Privacy Policy

Who we are

ConQuest is a conversational questionnaire platform operated by All Too Human Ltd (“ConQuest”, “we”, “us” or “our”), a company registered in England & Wales (company number 15336127) with its registered office at 15 Hawkins Grove, Church Crookham, Fleet, GU51 5TX.

For the purposes of UK data protection law — the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 — we are the “data controller” for the personal data described in this policy, except where we process questionnaire responses on behalf of a customer (see Questionnaire data).

ConQuest is currently in a pre-launch phase. Our public website primarily offers a waitlist, while the questionnaire product is being made available to early users. This policy covers all of these activities.

The personal data we collect

Waitlist sign-ups

When you join our waitlist we collect your name, email address, an optional description of your intended use case, and a record of which part of the site you signed up from. We use this to contact you about access and to understand demand.

Account information

If you create an account, we collect your name, email address and an encrypted (hashed) password. If you sign in through a third-party provider, we receive basic profile information from that provider. We also keep records relating to your account, such as authentication sessions and security events.

Questionnaire data

ConQuest lets organisations turn a questionnaire into a streaming conversation. Depending on your role:

• As an author/administrator, we process the questionnaire documents and configuration you upload to build and run a questionnaire.
• As a respondent, we process the responses you give during the conversation. These responses, and any profile information captured during a session, may contain personal — and potentially sensitive — information, depending on the questions asked by the organisation running the questionnaire. Where a questionnaire is offered in anonymous mode, we limit the identifying information associated with your responses.

Where an organisation uses ConQuest to collect responses from its own respondents, we generally act as a “data processor” and that organisation is the controller responsible for deciding what is asked and why.

Messages you send us

If you contact us — for example through our contact form or by email — we process the information you choose to provide so we can respond.

Technical and usage data

Like most online services, our servers automatically record technical information such as a timestamp, the pages requested, a signed visitor identifier (see Cookies), and diagnostic logs. We use this for security, to keep the service running, and to understand usage in aggregate.

How we use your data and our lawful bases

Under UK GDPR we must have a lawful basis for processing your personal data:

• Consent — joining the waitlist, sending you marketing communications, and setting non-essential cookies. You can withdraw consent at any time.
• Performance of a contract — creating and managing your account and providing the questionnaire service to you.
• Legitimate interests — securing the service, preventing fraud and abuse, maintaining essential cookies, and improving and developing ConQuest, where these interests are not overridden by your rights.
• Legal obligation — complying with the law, including responding to lawful requests and meeting our accountability duties.

Who we share your data with

We do not sell your personal data. We share it only with the categories of recipient needed to run the service:

• Cloud hosting and infrastructure providers who store and serve the application and its database.
• Email delivery providers who send transactional and waitlist emails on our behalf.
• AI / large language model (LLM) providers who process questionnaire conversations to power the conversational experience (see AI processing).
• Analytics or product-measurement providers, where you have consented to non-essential analytics.
• Professional advisers, authorities and acquirers — where required by law, to enforce our terms, or in connection with a business sale or reorganisation.

We require our service providers to process personal data only on our instructions and to keep it secure. A current list of the specific providers we use is available on request from privacy@humancentricengineering.com.

AI processing

ConQuest’s conversational experience is powered by third-party AI / LLM providers. To run a questionnaire as a conversation, the relevant questionnaire content and your responses are sent to these providers to generate the next part of the conversation. Because AI-generated output can be inaccurate or incomplete, it should not be relied on as professional advice. We choose providers that commit not to use data submitted through their APIs to train their general models, but you should not include information in a response that you would not want processed in this way.

International transfers

Some of our service providers may process personal data outside the UK. Where they do, we rely on appropriate safeguards recognised under UK data protection law — such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses — so that your data remains protected.

Cookies and similar technologies

We use two categories of cookie and similar technology:

• Essential (always active) — needed for the site to work, including authentication, security, and remembering your theme preference. This includes a signed visitor identifier cookie used for security and aggregated, non-identifying analytics in our server logs; it contains no personal data and lasts around 180 days.
• Optional (consent required) — analytics, marketing, and other non-essential cookies, set only if you agree.

You can review and change your choices at any time using the Cookie Preferences link in the site footer.

How long we keep your data

We keep personal data only for as long as we need it for the purposes set out in this policy. Waitlist details are retained until we have triaged your interest or you ask us to remove them. Account and questionnaire data is retained for the life of your account and deleted (or anonymised) when you delete your account or when an organisation closes its questionnaire, subject to any legal retention obligations. Diagnostic logs are kept for a limited period and then purged.

Your rights

Under UK GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to our processing in certain circumstances;
• receive certain data in a portable format;
• withdraw consent where we rely on it; and
• opt out of marketing at any time.

If you have an account, you can delete it — and the personal data associated with it — from your account settings. To remove yourself from the waitlist, or to exercise any other right, contact us at privacy@humancentricengineering.com. We will respond within the time limits required by law.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would, however, appreciate the chance to address your concerns first.

Children

ConQuest is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us so we can remove it. Where an organisation uses ConQuest to collect responses from children, that organisation is responsible for obtaining any consent required.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where the changes are significant, take reasonable steps to let you know.

Contact us

If you have any questions about this Privacy Policy or how we handle your data, contact us at privacy@humancentricengineering.com, or write to us at All Too Human Ltd, 15 Hawkins Grove, Church Crookham, Fleet, GU51 5TX.