Effective 3 October 2026
This Privacy Policy explains how UserArchitect ("UserArchitect", "we", "us" or "our") handles personal information when people use our website, subscribe to the service, administer a workspace or participate in research conducted through the platform.
We may collect account and contact information such as names, email addresses, organisation names and support enquiries; subscription and billing records such as plan, customer, subscription and invoice identifiers; technical and security information such as browser details, activity records and a salted hash derived from an IP address; and research information submitted or generated through studies, including survey answers, task activity, click coordinates, tree-test paths and card-sort responses.
Payment card details are entered into Stripe-hosted payment services. UserArchitect does not intentionally store full payment card numbers or card security codes.
Customers decide what research they run, who they invite and what questions they ask. The customer is responsible for ensuring that its study design, participant recruitment, notices, consents and collection of personal or sensitive information comply with applicable law and its own policies. Customers should collect only information they reasonably need and should not use UserArchitect to collect highly sensitive, regulated or high-risk information unless they have independently assessed the legal, privacy and security requirements.
We use information to provide and administer the service, authenticate users, process subscriptions, deliver research studies, display results, communicate service messages, respond to enquiries, prevent abuse, investigate security events, maintain audit records and improve reliability and usability.
We may use service providers to operate UserArchitect, including hosting and infrastructure providers, Stripe for payment processing, Postmark for transactional email and other suppliers required to provide or secure the service. Information may be disclosed to those providers only to the extent reasonably required for their role, or where disclosure is required or permitted by law.
Some service providers may process information outside Australia. Customers should consider this when deciding what participant information to collect and whether additional notices, consents or contractual controls are required.
We use technical and organisational safeguards designed to reduce the risk of unauthorised access, modification, disclosure, misuse, interference or loss. No internet service, hosting environment, software platform or transmission method can be guaranteed to be completely secure. Customers are responsible for their own account security, authorised team access, endpoint security and appropriate handling of exported research data.
Information may be retained while an account or study is active and for a reasonable period afterwards for service operation, billing, security, backup, dispute resolution and legal obligations. Deleted information may remain in system backups for a limited period before those backups are rotated. Customers should maintain their own copies of research outputs they are required to retain and should export important data before closing an account or deleting a study.
UserArchitect uses essential cookies or similar browser storage for authentication, security and application operation. We may also record limited technical information needed to keep sessions secure and diagnose service problems.
Research participants should direct questions about a study, the purpose of the research, consent, access, correction or withdrawal to the organisation that invited them. Where UserArchitect receives a request relating to customer-controlled research data, we may refer the request to the relevant customer or assist that customer where appropriate.
You may contact us about personal information associated with your UserArchitect account, or to request access or correction where applicable. We may need to verify your identity before acting on a request.
UserArchitect is not designed to remove the need for appropriate consent or ethical review. A customer conducting research involving children or vulnerable people is responsible for determining whether parental, guardian, institutional or other consent and safeguards are required.
We may update this Privacy Policy as the service, our providers or legal obligations change. The effective date above identifies the current published version.
Privacy enquiries can be sent to hello@userarchitect.com.