Participant and booking privacy.

Who is responsible

Public operating name: Bracket Bridge
Registered office: Unit 2406B, 24/F, Low Block, Grand Millennium Plaza, 181 Queen's Road Central, Sheung Wan, Hong Kong
Point of contact: Hugo Albert
Email: support@bracketbridge.com

For client-led studies, the client may be the controller and Bracket Bridge may act as processor, service provider, or operations partner. The project notice or written agreement identifies the actual roles for that study.

Data we collect on the booking page

• Name, phone number, email, optional notes, selected language, number of participants, selected availability, referral code, booking code, and appointment-management records.
• If you use email verification to review or cancel a booking, we keep short-lived, hashed verification records, delivery status, attempt counts, and the resulting cancellation audit entry. We do not store the verification code in readable form.
• For people who create a referral link, we store the name and email address they enter, the generated referral and access codes, preferred interface language, access-email delivery status, aggregate link activity, attributed booking progress, and any applicable reward-administration status. We use the email address to deliver and recover private dashboard access. The referrer dashboard does not expose participant names or contact details.
• Basic technical and security logs, such as IP address, browser or device information, requested URL, timestamps, and error events.
• Local browser cache and service-worker data used to make the participant tool load reliably. The booking page does not use advertising pixels or third-party marketing analytics scripts.

Limited signup analytics

We measure whether people can complete the booking flow and where usability problems occur. The measurement records a random short-lived flow ID, completed step names, selected language, one- or two-person booking mode, session ID, broad validation-error category, elapsed time, and timestamp.

Names, phone numbers, email addresses, notes, and the contents typed into contact fields are not included in these analytics events. The random flow ID is stored in the browser session for up to 30 minutes, analytics events are retained for up to 90 days, and the results are used only to improve the signup experience and diagnose technical problems.

Project and study data

Depending on the study, project data may include audio or voice recordings, language and accent samples, transcripts, prompts, task responses, human feedback, annotations, agent trajectory data, interaction logs, screen or tool-use sequences, eligibility details, limited demographics, payment administration records, and quality-control notes.

Why we use data

• To schedule, confirm, reschedule, and manage study appointments.
• To communicate practical study information, including session details and location where relevant.
• To operate, secure, troubleshoot, and improve the booking and participant tools, including aggregated signup completion and timing analysis.
• To run, validate, de-identify, anonymize, quality-check, and deliver project datasets under contract.
• To maintain business, tax, accounting, security, audit, and contractual records.

Legal basis and consent

For European participants, the legal basis depends on the project. It may include consent, performance of a participant agreement, legitimate interests, legal obligations, or processing carried out under a client controller's instructions. Study participation must be voluntary where consent is used. A project-specific consent or collection notice should explain the exact purpose, data categories, recipients, retention, withdrawal process, and compensation terms before collection starts.

Client-controlled data

Bracket Bridge works on a contract basis. Client project data remains client-controlled unless the applicable written agreement says otherwise. Bracket Bridge does not claim ownership of client project data and processes it only within the agreed project scope.

Sharing and processors

Data may be shared with the relevant client, approved operators or subcontractors, hosting and infrastructure providers, storage and security vendors, scheduling or communication tools, payment or recruitment providers, quality-control reviewers, professional advisers, or authorities where required by law. Bracket Bridge does not sell booking inquiry data.

Retention

Booking records are kept only as long as needed for scheduling, coordination, study administration, security, dispute handling, accounting, and legal records. Project data is retained according to the applicable statement of work, participant notice, deletion schedule, or data processing agreement. Direct identifiers should be minimized, separated, de-identified, anonymized, or deleted when no longer needed.

International transfers

Bracket Bridge's registered office is in Hong Kong. Participants, clients and service providers may be located in other countries. The applicable project notice must identify relevant international processing and transfer arrangements. Where European transfer rules apply, an appropriate legal mechanism and any required supplementary safeguards must be established for the actual transfer. A Hong Kong address, website notice or contract reference alone is not a transfer safeguard; no adequacy status or Data Privacy Framework certification is claimed here.

Your rights

Depending on your location and project context, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data, and to withdraw consent where processing is based on consent. You may also have the right to complain to a data protection authority. To make a request, email support@bracketbridge.com and include the project name, booking code, and the phone or email used for the booking.

EU representative and DPO

Bracket Bridge has not named a public Data Protection Officer or EU representative on this general site notice. If a specific project requires an EU representative, DPO contact, or local representative under applicable law, that information should appear in the project-specific notice or client agreement.

Participant, expert and company accounts

Account information includes your verified email, name, location, languages, optional self-declared expertise and company details, profile changes, sign-in records and invitation preferences. We use it to operate your requested account, connect it to your own study records and administer participation. Optional opportunity contact is a separate choice in your profile and can be switched off there. Registering an account does not authorize a study recording, company data access or marketing unrelated to your choice.

Payout information and access

Payout setup stores the recipient name, tax residence, payment-destination country, currency and encrypted IBAN or PayPal destination. Named administrators can access payout preparation exports for payment administration; ordinary directories show masked destination details. These records support agreed compensation, accounting, security and dispute handling. Required details are necessary to prepare the selected payment method. Format checks do not verify account ownership. Saved details and exports do not themselves send money. Transaction records distinguish manual payment evidence from provider-confirmed settlement.

Account deletion and your rights

You can edit your profile and optional contact preference, or request account deletion from your profile. Account deletion removes the live account and saved payout profile; it does not automatically erase independent study records, consent evidence, necessary accounting records or controlled backups. Further access, correction, withdrawal or deletion requests can be sent to support@bracketbridge.com. We may need proportionate identity verification and coordination with the study controller. Retention exceptions must have an applicable purpose and legal basis; they are not permission to retain everything indefinitely. You retain applicable complaint and statutory rights, including access and correction rights under Hong Kong's PDPO where applicable.