New features are already available.
Privacy Policy
Last updated: 05/28/2026
Protecting your data is our priority. Please read carefully.
Welcome to UserX's Privacy Policy!
We, USERX HUB LTDA, value your trust and privacy. Therefore, we have created this document to clearly and transparently explain how we collect, use, store, share, and protect your personal data when you use the UserX platform.
By creating an account and using UserX, you agree to the practices described in this Privacy Policy. It is very important that you read this document carefully, and if you have any questions, please contact us at privacy@userx.com.br.
We are the company responsible for the UserX platform and the processing of your personal data.
UserX is operated by USERX HUB LTDA, a private legal entity, registered under CNPJ No. 55.155.104/0001-67, with headquarters at Rua Gonçalves Ledo, No. 777, Rooms 1311 to 1317, Centro, CEP 60.110-261, Fortaleza/CE.
UserX is a B2B and B2C SaaS platform focused on end-to-end management of participant recruitment for research studies. Our purpose is to make the work of researchers and companies simpler, more organized, and compliant with legislation.
To make it easier for you to understand, we have prepared a glossary of the most important terms we use in this Policy.
| TERM | WHAT DOES IT MEAN |
| Personal Data | Any information that could identify you, directly or indirectly, such as your name, email, CPF (Brazilian taxpayer ID), phone number, address, etc. |
| Sensitive Data | Special type of personal data that reveals more intimate information, such as racial or ethnic origin, political opinions, religious beliefs, health data, sexual life, genetic or biometric data. |
| Data Treatment | Any operation performed with your personal data, such as collection, storage, use, sharing, modification, or deletion. |
| Headline | Natural person to whom the personal data refers (you, the User's team member, or a survey participant). |
| Controller | The company or person who decides how and why their personal data will be processed. |
| Operator | The company or person that processes personal data on behalf of the Controller, following their instructions. |
| User | Individual or legal entity (B2B or B2C client) that registers and uses the UserX platform to manage research projects. |
| Participant | An individual recruited through the Platform to respond to Screeners or participate in research sessions set up by the User. |
| Consent | Your free, informed, and unequivocal authorization for us to process your personal data for a specific purpose. |
| Cookies | Small text files stored on your device during your use of the Platform, which help to remember preferences and improve your experience. |
| LGPD | General Data Protection Law (Law No. 13.709/2018), the Brazilian regulation that protects personal data. |
| ANPD | National Data Protection Authority, the body responsible for overseeing and ensuring compliance with the LGPD. |
| Logs | Activity logs on the Platform, such as date, access time, and resources used. |
| Screener | Eligibility questionnaire used by the User to qualify Participants. |
| TCLE | Informed Consent Form, a document used to formalize participation in research. |
| AI Research Assistant | Generative AI-based chat functionality that assists users in organizing and systematizing research ideas. |
| Inputs | Texts, commands, and other content typed by the User in the AI Search Assistant. |
| Outputs | Responses and other content generated by the AI Research Assistant from User Inputs. |
We only collect the data necessary for you to use the UserX platform and manage your research projects.
Personal data is collected in different ways and for different purposes, always based on the permissions granted and the legal hypotheses provided for in the LGPD.
| WHEN WE COLLECT | WHAT DATA | What is it for |
| During user registration | Name, email, phone, company details (legal name, CNPJ, position), access credentials | Create and identify the User account, authenticate access (including via Magic Link), and enable service subscription. |
| In team management | Name and email of collaborators invited by the User | Allow sharing of project access with authorized team members by the User. |
| When using the Platform | Access logs, IP address, browsing data, session identifiers, and cookies | Ensure the security of the Platform, prevent fraud, identify and correct errors, and comply with legal obligations (Marco Civil da Internet). |
| In project configuration | Title, description, context documents, screener questions, video conference links, dates and shifts | Allow the configuration and execution of research projects created by the User. |
| When uploading contact lists | Name, email, phone, and other data from the user's own contact lists | Enable the User to invite their own contacts to participate in surveys, under their responsibility. |
| In Screeners' responses | Participant Responses to Demographic, Professional, and Behavioral Criteria | Verify participant eligibility for User projects. |
| In device metadata | Participant Audio, Camera, and Connection Status (Working or Malfunctioning) | Validate the Participant's technical readiness for remote sessions and reduce operational failures. |
| In payments and billing | Billing data, Credit history, incentive records paid to Participants | Process the billing for contracted services, manage credit balance, and operationalize incentive payments. |
| In compliance documents | TCLEs signed and other documents sent by the User or Participant | Custodiar legal documents related to User projects with integrity. |
| In the use of the AI Research Assistant | User-entered inputs, conversation history, User identifier, usage metadata (date, time, session duration), and generated Outputs | Enable AI chat functionality for organizing and systematizing research ideas, preventing abuse, and fulfilling legal obligations. |
Some data that can be transmitted through the Platform is considered sensitive by the LGPD and requires special care.
In accordance with Article 5, item II, of the LGPD, information about racial or ethnic origin, religious conviction, political opinion, data concerning health, sexual life, genetic or biometric data, among others, are considered Sensitive Personal Data.
In the context of UserX, sensitive data may primarily appear when the User configures Screeners or surveys that request this information from Participants (e.g., surveys involving diversity, health, or behavior).
How we handle sensitive data:
User ResponsibilityIt is incumbent upon the User (Controller) to obtain specific and prominent consent from Participants for the collection of sensitive data, or to utilize another legal basis provided for in Article 11 of the LGPD, as applicable.
UserX Performancewe act as an Operator in the processing of this information, processing it exclusively according to the User's instructions and the limits of these Terms.
Enhanced securitySensitive data is handled with additional layers of protection, including restricted access control and encryption.
SealsThe User is prohibited from using sensitive data for discriminatory or illicit purposes, as well as from entering it into the AI Research Assistant's Inputs.
To clarify “who is responsible for what,” UserX plays distinct roles depending on the type of data being processed:
| DICE TYPE | USERX'S ROLE | USER ROLE |
| User and team registration data | Controller | Data controller, or responsible for your invited collaborators. |
| Contact lists sent by the User | Operator | Controller, being responsible for the legal basis and legitimacy of the collection. |
| Screeners and Participant Data collected in projects | Operator | Research controller, responsible for purpose, legal basis, and Participant rights. |
| Inputs and Outputs of the AI Research Assistant | Usage log controller; | Owner of the entered Inputs; responsible for the content, legitimacy, and absence of third-party personal data in the Inputs. |
| Access logs, security data, billing | Controller | — |
When acting as the Operator, we process data exclusively according to the User's instructions, within the limits of LGPD and the established contract. Participant requests to exercise rights over research data should be directed to the User, who is the data Controller.
To process personal data, UserX always relies on one of the legal grounds provided by the LGPD:
| LEGAL BASIS | WHEN DO WE USE |
| Execution of contract (Art. 7, V, LGPD) | To create and maintain your account, enable platform use, process payments, manage credits, and store files. |
| Consent (Article 7, I and Article 11, I, LGPD) | When we need your express authorization, such as for sending marketing communications or for Users to process sensitive data, or for the international transfer of Inputs to the artificial intelligence provider. |
| Legal obligation (Art. 7, II, LGPD) | To fulfill obligations such as log retention (Marco Civil da Internet), issuing invoices, or complying with authorities' orders. |
| Legitimate interest (Art. 7, IX, LGPD) | To improve the Platform, personalize the experience, prevent fraud, ensure security, and conduct internal analyses, always with impact assessment and respect for your rights. |
| Fraud prevention (Art. 11, II, “g”, LGPD) | To authenticate identities, ensure the security of registrations and transactions, and protect Users, Participants, and UserX itself against fraudulent activities. |
| Regular exercise of rights (Article 7, VI, LGPD) | When necessary for the regular exercise of rights in judicial, administrative, or arbitration proceedings. |
To operate UserX and offer all its functionalities, we need to share data with some partners and suppliers. This is done securely and only for legitimate and previously informed purposes.
| WITH WHOM | WHAT DATA | WHY |
| Cloud infrastructure partners | Registration data, project data, files, and documents | Secure hosting, processing, and backup of Platform information. |
| Communication providers (email, WhatsApp, Slack) | Email, phone, and notification messages | Sending operational notifications to Users, the team, and Participants, as configured. |
| Payment processors | User financial data and required data for paying incentives to Participants | Process billing for contracted credits and operationalize incentive payments when intermediated by UserX. |
| Video conferencing tools (Zoom, Google Meet, Teams, etc.) | There is no direct sharing through the Platform; links are manually inserted by the User. | Performance of remote sessions, under the terms of the third-party platforms themselves. |
| Analysis and monitoring tools | Platform Usage, Navigation, and Performance Data | Usage analysis, experience improvement, and security and performance monitoring. |
| Generative AI provider | User-entered inputs in the AI Search Assistant and technical usage metadata | Enable the generation of responses by artificial intelligence, as detailed in Section 13. |
| Public authorities and regulatory bodies | Data required by law or court order | Compliance with legal, judicial, or regulatory requirements. |
UserX does not sell personal data to third parties. All partners are contractually obligated to process this information only for authorized purposes and to protect it in accordance with the LGPD.
We keep personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with legal and contractual obligations.
While the User's account is active, their data will be maintained. In case of cancellation, the data will be deleted or anonymized within 15 (fifteen) business days, notwithstanding hypotheses of legal retention.
Some data may be retained for specific periods:
Access logs: for at least 6 (six) months, according to the Marco Civil da Internet.
Tax and accounting documents: within the deadlines established by applicable tax legislation.
TCLE documents and project files: for as long as the contractual relationship with the User lasts, or for the period requested by the User, unless otherwise required by specific legal obligations.
AI Research Assistant conversation history: while the account is active, or for the period selected by the User in the feature settings, and can be deleted by the User at any time.
After the retention period, the data will be permanently deleted or anonymized so that it can no longer identify you.
Data security is a priority. UserX adopts technical and administrative measures to protect information against unauthorized access, loss, alteration, or improper disclosure.
9.1. Technical Measures:Cryptographyencrypted data in transit (TLS) and at rest.
Access controlRestricted access for authorized personnel, with logging and monitoring.
Multi-Factor Authentication (MFA)required for access to critical systems.
Magic Linktemporary link authentication, reducing risks associated with reused passwords.
Firewalls and intrusion detectionInfrastructure protection against external attacks.
Regular backupsbackups to ensure recovery in case of failures.
Internal policiesInformation security and privacy policies and procedures.
TrainingPeriodic training for employees on data protection.
Confidentiality agreementssigned by all employees and partners with access to personal data.
Vendor Managementevaluation and hiring of partners that meet adequate security and privacy standards.
Despite all efforts, no system is 100% secure. That’s why you also play a key role in protecting your data:
Keep your email access secure, as it is the central point of authentication.
Use strong, unique passwords and enable multi-factor authentication when available.
Log out of shared devices.
Be wary of suspicious communications: UserX will never ask for your password via email.
When using the AI Research Assistant, DO NOT enter Participant personal data, sensitive data, or confidential information into the Inputs.
In case of doubt or suspected incident, please contact us at privacidade@userx.com.br.
Some of our infrastructure, communication, and analytics partners have servers located outside of Brazil. This means your data may be transferred to other countries.
When this occurs, UserX ensures that transfers are carried out in compliance with the LGPD, adopting contractual and technical measures to ensure a level of protection equivalent to that required by Brazilian legislation.
| SERVICE CATEGORY | PURPOSE OF TREATMENT | Countries/Regions of Possible Transfer |
| Cloud infrastructure and hosting | Platform storage, processing, backup, and availability | Brazil; United States; European Union |
| Communication and Notification Services | Email, push notifications, WhatsApp, and Slack messages | United States; European Union |
| Usage and monitoring analysis | Statistical analysis, experience improvement, and application security | United States; European Union |
| Development and versioning tools | Source code development, maintenance, and versioning | United States |
| Payment processors | Credit Collection and Incentive Payment to Participants | Brazil; United States |
| Generative artificial intelligence services | Processing of AI Research Assistant Inputs and Generation of Outputs | People's Republic of China |
In the event of a data leak or security incident that could generate significant risk or damage, UserX will act quickly:
Analysis and containmentImmediate investigation to understand the nature, scope, and impact of the incident, with the adoption of appropriate containment measures.
Notification to ANPDcommunication to the National Data Protection Authority within 72 (seventy-two) hours, as required by Resolution CD/ANPD No. 15/2024.
Notice to HolderWe will inform the affected Data Subjects clearly and objectively, describing the nature of the data involved, the risks, and the measures adopted to reverse or mitigate the effects.
Communication channelpreferably by email registered with the account, or by notification within the Platform.
User CooperationWhen UserX acts as an Operator, it will provide all necessary support to the Controlling User so that they may comply with their legal obligations to the Data Subjects and the ANPD.
Cookies are small text files stored on your device when you use the Platform. They help remember your preferences and improve your experience.
| COOKIE TYPE | What is it for | CAN I REFUSE? |
| Essentials | They are fundamental to the Platform's operation, allowing login (including via Magic Link), navigation, and use of key functionalities. | Not required (for the Platform to function) |
| Analytics | They help understand how Users interact with the Platform, identifying the most visited screens and opportunities for improvement. | Yes |
| Marketing | They allow the sending of personalized communications and offers based on the use of the Platform. | Yes |
| Security | They detect suspicious activities, prevent fraud, and protect the account from unauthorized access. | No |
You can manage cookie settings directly in your browser's settings. However, disabling certain cookies may affect the functionality of the Platform.
UserX may use automated technologies and artificial intelligence to optimize the Platform's experience and operation. This includes:
Screener Criteria SuggestionsBased on the user's project history.
Pattern detection and fraud preventionto identify inconsistent responses or suspicious behavior.
Technical diagnostics of devicesAutomated validation of participants' audio, camera, and connection.
AI Research AssistantThird-party generative artificial intelligence-based chat functionality that assists the User in organizing and systematizing research ideas.
For the correct functioning of the AI Research Assistant, UserX integrates a generative artificial intelligence service provided by a third party. Therefore, it is important that the User is aware of the following:
Assignment to third partyThe inputs entered by the User are transmitted and processed within the third-party provider's infrastructure, as indicated in Section 10.
Processing Location: The processing of inputs occurs on servers located outside of Brazil, including in countries that are not currently on the list of countries with an adequate level of protection recognized by the ANPD.
Vendor treatment: The Inputs are subject, where applicable, to the own policies of the artificial intelligence provider, which may foresee, among other practices, the use of Inputs and Outputs for operational, improvement, maintenance, or training purposes of its models.
Mitigations adopted by UserXTo mitigate these risks, UserX adopts measures such as contractual restrictions for Users, internal usage logs for auditing, and specific clauses in the Terms of Use.
User SealTo reduce risks, Users are prohibited from entering personally identifiable information (their own or third-party data), sensitive data, or confidential information under seal into the Inputs, as detailed in the Terms of Use.
Non-binding natureThe AI Research Assistant does NOT make decisions with legal or similarly significant effects on the User or on Participants. The Outputs are merely auxiliary to the User's human activity.
Possibility of non-useThe use of the AI Research Assistant is optional. The User may choose not to use the feature without prejudice to the use of other Platform functionalities.
In accordance with Article 20 of the LGPD, you have the right to request a review of decisions made solely based on automated processing that significantly affect your interests, including requesting information about the criteria and procedures used. To exercise this right, please contact us via email at privacidade@userx.com.br.
The LGPD guarantees several rights regarding your personal data. UserX commits to respecting and facilitating the exercise of these rights.
| YOUR RIGHT | What does that mean in practice |
| Access | You can request and receive a copy of the personal data we have about you. |
| Correction | You can request the correction or update of any incorrect or outdated personal data. |
| Exclusion | You can request the deletion of personal data, subject to legal retention requirements. |
| Anonymization or blocking | You may request the anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data in accordance with the LGPD. |
| Portability | You can request to receive your data in a structured, commonly used, and machine-readable format so that it can be transferred to another provider. |
| Revocation of consent | You can withdraw your consent for processing at any time, with no retroactive effect. |
| Sharing information | You have the right to know which public or private entities we share your data with. |
| Opposition | You can object to treatments that you consider abusive or not in accordance with the LGPD. |
| Review of automated decisions | You can request a review of decisions made solely based on automated data processing. |
To exercise any of these rights, contact us via email at privacidade@userx.com.br. We will respond to your request within the legal timeframe, within 15 (fifteen) days.
Important: When UserX acts as the Operator—especially regarding Participant data collected in User projects—the request must be directed to the Controller User of the corresponding research. We will do our best to assist in forwarding the request.
The UserX platform is intended exclusively for individuals over 18 (eighteen) years of age or duly represented legal entities. We do not intentionally collect personal data from children or adolescents for the purpose of using the Platform.
If a project created by the User involves the recruitment of minor Participants, it is the sole responsibility of the User (Controller) to obtain the specific and informed consent of at least one parent or legal guardian, as required by Article 14 of the LGPD, and to adopt all applicable additional precautions.
If you are a parent, mother, or legal guardian and believe that a child's or adolescent's data was improperly handled through the Platform, please contact us immediately by email at privacy@userx.com.br.
UserX will only send marketing emails or promotional communications with prior user authorization (anti-spam policy).
You can unsubscribe from these communications at any time by clicking the unsubscribe link in the emails or by emailing privacy@userx.com.br.
Essential operational communications (project notices, billing, changes to these Terms or the Privacy Policy) are not considered marketing and may continue to be sent as long as the account is active.
This Privacy Policy may be updated at any time to reflect changes in our practices, legislation, or Platform functionalities.
For relevant changes that affect rights or the way data is handled, we will notify you in advance via a notification on the Platform and/or by email.
Continued use of the Platform after the notice period implies acceptance of the new terms. If you do not agree with the changes, you may cancel your account as provided in the Terms of Use.
UserX has a Data Protection Officer (DPO) responsible for ensuring compliance with this Policy and LGPD. They are the point of contact between you, UserX, and the National Data Protection Authority (ANPD).
You can contact the DPO for any questions or requests regarding privacy and data protection:
NameLucas Adbis Pinheiro Gonçalves
Emailprivacy@userx.com.br
AddressRua Gonçalves Ledo, nº 777, Rooms 1311 to 1317, Centro, Postal Code 60.110-261, Fortaleza/CE
If you have any questions about this Privacy Policy or how your data is handled, please contact us:
General support channelsupport@userx.com.br
Data Protection Officer (DPO) Channelprivacy@userx.com.br
AddressRua Gonçalves Ledo, nº 777, Rooms 1311 to 1317, Centro, Postal Code 60.110-261, Fortaleza/CE
Thank you for trusting UserX!
USERX HUB LTDA, CNPJ: 55.155.104/0001-67
Address: Rua Gonçalves Ledo, nº 777, Rooms 1311 to 1317, Centro, Postal Code 60.110-261, Fortaleza/CE
Support email: support@userx.com.br
Privacy email: privacy@userx.com.br
