PRIVACY POLICY

"What Will Fix the World?" Research Study

Effective Date: 1 June 2026

This Privacy Policy (the "Policy") describes the manner in which Propello Studio ("Propello Studio," "we," "us," "our," or the "Controller") collects, uses, retains, discloses, and otherwise processes Personal Data in connection with the research study titled "What Will Fix the World?" (the "Study"). This Policy is incorporated by reference into, and shall be read in conjunction with, the Terms and Conditions of the Study (the "Terms"). Capitalized terms not otherwise defined herein shall bear the meanings ascribed to them in the Terms.

1. DATA CONTROLLER

1.1 The Controller in respect of Personal Data processed pursuant to this Policy is Propello Studio.

1.2 All inquiries, requests, and complaints in respect of this Policy may be addressed to the Controller at: contact@propellostudio.com.

2. CATEGORIES OF PERSONAL DATA COLLECTED

2.1 In the course of your participation in the Study, the Controller may collect and process the following categories of Personal Data:

(a) Email address, where voluntarily provided by you;

(b) Free-text responses submitted by you via the Survey;

(c) Submission metadata, including the timestamp of submission and, where automatically captured by the Survey platform, general locale information.

2.2 The Controller does not knowingly collect: precise geolocation data, persistent device identifiers, biometric data, financial information, government-issued identifiers, or any "special categories" of Personal Data as defined under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") or under any analogous law.

3. PURPOSES OF PROCESSING

3.1 Personal Data is processed for the following purposes:

(a) the conduct of the Study, including without limitation Automated Processing of Submissions through embedding, clustering, classification, labeling, simulation, and related analytical activities;

(b) the production, refinement, and dissemination of Study Outputs;

(c) correspondence with Participants who have voluntarily provided email addresses, in respect of the progress and findings of the Study;

(d) responding to data subject rights requests;

(e) ensuring compliance with applicable legal and regulatory obligations;

(f) the establishment, exercise, or defense of legal claims.

4. LEGAL BASES FOR PROCESSING

4.1 The Controller relies upon the following legal bases for processing, as applicable to the Participant's jurisdiction:

(a) Consent — for Participants subject to the GDPR, processing is grounded in your explicit consent under Article 6(1)(a) of the GDPR, manifested by your submission of the Survey;

(b) Consent under Indian Law — for Participants in India, processing is conducted on the basis of your consent under the Digital Personal Data Protection Act, 2023;

(c) Business Purpose / Service Provision — for Participants subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and to analogous laws of other United States jurisdictions, processing is conducted for the limited business purpose of operating the Study;

(d) Legitimate Interests — to the extent permitted by applicable law, the Controller may rely upon its legitimate interest in conducting academic research, provided that such interest is not overridden by your fundamental rights and freedoms.

5. AUTOMATED PROCESSING AND DECISION-MAKING

5.1 You expressly acknowledge that your free-text Submissions shall be subjected to Automated Processing, which may include, without limitation: multilingual sentence embedding, unsupervised clustering, dimensionality reduction, automated cluster labeling using large language models, and agent-based simulation modeling.

5.2 No Automated Processing performed in connection with the Study produces legal effects concerning you, or similarly significantly affects you, within the meaning of Article 22 of the GDPR.

6. RECIPIENTS AND DISCLOSURE

6.1 Personal Data may be disclosed to the following categories of recipients:

(a) Survey Platform Providers — including Google LLC, in respect of Google Forms and Google Sheets, for the collection and storage of Submissions;

(b) Cloud Infrastructure and AI Service Providers — including, without limitation, providers such as Anthropic PBC, OpenAI OpCo LLC, Amazon Web Services, Inc., and Google Cloud, for the purposes of Automated Processing. Free-text content transmitted to such providers shall, to the extent technically practicable, be transmitted without associated email addresses or other directly identifying information;

(d) Website Hosting Provider — for the serving of propellostudio.com and associated pages;

(e) Legal, Accounting, and Professional Advisors — where reasonably necessary;

(f) Competent Authorities — where required by law, court order, or regulatory directive;

(g) Successors in Interest — in the event of a merger, acquisition, reorganization, or sale of assets.

6.2 The Controller does not sell Personal Data within the meaning of the CCPA/CPRA or any analogous law, and does not share Personal Data for cross-context behavioral advertising.

7. INTERNATIONAL DATA TRANSFERS

7.1 The Study is open to Participants worldwide, and the Controller's service providers operate globally. Consequently, Personal Data may be transferred to, stored in, and processed in jurisdictions other than your country of residence, including, without limitation, the United States and the European Economic Area.

7.2 Where transfers are made from jurisdictions imposing transfer restrictions, the Controller shall rely upon lawful transfer mechanisms, including the Standard Contractual Clauses approved by the European Commission, adequacy decisions, or equivalent safeguards.

8. RETENTION

8.1 The Controller shall retain Personal Data for such duration as is reasonably necessary to fulfill the purposes set forth in Section 3, subject to the more specific retention periods below.

8.2 Email addresses shall be deleted within ninety (90) days following the formal conclusion of the Study, or upon the Controller's receipt of a valid deletion request, whichever shall occur sooner, unless a longer period is required for legal compliance, dispute resolution, fraud prevention, security, or enforcement of the Terms.

8.3 Free-text Submissions and associated submission metadata that remain capable of being linked to an identifiable Participant shall be retained for no longer than three (3) years following the formal conclusion of the Study, unless earlier deletion is required pursuant to a valid deletion request or a longer period is required for legal compliance, dispute resolution, fraud prevention, security, or enforcement of the Terms.

8.4 Working files, processing logs, review notes, intermediate analytical files, and other internal records created in connection with the Study may be retained for so long as reasonably necessary for the purposes described in Section 3, provided that the Controller shall use commercially reasonable efforts to remove or avoid retaining directly identifying information where it is no longer needed.

8.5 Anonymized, de-identified, or aggregated data, including Study Outputs derived therefrom, may be retained by the Controller indefinitely and in perpetuity, without restriction.

9. DATA SECURITY

9.1 The Controller shall implement reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, alteration, disclosure, or destruction.

9.2 Notwithstanding the foregoing, Personal Data is transmitted, hosted, processed, and stored electronically, including through third-party systems. No method of electronic transmission, electronic processing, or electronic storage is entirely secure, and the Controller cannot, and does not, warrant or guarantee the absolute security, uninterrupted availability, or freedom from unauthorized access, alteration, disclosure, loss, or destruction of Personal Data.

10. YOUR RIGHTS

10.1 Subject to applicable law and to the limitations described herein, you may be entitled to exercise the following rights:

(a) Access — to obtain confirmation as to whether the Controller processes your Personal Data, and to request a copy thereof;

(b) Rectification — to request the correction of inaccurate or incomplete Personal Data;

(d) Restriction — to request the restriction of processing in certain circumstances;

(e) Objection — to object to processing based on the Controller's legitimate interests;

(f) Portability — to receive your Personal Data in a structured, commonly used, machine-readable format;

(g) Withdrawal of Consent — to withdraw your consent at any time, without affecting the lawfulness of processing conducted prior to such withdrawal;

(h) Non-Discrimination — to exercise the foregoing rights without discriminatory treatment;

(i) Lodging of Complaints — to file a complaint with your competent supervisory or data protection authority.

10.2 Requests pursuant to Section 10.1, including withdrawal or deletion requests, may be submitted to contact@propellostudio.com. Any request relating to a particular Submission must be sent from the same email address that was used, provided, or associated with that Submission, unless the Controller, in its sole discretion, accepts alternative evidence sufficient to verify your identity and connection to the relevant Submission. The Controller shall respond within the time limits prescribed by applicable law, which time limits shall not, in general, exceed thirty (30) days.

10.3 The rights described herein are not absolute and may be subject to exceptions, limitations, and balancing tests under applicable law.

10.4 Except to the limited extent expressly required by applicable law in respect of your own Personal Data, nothing in this Policy grants you any right to request, inspect, receive, copy, audit, or demand access to any raw Submission record, datasheet, spreadsheet, database, dataset, metadata, prompt, model input or output, source code, processing log, scoring rubric, internal note, analysis file, or other underlying record or working material created, maintained, or used by the Controller in connection with the Study.

11. ANONYMIZED AND DERIVED DATA

11.1 Once Personal Data has been irreversibly anonymized or aggregated such that it no longer identifies, and is no longer reasonably capable of identifying, any individual, such data shall cease to constitute Personal Data under applicable privacy laws and may be retained, used, disclosed, and otherwise processed by the Controller without restriction and in perpetuity, for any purpose, including without limitation purposes other than the Study.

11.2 You acknowledge that, owing to the irreversible nature of certain anonymization and aggregation procedures, requests for erasure may not be effective with respect to data that has already been so processed.

12. CONTENT REDACTION AND RETENTION OF UNREDACTED DATA

12.1 The Controller may, in its sole discretion and as further described in the Terms, elect not to display in any public-facing Study Output any content deemed offensive or otherwise unsuitable. Such elective non-display shall not constitute deletion or erasure, and the Controller shall remain fully entitled to retain and process the unredacted underlying content for any internal analytical purpose contemplated by this Policy or by the Terms.

13. NO OBLIGATION TO PUBLISH OR DISCLOSE OUTPUTS

13.1 As more fully set forth in the Terms, the Controller is under no obligation, whether contractual, fiduciary, statutory, or otherwise, to publish, disclose, or release any Study Output, derived data, model, analysis, or summary, in whole or in part, at any time or by any deadline, and may withhold publication in perpetuity, in its sole discretion.

14. CHILDREN'S DATA

14.1 The Study is not directed to, nor does the Controller knowingly accept Submissions from, individuals under the age of eighteen (18). Should the Controller become aware that it has collected Personal Data from a minor, it shall delete such data without undue delay.

15. COOKIES AND TRACKING TECHNOLOGIES

15.1 The Survey is hosted on third-party survey infrastructure (Google Forms), which may set cookies as described in the relevant third-party privacy notices.

15.2 The propellostudio.com domain employs only such cookies as are strictly necessary for site functionality, unless and until otherwise disclosed via a cookie notice on the site.

16. AMENDMENTS

16.1 The Controller reserves the right to amend this Policy from time to time. The Effective Date set forth at the head of this Policy shall be updated to reflect the most recent revision. Where material changes are made, the Controller shall, where reasonably practicable, notify subscribed Participants by email.

17. LANGUAGE

17.1 This Policy is drafted in the English language, which shall be the controlling and authoritative version notwithstanding any translation provided for convenience.

18. CONTACT

Inquiries, requests, and complaints regarding this Policy may be directed to: contact@propellostudio.com.