Privacy Policy

Sonergy Data Technologies is responsible for your account, Surdatics Verify, your wallet, the daily game, and the messages we send you on WhatsApp, Telegram, SMS and email.

The answers to a study belong to the research team that ran it. It decides what the study is for and is responsible for that use; we hold and process the answers on its behalf. The same goes for a business's feedback forms and an organisation's ballots.

To ask about anything here, or to use your rights, write to info@surdatics.com.

• Your account: your name, email address, password (stored only as a hash, never readable), your organisation and your role in it. If your organisation signs you in with its own system, the name and email address it sends us.
• Your profile, if you fill it in: date of birth, gender, where you live, occupation, education, phone number and a short bio. It is optional, but a reward needs a complete profile and a confirmed email address.
• Surdatics Verify: a set of numbers describing your face (see below).
• Your answers: what you answer, when, and through which channel. Where a study asks for it, the place an answer was given (your browser's location, with your permission, or recorded by a field worker). For a video answer, the recording, a transcript and the themes Surdatics AI draws from it. For a voice note on WhatsApp, the recording, a transcript and, if you spoke another language, an English translation.
• Your wallet: your wallet address, and every reward, royalty and other SURDA movement. When cash-out opens, where you send it (a bank account or a wallet address).
• Airtime and data rewards: the Nigerian phone number you confirm for them, and each top-up sent to it, for a study or an invite.
• WhatsApp, Telegram and the daily game: see their sections below.
• Safety: when you sign up, take Surdatics Verify or cash out, your network address, your browser's description of itself, a random device id kept in your browser and, at Surdatics Verify, your camera's name. When you answer first to claim a reward later, or give feedback without an account, a scrambled code of your device and connection. We use these only to stop one person running many accounts or answering too often, and we do not send your address to anyone to do it.
• What you send us: messages you write to us, and words you agree to let us publish.
• What organisations give us: if an organisation puts you on a ballot register or invites you to give feedback, the details it gives us, such as your name, membership number, email address or phone number.

Under the Nigeria Data Protection Act 2023 and, where it applies to you, the EU or UK GDPR:

• To run your account, your wallet, and the studies, game and channels you use: our contract with you.
• To match you to studies: your consent, given when you fill in your profile. A blank field just means fewer studies match you.
• To take part in a study: the consent you give that study before its first question. The research team's own legal basis covers what it does with the answers.
• To offer your anonymised answers to buyers: your separate yes in that study or, for answers given before studies asked about resale separately, the Terms of Use you accepted then. You can stop future sales at any time in your settings.
• To check you are one real person (Surdatics Verify): your explicit consent.
• To tell you about new studies and rewards on WhatsApp, Telegram, SMS or email: your consent. Messages about your account itself: our contract.
• To prevent fraud and keep Surdatics secure: our legitimate interest in stopping one person from taking rewards many times over, and in keeping everyone's data safe.
• To keep financial records and answer lawful requests: our legal obligations.
• To hash answers and anchor the hashes on the blockchain: our legitimate interest in proving the data has not been changed. A hash says nothing about you.

Surdatics Verify checks that a real person, not already verified on another account, is behind an account. It uses biometric data, which the NDPA treats as sensitive personal data and the GDPR as special-category data, so:

• We ask for your explicit consent first, separately from everything else.
• A few small pictures from your camera are measured on our own servers, never by an outside face-recognition service, and then discarded. We keep only the measurement, a set of numbers describing your face: never a photograph or a video.
• It is optional. You can answer many studies without it, but a reward needs it.
• The measurement is never sold, never in any dataset, and never shown to research teams.
• You can withdraw your consent at any time in your verification settings. The measurement is then deleted, and you are no longer verified.

WhatsApp. When you answer a study on WhatsApp, or link your number, we hold your WhatsApp number, your WhatsApp profile name and what you send us: your answers, voice notes and messages. They travel through the WhatsApp Business Platform, whose operator handles them for us as our processor (it is in the list of providers below); WhatsApp's own privacy policy also applies to your use of WhatsApp. Some studies can be answered on WhatsApp without an account: then we keep your number with your answers, so that each number answers a study once.

Voice notes. If you answer an open question with a voice note, the recording is kept privately for 12 months, then deleted. Surdatics AI writes out what you said and, if you spoke another language, translates it into English; that text stays with your answer. Until the recording is deleted, the research team can listen to it. Recordings are never in any dataset offered to others.

Telegram. If you link Telegram or open the Surdatics app inside Telegram, we hold your Telegram account id and username, and what you send our bot. Telegram carries the messages under its own privacy policy.

Text messages and email news. We text you about studies and rewards, or email you news, only if you ask us to, and you can stop at any time. A business that invites you to give it feedback sends its invitation through us, with a link to stop its requests.

• Signed in: your guesses, your answers and predictions, your scores, points, streaks and badges, whether each answer counted and, from your profile, your region, country and age group, so we can count your answer and place you in your region.
• As a guest: a random id kept in your browser lets the game know you played today. We store only a keyed hash of it, never the id itself, with your guesses, scores and streak: no name and no account. If you sign in on the same browser, your guest plays join your account. Your network address is used only to limit how much one connection can play, and is not kept with your plays.
• What is public: a day's results, only as totals and only once enough verified people have answered, and region rankings, only for regions with enough players. Never anyone's answers, guesses or name. Your own rank is shown only to you, and a guest is never on any board.
• Each day’s results get a SHA-256 hash, anchored on the blockchain. Only the hash goes on the blockchain.
• A share card shows your score, streak and level, never your answers or your name. A short share link is deleted if nobody opens it within 7 days, and every link after 90 days.

• Research teams see your answers under your wallet address, with the age group, gender and country from your profile: never your name, email address, phone number or face measurement.
• A business sees the answers to its feedback form, as the form's own statement says; on an anonymous form, only together with other people's. An organisation running a ballot never sees how you voted.
• Validators reviewing a disputed answer see it under your wallet address, never your name or contact details, and must keep it confidential and use it only to decide the dispute.
• Dataset buyers receive anonymised answers only: from studies where you said yes to resale, and answers you gave before studies asked about resale separately, under the Terms of Use you accepted then. Never once you have stopped future sales in your settings.
• Our staff see what they need to run Surdatics, support you and stop fraud.
• The providers in the next section, on our instructions only, and authorities, where the law requires it.
• Nobody else. We do not sell your personal details, and we share nothing with advertisers.

These providers process personal data for us, only on our instructions and under data-processing terms. AI service providers are listed by the kind of service they give; the others by name.

Telegram carries messages between you and our bot under its own terms. On research teams' pages, some charts are drawn by Google's chart library, which the browser loads from Google, in the United States, under Google's own terms. When cash-out opens through another company, it is added here before it is used.

Every answer gets a SHA-256 hash the moment it arrives, and so do each study's dataset and each day's game results. The hashes are anchored on the Internet Computer (ICP) blockchain, so no one can change the data without it showing. Only the SHA-256 hash goes on the blockchain, never the answers or anyone's details, and a hash cannot be turned back into an answer. A hash stays on the blockchain after its answer is deleted; it says nothing about you or the answer.

• Surdatics AI is the name of our automated writing, translation and transcription. It helps research teams write studies and reports, translates studies and answers, writes out recorded answers, writes the daily game’s host lines around the results the platform counts, and answers questions in the site’s assistant. This is automated processing by software, not by a person, and the AI service providers listed above process what it reads, on our instructions.
• We do not train AI models on your personal data. We do not scrape people’s data from the web, and we do not accept scraped datasets.
• People decide about your answers: the research team approves or rejects them, and validators decide disputes.
• Some things are decided by automated checks, with no person involved at first. Surdatics Verify compares your face measurement with those of verified accounts, and refuses one that matches another account; it also refuses a virtual camera, a connection that hides where you are (such as a VPN), and a device or connection already used to verify several accounts. Our fraud checks hold a reward or a cash-out when one device, connection or payout account serves several accounts, or two verified faces look alike. A refusal or a hold stops only that verification, reward or cash-out until it is settled. You can ask a person to review any of them: write to info@surdatics.com.

Under the NDPA and the GDPR you can make us do the following, free of charge. Write to info@surdatics.com from the email address on your account; we may ask you to confirm it is you. We answer within one month, and put right anything inaccurate within 21 days.

• See it: a copy of what we hold about you.
• Correct it: most of it you can change yourself in your profile.
• Delete it: we delete your account’s personal details (your name, email address, profile and face measurement), the recordings of your face or voice, your WhatsApp and Telegram links and your daily game. Your answers stay in the studies you gave them to, with nothing that says who you are, and are never again offered to buyers. Our financial records and your consents are kept, as the law requires, under an id that no longer says who you are. Answers a research team has already downloaded, or that are in an anonymised dataset already sold, cannot be recalled, and we say so plainly.
• Take it with you: what you gave us, in a machine-readable file.
• Pause it: ask us to keep your data but stop using it, for example while we settle a correction or an objection you made.
• Withdraw consent: to profile matching, Surdatics Verify, resale or messages, each on its own. You lose only what it made possible: without Surdatics Verify, for example, rewards.
• Object: to anything we do on the basis of our legitimate interest.
• Ask for a person: to review any automated decision about you.
• Complain: to the Nigeria Data Protection Commission or, in the EU or UK, to your own data protection authority.

For the answers to a study, the research team decides; we pass your request on and help it answer.

Our servers are in Nigeria. Some of the providers listed above process data in other countries, as the list says. Where data leaves Nigeria, the EEA or the UK, we rely on the safeguards those laws allow: the provider's data-processing terms, with standard contractual clauses where it offers them, or the transfer being needed to give you a service you asked for, such as sending your WhatsApp message.

• All traffic is encrypted in transit (TLS).
• Secrets, signing keys and payout credentials are encrypted at rest.
• Passwords are hashed and cannot be read by us or recovered.
• Recordings, photos and other private files are reached only through short-lived signed links.
• Only named administrators can reach production data, and the admin console keeps a record of the changes they make, with who made them and why.

We do not claim certifications we do not hold. If a breach puts you at risk, we tell you and the regulator as the law requires.

We use no advertising or analytics cookies. The site keeps only what it needs to work: your sign-in, your choices (such as light or dark), the codes of answers you will claim later, a random device id used against fraud, and the daily game's guest id. Clearing them signs you out, and the game then treats you as a new guest.

Surdatics is for people aged 18 and over. That includes the daily game. We do not knowingly hold data about children: when we learn that we do, we delete it. If you think we do, tell us.

The countries, states, regions, cities and towns you choose from come from GeoNames (geonames.org), used under the Creative Commons Attribution 4.0 licence. The list of occupations is grouped by the International Labour Organization’s International Standard Classification of Occupations (ISCO-08). A place or job you type yourself under “Other” is kept exactly as you typed it and is not checked against these lists.

We post every change here with a new date, and keep each earlier version. Before a change that materially affects you applies to you, we tell you by email and in the product, and ask you to accept it; until you do, the version you accepted before still applies to you.