This policy describes, with honesty and detail, what we collect and how we treat the information. It is in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679).

Data controller

Pedro Seabra, independent researcher. Contact: hello@nowwethink.com.

What data we collect

Survey answers. The answers you give to the questions, including the optional ones (email and profession, if filled in).

Technical metadata. To ensure integrity and quality of the study, we collect: country and approximate city (inferred at the Cloudflare edge from the IP), timezone, browser language, device type, operating system, browser, screen size, referrer page, and UTM parameters if you arrived via a campaign link. We also collect a cryptographic hash (HMAC-SHA256) of your IP, with a server salt, which cannot be reversed to the original IP and does not identify the person.

Session identifier. When you accept the terms, a unique identifier (UUID) is generated that links your answers and lets you resume the questionnaire. It is stored in your browser localStorage and in our database.

What we DO NOT collect. We do not collect your name (unless you voluntarily provide it in an open field), your IP in cleartext, or any information that directly identifies you, except where you explicitly authorise it (email for the report, or name if you accept identified citation).

What we use the data for

• Aggregate statistical analysis of answers, for research purposes.
• Publication of results in anonymised or aggregate form.
• Citation of qualitative testimonies, only with the identification regime you chose.
• Sending the personalised report and study updates, if you authorised this in the consent.
• Ensuring study integrity (detection of duplicate or automated answers).

Legal basis

Processing rests on your explicit consent (article 6(1)(a) of the GDPR), collected at the start of the questionnaire. You may withdraw consent at any time without affecting prior lawful processing.

Retention

Answers and metadata are retained for the duration of the investigation and up to five years after publication, for academic verification. They may be retained in fully anonymised form for historical or statistical purposes.

Sub-processors and location

The technical infrastructure is provided by Cloudflare, which hosts the database (D1) and the site. Data may be processed in EU data centres or in countries with adequacy decisions. There is no sharing with third parties for commercial purposes.

Your rights

You have the right to access, rectify, erase and restrict the processing of your data, as well as portability and objection. You may exercise these rights through the email hello@nowwethink.com. To exercise the right to erasure, indicate the session identifier (which appears in the footer while you are answering).

You may also lodge a complaint with the supervisory authority of your country (in Portugal, the Comissão Nacional de Proteção de Dados — CNPD).

Cookies

We do not use cookies for advertising or profiling. We only use localStorage to keep your session identifier, which is strictly necessary for the questionnaire.

Last update · 2026-05-09 · Consent version 2026-05-09.v1