we delete personal information we collected from you, subject to certain exceptions.

• Right to Correct. You may request that we correct inaccurate personal information.

• Right to Opt Out of Sale or Sharing. We do not sell personal information. To the extent that our use of analytics technologies (such as Google Analytics) may constitute “sharing” of personal information under the CCPA, you may opt out by using Global Privacy Control, adjusting your cookie settings, or contacting us directly.

• Right to Limit Use of Sensitive Personal Information. We collect certain information that may be considered sensitive personal information under the CCPA, such as racial or ethnic origin. We collect this information from research participants only when relevant to a specific study and use it solely for research analysis and aggregated reporting. You may request that we limit our use of your sensitive personal information to purposes authorized by the CCPA.

• Right to Non-Discrimination. We will not discriminate against you for exercising your rights.

• Authorized Agents. You may designate an authorized agent to submit requests on your behalf by providing written authorization.

• Shine the Light. California Civil Code § 1798.83 permits California residents to request information regarding disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

Our California Do Not Track Notice. We do not support Do Not Track (“DNT”) signals of web browsers. DNT is a setting in your web browser that informs websites that you do not want to be tracked. You can enable or disable DNT through the Preferences or Settings options of your web browser. We do, however, honor Global Privacy Control (GPC) signals as described in Section 4.

8.3 Residents of Other States with Comprehensive Privacy Laws

If you are a resident of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Utah, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, or another state with comprehensive privacy laws, you may have the following rights under your state’s privacy laws, including the rights to:

• Know whether we process your personal information

• Access your personal information

• Correct inaccuracies in your personal information

• Delete your personal information

• Obtain a copy of your personal information in a portable and readily usable format (data portability)

• Opt out of the processing of personal information for purposes of targeted advertising, the sale of personal information, or profiling in furtherance of decisions that produce legal or similarly significant effects

Residents of certain states also have the right to appeal a denial of a privacy request.

8.4 How to Submit a Request

To exercise any of your privacy rights, or to appeal a decision regarding a prior request, contact us at stefanie@hootology.com. We will verify your identity before processing your request and respond within the timeframe required by applicable law.

9. Third-Party Links and Services

While we have carefully chosen those vendors with whom we work, especially those involved in the transmission of data on behalf of our business, we do not control and are not responsible for the privacy practices or content of third-party websites, including those of affiliates, business partners, or other websites to which we may link from time to time. When visiting any third-party website, you are responsible for reviewing the privacy policy and terms of use applicable to that site, as they may be different from ours.

If you access our Platform through a third-party research panel provider (such as Prodege), that provider’s privacy policy governs its collection, use, and sharing of your information.

10. GDPR: EU, EEA, and UK Data Subjects

Our Website, Platform, and services are operated from the United States. The Internet laws in the United States govern all matters relating to this Website. If you access our Website or Platform from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using our Website or Platform and submitting information, you authorize this transfer, processing, and use.

If you are located in the European Union, European Economic Area, or the United Kingdom, your personal data is subject to protection by the General Data Protection Regulation (“GDPR”) or the UK GDPR (collectively, “GDPR” unless otherwise specified). This section describes the additional protections and rights that apply to you.

10.1 Legal Basis for Processing

Under the GDPR, we process your personal data only when we have a valid legal basis to do so. The following identifies the legal basis we rely on for each category of processing:

• Responding to inquiries from prospective clients and providing information about our services. Legitimate interest (Article 6(1)(f)). We have a legitimate interest in responding to inquiries and communicating with prospective clients about our services.

• Collecting demographic information and conversation responses from research participants. Consent (Article 6(1)(a)). Participants provide affirmative consent through the HOOQZ Participant Agreement before joining a research session.

• Using AI tools to summarize and classify participant responses during Research Activities. Consent (Article 6(1)(a)). AI processing is disclosed in the Participant Agreement and participants consent before participating.

• Processing special category data (racial or ethnic origin) from research participants. Explicit consent (Article 9(2)(a)). Where a study requires collection of racial or ethnic origin data, we obtain explicit consent from participants. This data is collected only when relevant to a specific study and used solely for aggregated research analysis.

• Using cookies and analytics technologies on our Website and Platform. Consent (Article 6(1)(a)). We obtain consent for non-essential cookies and tracking technologies through our cookie consent mechanism.

• Security monitoring, fraud prevention, and bot detection. Legitimate interest (Article 6(1)(f)). We have a legitimate interest in protecting the security and integrity of our Platform and preventing fraudulent participation in Research Activities.

• Complying with legal obligations. Legal obligation (Article 6(1)(c)). We process personal data as necessary to comply with applicable laws and regulations.

• Disclosing information in connection with a business transfer. Legitimate interest (Article 6(1)(f)). We have a legitimate interest in conducting business reorganizations, mergers, or acquisitions.

10.2 International Data Transfers

Because Hootology is based in the United States, personal data collected from individuals in the EU, EEA, or UK will be transferred to the United States for processing. The United States may not provide the same level of data protection as your home jurisdiction.

Where we are required to provide appropriate safeguards for such transfers, we will rely on recognized transfer mechanisms, which may include Standard Contractual Clauses as adopted by the European Commission, or other lawful transfer mechanisms recognized under applicable law at the time of transfer. We will implement supplementary technical and organizational measures, including encryption in transit and at rest and contractual restrictions on service providers, as appropriate given the nature of the data transferred.

If you have questions about how your data is transferred or the safeguards in place, please contact us at stefanie@hootology.com.

10.3 Your Rights Under GDPR

If you are located in the European Union, European Economic Area, or the United Kingdom, your personal data is subject to protection by the General Data Protection Regulation (“GDPR”) or the UK GDPR. Under the GDPR, you have the right:

• To know what information is being collected, as disclosed in this Privacy Policy (“right to transparent information”)

• To object on grounds relating to your particular situation to the collection or processing of certain kinds of information (“right to object”)

• To withdraw consent even after it has been given, without affecting the lawfulness of the processing of your data prior to your withdrawal (“right to withdraw consent”)

• To access, modify, or update your information so that it is correct (“right to access” and “right to rectification”)

• To have your information deleted or erased (“right to erasure” or “right to be forgotten”)

• To have your data transferred or ported elsewhere (“right to data portability”)

• To restrict processing in certain situations (“right to restriction of processing”)

• To not be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects

The categories of data processors with whom we work, and that help us in the collection of information that allows us to serve and interact with you, include cloud infrastructure providers, AI analysis providers, analytics providers, customer relationship management providers, and research panel recruitment providers, as further described in Section 3.

You may contact us at any time to have your information updated or corrected, deleted, or to obtain a copy for your records. If you feel that we have not complied with applicable data protection regulations, please contact us at katrina@hootology.com with your first and last name, your country of origin, and a summary of your concern or complaint. We will endeavor to respond at our earliest possible convenience. If contacting us does not resolve your complaint, you may have the right to lodge a complaint with your local data protection authority.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time as necessary to protect our users and to comply with applicable law. When we make changes, we will post the updated policy on our Website with a revised “Last Updated” date. For material changes, we will provide additional notice by notice on our Website. We have no intention of making changes to our Privacy Policy to make it less protective of personal information collected prior to such changes. To the extent permitted by applicable law, our use of your information is governed by the Privacy Policy in effect at the time the information is collected. Your continued use of our Website or Platform after the posting of an updated Privacy Policy constitutes your acceptance of the changes.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, contact us at:

Hootology Inc.
Address:  249 Smith St PMB 2013, Brooklyn, NY 11231.
Email: stefanie@hootology.com