Please rotate your device

Dlyte works best in portrait mode. Please rotate your phone to continue.

DLYTE Logo

Privacy Policy

Last updated: 28 October 2026

About This Policy

Introduction

This Privacy Policy is issued by Dlyte Pty Ltd (ACN 636 076 885) ("Dlyte," "we," "our," or "us"). Dlyte is committed to protecting your privacy and handling your personal data in accordance with applicable data protection laws, including the Australian Privacy Act 1988 (Cth), the EU/UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA) where applicable.

This Privacy Policy explains how we collect, use, store, and disclose your personal information when you use our platform at dlyte.io (the "Platform") — a two-sided marketplace connecting businesses with qualified product testers.

Definitions

In this Privacy Policy, we use the following terms:

  • "Business" refers to individuals or organisations that use the Platform to create testing projects, define audience criteria, and receive research signals about their digital products.
  • "Tester" refers to individuals who register on the Platform to participate in product testing opportunities and receive compensation for their contributions.
  • "Visitor" refers to anyone browsing our website or enquiring about our services without a registered account.
  • "Guest observer" refers to someone given a shareable link to watch and listen to a moderated study room without needing a registered account.

You may belong to more than one of these groups, in which case multiple sections of this Privacy Policy will apply to you.

Our Role

Dlyte as data controller: We act as a data controller when we collect and process personal data directly from you — for example, when you register an account, build a tester profile, create a testing project, or contact us. As data controller, we determine the purposes and means of processing your personal data.

Dlyte as data processor: When facilitating testing projects on behalf of Businesses, we may process Tester data on the Business's instructions. In these cases, the Business acts as the data controller and Dlyte acts as a data processor. We encourage you to review the privacy policies of any Business whose testing projects you participate in.

Information We Collect

For All Users

  • First name and last name
  • Email address and password (encrypted)
  • Authentication data (password, Google login, or Microsoft organisational sign-in if used)
  • For Business accounts, work-email verification status, verification method, and verification date
  • Session information and login history
  • User preferences and dashboard settings
  • Returning user preference — your account type (business or tester) is stored in your browser so you are directed to the appropriate sign-in page on return visits. This can be cleared by deleting your browser data.

For Testers

We collect profile information to help Businesses find qualified Testers. We use it to match you with relevant testing opportunities. Businesses may receive relevant individual participant information for their studies, as explained in Data Sharing and Phone Verification below; it is not always anonymised or aggregated.

Demographics & Location:

  • Date of birth (to determine age range: 18-25, 26-35, 36-50, 51-64, 65+)
  • Gender identity
  • Location (country, state/region)
  • Area type (metropolitan or regional)
  • Cultural background (optional, for diversity insights)

Languages & Proficiency:

  • Languages spoken (up to 4 languages)
  • Proficiency level for each language (Native, Fluent, Conversational, or Basic)
  • Multilingual capability classification

Family & Lifestyle:

  • Marital status
  • Household income range (combined income of your household)
  • Personal income range (your own income)
  • Parental status (whether you have children under 18) and number of children
  • Home ownership status (renting, own outright, mortgage, or other)
  • Education level (high school, trade/vocational, undergraduate, postgraduate, or other)
  • Online shopping frequency (optional)

Professional Information:

  • Employment status (Full-time, Part-time, Self-employed, Student, Retired, etc.)
  • Business affiliation (whether you are a business owner, employee of a business, or neither)
  • Company size and your role in the company (if applicable)
  • Employment industry sectors (if applicable)

Accessibility & Inclusivity:

  • Functional access needs (vision, hearing, motor, cognitive support requirements)
  • Assistive technology usage (optional)
  • Note: All accessibility data collection includes "Prefer not to say" options

Technology & Devices:

  • Web expertise level (Beginner, Intermediate, Advanced, Expert)
  • Devices owned (smartphones, tablets, laptops, desktops)
  • Browsers used (Chrome, Firefox, Safari, Edge, etc.)
  • Operating systems

Industry Interests:

  • Industries you are interested in testing for
  • Product testing preferences

Sector-Specific Behavioural Data:

When you express interest in certain industry categories, you may be invited to complete additional profile questions specific to those sectors. Completing these optional modules improves your eligibility for more relevant — and often higher-paid — testing studies. The sector modules and the types of data collected are:

  • Housing & Real Estate — property ownership, investment property activity, home purchase timeline, and real estate behaviour
  • Telecommunications — current provider, plan type, switching history, monthly spend, and services used
  • Banking & Finance — primary bank, financial products held, banking preferences, switching history, and buy-now-pay-later usage
  • Insurance — insurance types held, primary provider, claims history, and comparison shopping behaviour

These modules are entirely voluntary. You choose which sectors to complete based on your interests, and you can update or remove your responses at any time.

Reliability & Quality Data:

To maintain the quality of our testing community and ensure fair matching, we track platform usage patterns and response quality metrics. This includes study completion rates, response consistency, and engagement history. This data is used internally to prioritise reliable Testers for study opportunities and is not shared with Businesses.

Earnings & Payout Information:

  • Your country and the recorded market and currency of each earning, used to determine the payout options available to you
  • Your selected payout method, recipient name and email where required, amount, currency, transaction references, and provider issuance or delivery status
  • For Australian bank transfers, your account name, BSB and account number; these details also support payout-security checks where applicable
  • For electronic rewards, the selected reward and secure reward-access records where provided. Australian options may include GiftPay eGifts in AUD; international USD reward and PayPal options are provided through Tremendous where available

You choose from the available methods in Earnings → Withdrawal and review and confirm before a payout is requested. Australian bank details are not required solely to select an electronic reward.

Account Security & Fraud Prevention:

  • Verified phone number and normalised email information used to support account uniqueness
  • A first-party browser/device identifier, privacy-protected network identifier, and associated first-seen and last-seen observation dates
  • A privacy-protected payout-recipient identifier derived from bank details, including current and historical payout-recipient relationships
  • Derived relationships between accounts and internal review status, reasons, and decisions

We do not use invasive canvas, font, audio, biometric, or hardware fingerprinting. A shared IP or network alone does not connect accounts, block an account, or hold a payout. Connected-account investigation tools and review decisions are restricted to authorised Dlyte administrators. Privacy-protected bank, device, and network identifiers are not provided to Businesses.

Study Participation & Legal:

  • Confidentiality Agreement timestamp: When you apply to a moderated research study, we record the date and time you acknowledged Dlyte's Confidentiality Agreement. This timestamp is stored against your booking as a legal record of your agreement and is accessible to Dlyte and the Business running the study.
  • Recording consent: Where you provide explicit consent to being recorded in a session, we store a timestamp, your IP address, and session identifier at the point of consent.

For Businesses

  • The Business account holder's first name and last name, collected separately from the company name
  • Company name and website. The company name is entered separately by the account holder and is locked after it is first saved
  • If Microsoft organisational sign-in is used, Microsoft may provide the account holder's given name, family name, and work email address. We do not use the account holder's Microsoft display name as the company name
  • Business type (Startup, Agency, Enterprise, etc.)
  • Agency type (if applicable: Digital, Marketing, Consulting, etc.)
  • Primary industry or client industries served
  • Company size and location
  • Contact information
  • Calendar integration data (optional): If you choose to connect your Google Calendar or Microsoft Outlook Calendar, we access your OAuth access token and, solely for the purpose of creating and managing session events, we write calendar events on your behalf. We do not read, store, or process any existing calendar events, contacts, or other calendar data. Access tokens are encrypted at rest. You can revoke calendar access at any time from your account settings.

For Visitors

  • Analytics data collected through cookies (see Cookies & Analytics below)
  • Enquiry details if you contact us

Fraud Prevention and Platform Integrity

Dlyte processes account, device, network, and payout-recipient information to protect genuine participation, prevent duplicate or coordinated Tester accounts, and reduce payout abuse. Our controls may identify strong relationships between accounts using verified phone, payout-recipient, or first-party device evidence. Strong relationships may be combined to identify a connected group of accounts, including where the relationship is indirect.

For Business accounts, we verify an eligible work email when the account is created or reverified, and renew that verification every 90 days. We use this verification to protect business account access and sensitive actions such as purchasing, publishing, recruiting, and team administration.

  • Shared network information is supporting context only and is not treated as proof that accounts belong to the same person.
  • Automated checks may surface a case or temporarily hold a payout while the evidence is reviewed.
  • Authorised Dlyte administrators make approval, blocking, and final payout decisions; we do not permanently block an account or payout solely through automated processing.
  • Review decisions may be reconsidered when the membership of a connected account group changes, while a confirmed block may remain effective to prevent repeated abuse.
  • Businesses and researchers do not receive raw bank details, device identifiers, network identifiers, connected-account investigation tools, or internal review decisions.

If you believe a security decision affecting your account or payout is incorrect, you may contact us to request an explanation and human review.

Sensitive Data

Some information we collect — such as accessibility needs, cultural background, and gender identity — may be considered sensitive or special category data under applicable data protection laws. We only collect this data with your explicit consent, and you always have the option to select "Prefer not to say" or leave these fields blank. This data is used solely for the purpose of matching you with relevant testing opportunities and providing anonymised, aggregated insights to Businesses.

Lawful Basis for Processing

We process your personal data under the following lawful bases:

Contract:

  • Registering and managing your account
  • Matching Testers with relevant testing projects
  • Processing payments between Businesses and Testers (Dlyte retains a service fee from each transaction to cover platform operations, payment processing, and quality assurance)
  • Communicating about your account and active projects

Legitimate Interest:

  • Improving our Platform and user experience (e.g., fixing bugs, optimising performance, refining UI — this does not include AI model training)
  • Ensuring platform security and preventing fraud
  • Generating anonymised, aggregated tester insights for Businesses
  • Analysing platform usage to develop better features (e.g., understanding which features are most used — this does not involve sharing your data with AI providers or third parties)

Consent:

  • Collecting sensitive data (accessibility, cultural background, gender identity)
  • Sending marketing communications (you can withdraw consent at any time)
  • Using non-essential cookies and analytics

Legal Obligation:

  • Complying with applicable laws and regulations
  • Responding to lawful requests from authorities

How We Use Your Information

We use the information we collect to:

  • Provide and maintain our marketplace services
  • Match Businesses with qualified Testers based on their requirements
  • Generate tester insights and analytics for Business users (anonymised and aggregated)
  • Power AI-assisted features such as audience segmentation analysis (using non-personal, aggregated criteria only)
  • Process and facilitate testing jobs and payments
  • Communicate with you about your account, jobs, and platform updates
  • Improve our Platform and user experience
  • Ensure platform safety and prevent fraud
  • Comply with legal obligations

Consequences of Not Providing Data

You are not obligated to provide personal information to us. However, if you choose not to provide certain information, we may not be able to register your account, match you with testing opportunities, process payments, or provide you with the full functionality of our Platform. Where data is optional (such as cultural background or accessibility needs), choosing not to provide it will not affect your ability to use the Platform.

Tester Insights & Analytics

For Business users, we provide aggregated tester insights showing demographic trends, technology distributions, accessibility needs, cultural diversity, and language capabilities across our tester pool. This data is anonymised and presented in aggregate form only— we never share individual Tester profiles or personally identifiable information without explicit consent.

AI-Assisted Features & Automated Processing

Dlyte uses artificial intelligence to enhance the Platform experience. We are committed to transparency about how AI is used and what data is involved.

What AI features do

AI-assisted features analyse criteria selections made by Business users (such as age ranges, location preferences, and device types) to help identify whether those selections represent one audience group or multiple distinct segments. These features are advisory — Businesses always make the final decision.

What data is processed by AI

  • Only aggregated, non-personal criteria categories selected by Businesses (e.g. "Age Range: 18-25, 26-35" or "Area Type: Metro")
  • No personal Tester data — individual names, emails, profiles, or identifiable information are never sent to AI services
  • No biometric data, health data, or special category data is processed by AI

Third-party AI providers

AI processing is performed by OpenAI (see Third-Party Services below). Data sent to OpenAI is subject to their data processing terms and is not used by OpenAI to train their models. We select AI providers that offer enterprise-grade data protection and processing agreements.

Your rights regarding automated processing

AI-generated suggestions do not make binding decisions about individuals. They assist Business users in organising their audience criteria. You have the right to request information about how automated processing affects you, and to have any concerns addressed by contacting us (see Contact Us below).

No AI Training on Your Data

We want to be unambiguous on this point: Dlyte does not use any user data — from Businesses or Testers — to train, fine-tune, or improve AI or machine learning models, whether internally or through any third party. This includes:

  • Business-uploaded content (prototypes, briefs, research questions, screenshots, recordings, product strategy)
  • Tester feedback, responses, profiles, and testing results
  • Communications between users and the Platform
  • Analytics data, usage patterns, or behavioural data

Our AI provider (OpenAI) operates under enterprise API terms that explicitly prohibit the use of API data for model training. We do not use data for "service improvement" in any way that involves AI training. If this policy ever changes, we will notify all users at least 60 days in advance and provide a clear opt-out mechanism before any change takes effect.

Unmoderated Test Recordings (Website Tasks, Video & Voice Responses)

Depending on the testing method and study settings, Businesses may request recordings of website tasks, screen activity, and video or voice responses. Website-task recordings are separate from clips recorded with a participant's camera and microphone to answer individual questions. This section explains how we handle that data.

What Is Captured

  • Website-task activity or a shared screen, window or tab, where requested and explained in the study instructions
  • Camera video and microphone audio during the recording steps selected for the study, including per-question responses
  • Recording duration and task timing, including when interaction with a website task begins and recording stops
  • Research recording occurs during the task or response-recording steps disclosed to the participant; it is separate from optional FullStory analytics

Consent

We explain the required recording scope and request explicit consent before the relevant recording begins. Browser permissions for local camera, microphone or screen access are requested where those features are used. Where a study offers written responses instead of optional video, participants may choose that alternative. If a recording is required for a particular study, a participant may decline and leave the study rather than complete the required recorded task.

Remote Website Tasks Using Browserless

Where enabled, we use Browserless to run a website in a remote browser, display an interactive website view within Dlyte, and capture the website-task recording. This supports website-based usability, task-based and other research testing, including mobile-sized website views on a computer. A mobile-sized remote view is not a recording of a physical phone. Mobile and desktop studies may use different recording paths; not every study uses Browserless.

Browserless processes the target website address, page content, interactions and any information entered into that remote website, together with recording and technical session data needed to operate the task. The remote website recording is saved to Dlyte's private storage for research review. This remote recording does not automatically capture your computer desktop, other local applications, camera or microphone. Any separate screen, camera or microphone recording is explained in the study instructions and subject to the relevant consent and permissions.

Information entered into a website during a recorded task may appear in the research recording. Avoid entering unnecessary personal, financial or sensitive information. The website being tested may also process information under its own privacy policy. Browserless-powered task recording is not enabled or disabled by the optional Analytics cookie setting.

How Recordings Are Processed

  • Recordings are uploaded directly to secure, encrypted Object Storage during the test session
  • After submission, the audio portion of each recording is sent to OpenAI's speech-to-text service for transcription. Only the audio is sent — no video frames are transmitted to OpenAI
  • The resulting transcript text is stored alongside the recording for the Business to review
  • Transcription is a one-time processing step — recordings are not re-processed or analysed further

Storage & Access

  • Recordings are stored in encrypted Object Storage with AES-256 encryption at rest
  • Access is restricted to the Business that created the test and authorised Dlyte platform administrators
  • Recordings are processed by the service providers needed to deliver the recording, storage and transcription features described in this Policy, and are otherwise not disclosed to unrelated parties unless required by law
  • No recordings are made publicly accessible

Retention

Unmoderated test recordings and their transcripts are retained until the Business or participant requests deletion. Businesses may request deletion of recordings at any time. Participants may also request deletion of their video recordings via the data deletion process.

No AI Training

Consistent with our platform-wide policy, video recordings and their transcripts are never used to train, fine-tune, or improve any AI or machine learning models, whether internally or through any third party. OpenAI processes audio solely for one-time transcription under enterprise API terms that prohibit the use of data for model training.

Moderated Session Recordings

When a Business runs a moderated research session through the Platform, the live video conference between the moderator (Business) and the participant (Tester) is recorded. This section explains how we handle moderated session recording data.

What Is Captured

  • Full video and audio of the live session, including both the moderator and the participant
  • Session duration and timing metadata
  • The recording is a composite view of all participants — individual streams are not stored separately

Consent

DLYTE collects explicit, informed consent from participants at three points in the session journey:

  • At study application — participants are notified that sessions are recorded before they apply for a study
  • Immediately before joining — participants must check two explicit consent boxes before the session room opens: one confirming consent to recording, and one confirming agreement to keep study materials confidential. The session room URL is only provided after this consent is submitted
  • During the session — a recording indicator is displayed in the platform interface while the session is active

Consent records are stored against the participant's booking and include the consent timestamp, IP address, browser/device identifier, and the session identifier. Consent is re-confirmed on each join. The session is conducted via a third-party video conferencing service (Daily.co).

How Recordings Are Processed

  • Sessions are recorded via Daily.co, our video conferencing provider, and transferred to Replit's managed cloud object storage (backed by Google Cloud Storage) for secure storage
  • After the session, the audio portion of the recording is sent to ElevenLabs' speech-to-text service for transcription. Only the audio is sent — no video frames, participant names, or identifying information are transmitted to ElevenLabs
  • The resulting transcript is stored in the Platform database for the Business to review
  • Transcription is a one-time processing step — recordings are not re-processed or analysed further

Storage & Access

  • Recordings are stored in our cloud infrastructure (Google Cloud, US-based data centres)
  • Access is restricted to the Business that created the study and authorised Dlyte platform administrators
  • Recordings are not shared with any other party unless required by law
  • No recordings are made publicly accessible
  • Access links to recordings are temporary and expire — a fresh link is generated each time a Business opens the session review

Retention

Moderated session video recordings are subject to a 75-day retention policy. After 75 days, the video recording is permanently deleted from our servers. This policy exists to limit the storage of sensitive participant data and to align with responsible research data practices.

  • Businesses receive an email warning 14 days before a recording is due to expire
  • A second warning is sent 3 days before expiry
  • Businesses may download recordings at any time before expiry via the Session Review panel
  • Once deleted, the video cannot be recovered — Businesses are responsible for downloading copies if they wish to retain recordings beyond 75 days

Transcripts are not affected by video deletion. Session transcripts, notes, and highlights remain available indefinitely and are not subject to the 75-day retention window.

No AI Training

Consistent with our platform-wide policy, moderated session recordings and their transcripts are never used to train, fine-tune, or improve any AI or machine learning models, whether internally or through any third party. ElevenLabs processes audio solely for one-time transcription and does not use data for model training.

Guest Observers in Moderated Studies

A Business can share a guest observer link to its moderated study room. Guests can watch and listen without a Dlyte account. This is separate from the invited team-observer account flow and does not give access to study setup, participant records, workspace messages or the recording library.

Information We Collect and Why

  • We collect the guest's supplied name and email address, the associated study, an access-record identifier, the acknowledgement timestamp, the accepted Guest Observer Terms version for new acknowledgements, and the meeting-access token expiry. We use these records to administer access, document acknowledgements, investigate misuse and respond to privacy or legal requests.
  • The guest form does not verify the supplied identity or email address. Joining does not create an account or subscribe a guest to marketing.
  • Before entry, guests acknowledge that the session may be recorded and agree to confidentiality and the Guest Observer Terms. We do not treat an older access record as acceptance of a newer terms version.

What Others and Our Provider Receive

Daily.co receives the guest's display name, a session-specific identifier and meeting-access token to operate the video room. The guest's email address is not included in that token. The display name and presence may be visible to others in the room and may appear in a recording if included in its layout. Guests receive the live session content, which can include participant video, audio, screen sharing and information discussed in the session. Guest cameras and microphones are disabled. Recording processing is described in Moderated Session Recordings above.

Shared-Link Access and Safeguards

Anyone a guest link is forwarded to may be able to enter after completing the form. Links use the same study room and are not limited to scheduled session slots. Businesses should share them only with authorised observers, inform participants about observers, and obtain any required permissions or consent. A Business can disable or regenerate its link; completed or cancelled studies do not accept guest entry. Guest links do not provide access to saved recordings. Dlyte does not enable optional analytics, session-replay analytics or support-chat tracking on the guest observer page.

Guest Records and Privacy Requests

Guest-access and acknowledgement records are retained with the associated study unless deleted earlier under an applicable privacy request or other requirement. Leaving the room, a meeting token expiring, or disabling a link does not itself delete those records. They are separate from the session video and its retention period. To request access, correction or deletion, use the contact details in Contact Us below and identify the study and the email address you supplied. We may need additional information to verify a request.

Profile Intro Recordings (Video & Voice)

Testers may optionally record a short "Profile Intro" — a brief video or voice self-introduction (up to 60 seconds) saved to their Tester profile. Unlike test recordings, a Profile Intro is not tied to any single test or study; it is persistent profile content that helps Businesses get to know a Tester. This section explains how we handle that data.

What Is Captured

  • A single self-introduction recording — either camera video with microphone audio, or voice audio only, at the Tester's choice
  • The recording type (video or voice) and its duration
  • The recording is started and stopped by the Tester — no background or continuous recording occurs

It Is Optional

Recording a Profile Intro is entirely optional. The Tester actively chooses to record and save it, and browser-level permissions for camera and microphone access are requested only when the Tester chooses to record. A Tester may use the Platform and participate in studies without recording a Profile Intro.

Storage & Who Can View It

  • Recordings are stored in encrypted Object Storage with AES-256 encryption at rest
  • Because a Profile Intro is part of a Tester's profile, it may be viewed by Businesses to whom the Tester is surfaced — including when the Tester is matched or suggested to one of the Business's studies or jobs, has been prioritised for one of them, is a candidate for a moderated study, or has taken part in one of the Business's tests. This means a Profile Intro can be seen during matching and discovery, before the Tester has formally applied
  • Access is otherwise restricted to the Tester and authorised Dlyte platform administrators
  • Profile Intros are not shared with any other party unless required by law, and are never made publicly accessible

Not Transcribed

Unlike test and moderated session recordings, a Profile Intro is not sent to any speech-to-text service for transcription and is not analysed further. It is stored and played back as recorded.

Retention & Deletion

A Profile Intro is retained for as long as the Tester keeps it on their profile. The Tester can replace it by re-recording, or delete it at any time from their profile — deleting a Profile Intro permanently removes the recording from our storage. Testers may also request deletion via the data deletion process.

No AI Training

Consistent with our platform-wide policy, Profile Intro recordings are never used to train, fine-tune, or improve any AI or machine learning models, whether internally or through any third party.

Phone Verification and Country Eligibility

For Australian-targeted expressions of interest and study recruitment applications, you must verify an Australian mobile before creating an account through that application or accessing its questions. This is not a requirement for simply reading the public study page or for unrelated general registration. A signed-in participant with an already verified valid Australian mobile does not need to repeat the check. These requirements follow the published opportunity's country criteria, not its payment currency.

We send an SMS verification code and use your phone number's country information. This helps check country eligibility. Verification shows access to an SMS sent to that number at that time. It does not prove residence, nationality or current physical location, and it does not guarantee selection for a study.

Information we collect and use

We process your mobile number in international format, including its country calling code (for example, +61), and derive country information from the number. We record whether verification succeeded and, when saved to a participant profile, the verification date. Temporary verification records include the number, linked opportunity, a protected representation of the code, expiry, attempt count and a link to the browser session. Request limits also use protected representations of the phone number and network address. The calling code is included in the number; it need not be stored as a separate field.

After successful verification, your number and verified status can carry across to your new participant profile or be attached to your existing profile when you sign in and continue the application. We also use verified phone information for account security, account uniqueness and duplicate-account or fraud investigations, as described in Account Security & Fraud Prevention. Verification does not subscribe you to marketing; any marketing permission is separate.

Who receives or can access it

Twilio, our SMS delivery provider, receives the destination number, DLYTE's sending number and the SMS text, including the verification code. Twilio and the telecommunications providers involved in delivery process message-routing and delivery information. DLYTE does not send your screening answers to Twilio as part of this verification message.

You can access your saved number through your account, and authorised DLYTE staff can access it for support, administration and security. Authorised business or researcher accounts can also receive the saved number in some study participant data responses. These responses are not limited to an eligibility result, even where a particular screen does not display the number. Temporary verification codes are not included in those participant responses.

Storage, expiry and deletion

A recruitment SMS code expires after 10 minutes. A successful code is consumed, and the temporary permission to continue the application expires after one hour. Request-limit records expire after two hours. Expiry stops a record being usable; it is not a promise of immediate deletion. Expired records are removed through the session store's cleanup process, and verification information held in a browser session can remain until that session is removed.

A number saved to your profile, its verification status and verification date are account data retained while the account remains in use and handled through the account-deletion process described in Data Retention below. Unresolved research, financial or security matters can affect deletion. Deleting a DLYTE account does not automatically delete SMS records held by Twilio or delivery networks. Their records follow their own retention arrangements; an account-specific deletion timetable for these provider records has not been confirmed. You can ask us about access, correction or deletion through our existing support or privacy contact routes.

SMS delivery can involve processing outside Australia, including in the United States. The precise locations, provider retention settings and transfer arrangements applicable to DLYTE's Twilio account have not been confirmed in this policy; see International Data Transfers below and Twilio's Privacy Notice (opens in a new tab).

If you have an overseas number or cannot receive the SMS, before continuing. Support can help investigate, but contacting us does not automatically remove the verification requirement.

Data Sharing

We do not sell your personal information. We may share your information only in these limited circumstances:

  • With your explicit consent
  • To fulfill testing jobs you've accepted (sharing relevant profile information with the hiring Business)
  • With service providers who assist in operating our Platform (under strict confidentiality agreements)
  • When required by law or to protect our rights and safety

Data Security

We implement industry-standard technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. This includes encryption of sensitive data, secure database storage, and regular security reviews.

Cookies & Analytics

When you visit our Platform, we may collect data through cookies and similar technologies. This includes:

  • Essential cookies: Required for the Platform to function (e.g. session management, authentication). These cannot be disabled.
  • Analytics cookies: Help us understand how users interact with the Platform so we can improve the experience. Optional analytics, including FullStory, require Analytics consent. You can decline or withdraw that consent through our cookie preferences, or manage cookies in your browser.

Data collected through cookies may include your IP address, browser type, pages visited, time spent on pages, and approximate location. Disabling certain cookies may affect your ability to use some features of the Platform.

FullStory Product Analytics and Session Replay

With your Analytics consent, we use FullStory on eligible pages of dlyte.io and app.dlyte.io to understand navigation, identify usability problems and improve the Platform. FullStory provides interaction analytics and session replay: a reconstruction of activity on captured Dlyte pages, not a camera or whole-device screen recording. Data may include page addresses, clicks, scrolling, navigation, time on pages, browser and device information, IP addresses, and cookie or session identifiers.

We configure Dlyte's FullStory capture to mask page text and exclude images, video, audio and embedded media. We also exclude sensitive routes, including authentication, private research tasks and results, participant details, messages and financial screens. For signed-in users, we may associate eligible analytics activity with an internal account identifier and account type, rather than sending names, email addresses or full Tester profiles as identity properties.

You may withdraw Analytics consent through our cookie preferences to stop future FullStory capture. This does not delete information already collected; you can request deletion through the rights and contact processes described below. FullStory analytics is separate from the research recordings shared with a Business, including Browserless-powered website tasks.

Third-Party Services and Subprocessors

We believe you should know exactly who handles your data. Below is a complete list of third-party services (subprocessors) we use, what data they access, and why:

Cloud Infrastructure

  • Neon (Database hosting) — Stores all Platform data including user accounts, project data, and transaction records. Located in US data centres. Subject to SOC 2 Type II compliance.
  • Replit (Application hosting) — Hosts the Platform application and serves web traffic. Does not have direct access to database contents.

Payment Processing

  • Stripe — Processes credit purchases from Businesses. Receives: name, email, billing address, payment card details. Stripe is PCI DSS Level 1 certified. Dlyte does not store card details.
  • Australian bank transfer (Testers) — Dlyte manages approved AUD bank withdrawals using the Tester's bank account name, BSB and account number. These details are used for the selected bank transfer and to protect payout security, are encrypted at rest, and are accessible only to authorised Dlyte staff. A privacy-protected payout-recipient identifier is also used to detect current or historical recipient sharing, connected accounts, and repeated payout abuse without displaying raw bank details in the fraud-review system.
  • GiftPay (Australian eGifts) — Where available, provides AUD eGifts selected by Australian Testers. Receives the recipient email address, reward amount and a unique payout reference needed to issue or reconcile the reward. GiftPay manages subsequent retailer-card selection and balance information. Dlyte records the original issued amount and issuance or collection status; we do not receive the current remaining allocatable eGift balance through this integration.
  • Tremendous (International rewards) — Where available, provides USD gift/prepaid rewards and PayPal options for Testers outside Australia. Receives the recipient name and email address, reward amount and currency, selected reward option and transaction references needed to arrange delivery and reconcile the payout.

Electronic payout information is shared with the provider for the option you select, rather than sending your full Tester profile. Provider availability and eligibility vary. When you use a provider's reward or redemption website, its own privacy policy and terms also apply. Providers may process information outside your country, subject to the international-transfer safeguards described below.

Authentication

  • Google OAuth — Optional sign-in method. Receives: authentication request. Returns: name and email address. Google does not receive any Platform usage data.
  • Microsoft organisational sign-in — Optional sign-in and work-email verification method for Business accounts. The identity token may provide your given name, family name, work email address, Microsoft tenant identifier, and Microsoft account object identifier. Given name and family name are used only for the account holder's personal profile fields. Your Microsoft display name is not used as the company name; you enter the company name separately during Business onboarding. We use identity-only permissions and do not request Microsoft 365 mailbox, contacts, files, or calendar access for this sign-in method.

SMS verification and delivery

Twilio — Sends SMS verification codes. Receives the destination mobile number with its country calling code, our sending number and the SMS text, including the code. Twilio and delivery networks process routing and delivery information and may process it overseas. See Phone Verification and Country Eligibility for uses, access and retention limitations.

Calendar Integrations

  • Google Calendar — Optional integration available to Business accounts for automatic session event creation
    • Data received: OAuth access token and refresh token issued by Google upon your authorisation
    • What we do: Create, update, and delete calendar events for moderated research sessions on your behalf. We do not read, store, or analyse any of your existing calendar events, contacts, or other Google data
    • Data stored: Encrypted OAuth tokens only. No calendar content is stored by Dlyte
    • Purpose: Automatically add and update session bookings in your Google Calendar
    • Revocation: You can disconnect Google Calendar at any time from Settings → Integrations. Revoking access immediately deletes the stored tokens
  • Microsoft Outlook Calendar — Optional integration available to Business accounts for automatic session event creation
    • Data received: OAuth access token and refresh token issued by Microsoft upon your authorisation
    • What we do: Create, update, and delete calendar events for moderated research sessions on your behalf. We do not read, store, or analyse any of your existing calendar events, contacts, emails, or other Microsoft 365 data
    • Data stored: Encrypted OAuth tokens only. No calendar content is stored by Dlyte
    • Purpose: Automatically add and update session bookings in your Outlook Calendar
    • Revocation: You can disconnect Outlook Calendar at any time from Settings → Integrations. Revoking access immediately deletes the stored tokens. You can also revoke access directly from your Microsoft account at myapps.microsoft.com

Communications

  • Resend — Sends transactional emails (verification, password reset, notifications). Receives: recipient email address and email content.
  • HubSpot — CRM and marketing automation (only for users who opt in to marketing communications). Receives: email address, name, and user type.

Video Conferencing

  • Daily.co — Hosts live moderated research sessions and cloud-records the video conference
    • Data received: Participant and moderator audio/video during live moderated sessions, session display names, session-specific identifiers and meeting-access tokens, including for guest observers
    • Storage: Recordings are transferred to and stored in our cloud infrastructure (Google Cloud, US-based) for up to 75 days, then permanently deleted
    • Guest information not included in meeting tokens: Guest email addresses, platform profiles and screening answers
    • Purpose: Video conferencing and session recording for moderated research studies

Website Testing and Recording

  • Browserless — Provides remote browsers and website-task recording for supported research experiences. Processes website URLs and content, participant interactions and information entered into the remote website, recordings and technical session data. See the Remote Website Tasks section above for the recording boundaries. Browserless Privacy Policy.

Product Analytics

  • FullStory — Provides consent-controlled product analytics and session replay on eligible Dlyte pages. Processes privacy-controlled interaction and technical data, session identifiers and, where applicable, an internal account identifier and account type. See Cookies & Analytics above for privacy controls and your choices. FullStory Privacy Policy.

Browserless and FullStory may process information outside Australia, including in the United States. The International Data Transfers section below applies.

AI Processing

  • OpenAI — AI-assisted audience segmentation analysis and unmoderated test response transcription
    • Data sent (segmentation): Aggregated, non-personal criteria categories only (e.g. age ranges, location types, device categories)
    • Data sent (transcription): Audio extracted from unmoderated video responses for speech-to-text conversion. Only audio is sent — no video frames, participant names, or identifying information
    • Data NOT sent: Individual Tester names, emails, profiles, business prototypes, uploaded materials, or any personally identifiable information
    • Purpose: Audience segmentation analysis and one-time transcription of unmoderated video responses
    • Training: OpenAI does not use data sent via enterprise API for model training. Dlyte does not use your data for AI training (see No AI Training sections above)
  • ElevenLabs — Speech-to-text transcription for moderated session recordings
    • Data sent: Audio extracted from moderated session recordings. Only the audio portion is sent — no video frames, participant names, or identifying metadata
    • Data NOT sent: Video content, participant profiles, Business data, or any personally identifiable information
    • Purpose: One-time speech-to-text transcription of moderated research sessions
    • Training: ElevenLabs does not use data sent via its API for model training. Dlyte does not use your data for AI training

We use data processing agreements with subprocessors to require them to protect your data to standards at least as stringent as this Privacy Policy. We review our subprocessor list regularly and will update this page if changes occur. If we add a new subprocessor that materially changes how your data is handled, we will notify affected users in advance. The account-specific Twilio processing, retention and transfer arrangements noted above still require confirmation; this general statement does not confirm those arrangements.

Data Retention

We retain your personal information only for as long as necessary. Below is our retention schedule by data category:

Account data (profile, preferences, settings)

Deleted within 30 days of account closure

Phone verification (saved number, country calling code, verification status and date; temporary challenges and session records)

Saved profile details follow account-data deletion, subject to unresolved research, financial and security matters. Recruitment codes expire after 10 minutes, temporary continuation permission after one hour and request-limit records after two hours. Expiry is separate from session-store cleanup. Provider-held SMS records are not automatically deleted with the account; see Phone Verification and Country Eligibility above.

Business-uploaded content (prototypes, briefs, research materials)

Deleted within 30 days of account closure, unless associated with an active or completed testing project

Unmoderated test data (results, feedback, signals, video recordings, transcripts)

Retained until the Business or participant requests deletion

Moderated session recordings (video)

Automatically deleted after 75 days. Businesses receive email warnings 14 days and 3 days before deletion. Businesses may download recordings before expiry

Moderated session transcripts

Retained indefinitely and unaffected by video deletion. Deleted upon Business or participant request

Financial records (transactions, invoices, payment history)

Retained for 7 years as required by Australian tax law

Device and network security signals (privacy-protected identifiers and observation dates)

Active observations are used for up to 90 days. Review decisions may be retained with financial security records where required to prevent repeated payout abuse

Anonymised and aggregated data

May be retained indefinitely (cannot be linked back to any individual)

System backups

May contain your data for up to 90 days after deletion, then rotated and overwritten

You may request deletion of your account and associated data at any time through your account settings or by contacting us. We will confirm deletion within 30 days and notify you when the process is complete. For full details on the deletion process, see Section 8.3 of our User Agreement.

Your Rights

Depending on your location and applicable law, you may have the right to:

  • Access your personal information
  • Correct inaccurate or incomplete information
  • Request deletion of your information
  • Export your data in a portable format
  • Restrict or object to processing of your personal data
  • Withdraw consent for optional data collection at any time
  • Opt-out of marketing communications
  • Not be subject to solely automated decision-making that produces legal effects
  • Lodge a complaint with a supervisory authority (see Complaints below)

To exercise these rights, please contact us through your account settings or via the details in the Contact Us section below.

Business account holders can correct their personal first name and last name in account settings. A company name is locked after it is first saved. If a Microsoft display name was previously inserted into the company-name field by an earlier version of the Platform, the affected account holder may replace that value once with the correct company name before the company name is locked.

Complaints

If you believe we have not handled your personal data in accordance with this Privacy Policy or applicable law, you have the right to lodge a complaint:

  • With us first: and we will investigate and respond within 30 days.
  • Australia: Office of the Australian Information Commissioner (OAIC) at oaic.gov.au
  • EU/UK: Your local data protection authority or supervisory authority under the GDPR.
  • California (USA): The California Attorney General's office.

Children's Privacy

Our Platform is intended for users aged 18 and older. We do not knowingly collect information from children under 18. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete such information.

International Data Transfers

For SMS verification, Twilio and telecommunications delivery networks may process your number, verification-message content and delivery information outside Australia, including in the United States. DLYTE's account-specific processing locations and contractual transfer arrangements still require confirmation; we do not claim Australian-only SMS processing.

Your information may be transferred to and processed in countries other than your country of residence, including Australia and the United States (where our service providers operate). International transfers require the safeguards applicable under data protection law, which may include standard contractual clauses or reliance on adequacy decisions. The applicable arrangements for SMS processing still require the confirmation described above; we do not claim that a particular transfer safeguard has been verified for DLYTE's Twilio account.

Contact Us

If you have questions about this Privacy Policy or how we handle your information, please contact us. When you submit a message through our contact form, you will receive an automated confirmation email with a copy of your message, subject, and submission date and time for your records.

Dlyte Pty Ltd (ACN 636 076 885)

Email:

Website: dlyte.io

For data deletion requests, please visit our Data Deletion page.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top. We encourage you to review this Privacy Policy periodically.