Privacy Notice

Last updated: 12 August 2026

Who is responsible?

Rich Baker operates Given Time and is the independent study lead and data controller for personal information collected through this Communications research.

For privacy questions, rights requests or withdrawal requests, email hello@rich-baker.com.

Scope

This notice covers the Given Time 2.2.0 fixed Communications interview used for developmental and cognitive/usability testing. It also explains the limited website and device information needed to make the service work.

Information processed

Given Time may process:

  • your agreement to take part;

  • a random interview identifier;

  • the questions and options shown;

  • typed answers, transcripts of submitted spoken answers and fixed-choice selections;

  • question exposure, deterministic transition and review status;

  • original answers, append-only corrections and additions;

  • timestamps and limited technical diagnostic information;

  • when site password protection is enabled, an essential signed access cookie used only to confirm site access; and

  • a browser-stored interview reference used to offer resume in that browser.

You are not required to provide your name, employer, client or organisation. Hosting and security systems may also process an IP address, browser/device details and request metadata as part of operating and protecting the service.

Why the information is used

The information is used to administer the interview, save and restore submitted answers, create a voice transcript where requested, show the correct declared question route, let you review and correct the record, assess the developmental/cognitive usability of the interview, maintain security and reliability, and support researcher review.

The fixed 2.2.0 interview makes no semantic model calls during elicitation. Spoken answers are sent to OpenAI only for transcription. No post-review analysis is started by this release.

Lawful basis

The UK GDPR Article 6 lawful basis for this processing is legitimate interests. The legitimate interests are conducting developmental research into how communications work is carried out and how generative AI may feature in that work, in order to develop and evaluate the Given Time research method and product, and operating a secure and reliable research service.

A study-specific Legitimate Interests Assessment records the purpose, necessity, privacy impact and safeguards. You have the right to object to processing based on legitimate interests. An objection will be considered in light of your circumstances and the applicable legal requirements.

Agreement to participate is ethical consent to take part. It is not automatically the UK GDPR lawful basis for processing personal information.

Given Time is not designed to collect special-category or highly sensitive information. Participants are instructed not to provide health, employment-case, legally privileged, confidential or identifying third-party information. If such material is discovered unexpectedly, it will be promptly restricted and deleted without being used for research. The controller will record only the minimum incident information needed to document the action, without copying the sensitive content into a new record.

Voice recording and OpenAI transcription

When you choose Speak your answer, your browser records locally under your control. On submission, the recording is sent to the Given Time server hosted by Render and then to OpenAI’s audio-transcription API. Given Time does not write the raw audio to Airtable, a local file or another research record. The returned transcript is stored as the submitted answer.

OpenAI does not use API inputs and outputs to train its models by default. Its published data-control table currently states that the audio-transcription endpoint has no abuse-monitoring or application-state retention. No special UK-only processing or data-residency arrangement is claimed unless separately verified and recorded.

Storage, hosting and service providers

The current services relevant to this path are:

  • Render: hosting the Given Time web application and server-side request handling;

  • Airtable: storing interview answers, transcripts, fixed responses, exposure and transition history, review status, corrections and limited operational metadata;

  • OpenAI: transcribing submitted voice audio only; and

  • Squarespace: hosting the public Participant Information and Privacy Notice pages, providing Squarespace Analytics and operating the cookie-preferences control; and

  • Google Analytics: measuring visits and activity on those public pages through the configured Google Analytics 4 service. Google Analytics is not used in the Given Time interview application and does not receive the research interview record through this path.

An email provider processes messages sent to hello@rich-baker.com. These suppliers may use subprocessors or process information outside the UK. OpenAI's published API Data Processing Addendum incorporates Standard Contractual Clauses amended by the UK Addendum for UK data. Render publishes a Data Processing Addendum incorporating a UK Addendum. Those are verified published provider terms; this notice does not claim that separately negotiated OpenAI or Render terms have been internally verified. Airtable's Data Processing Addendum has been executed for the controller relationship and includes the UK transfer provisions recorded in the governance evidence.

Review, corrections and provenance

At the end of a completed fixed interview, the participant can review the exact questions and recorded answers. A correction is appended rather than silently replacing history. The original remains reconstructable; the corrected value becomes authoritative for later interpretation. Correcting a structural answer does not replay the interview, and any resulting missing branch remains recorded as missing rather than treated as negative evidence.

Access and disclosure

Access to interview records is restricted through Given Time's admin credentials and Airtable workspace permissions. Rich Baker controls who is authorised to access the study. Personal research information is not sold or used for advertising, participant scoring, employment decisions, commercial lead scoring or automated decisions about participants.

Complete transcripts and identifiable quotations will not be published. Any future use of non-identifying quotations or substantive findings must follow the Participant Information, the approved research status and any separate permission required.

Retention

The operational date for both withdrawal and retention is the last participant activity successfully recorded in the interview record. If answer review is completed, this is the recorded review-completion time. Otherwise, it is the latest persisted start, answer, correction or addition time. Closing the browser does not create a separate event.

No later than 90 days after that recorded activity, the controller actively reviews the identifiable interview record. It is then deleted, irreversibly anonymised, or retained for a further documented period only where a specific continuing research need justifies that decision. The application does not enforce this automatically. Ninety days is not an automatic entitlement to retain every record.

An identifiable record is not irreversibly anonymised during the participant's 14-day withdrawal window. Provider backups, operational logs or security records may follow the provider’s own documented schedule. Contact and withdrawal correspondence is retained only as long as needed to manage the request and document the outcome.

Withdrawal and deletion

You can ask us to delete your identifiable interview record within 14 days of the last participant activity successfully recorded in the interview record. Email hello@rich-baker.com and include your interview reference if available. If you do not have it, provide the approximate date and time and only the minimum non-confidential information needed to locate the record.

The controller will not disclose or delete a record on an uncertain match. The record will not be irreversibly anonymised during the 14-day window. After that window, or after information has been irreversibly anonymised and can no longer be linked to a participant, deletion may no longer be possible.

Security and data minimisation

The service uses HTTPS, server-side service credentials, restricted review access, password protection and an essential signed access cookie when that protection is enabled, data minimisation and limited diagnostic logging. No internet service can guarantee absolute security. Participants should avoid names and confidential or sensitive details.

Cookies and browser storage

When password protection is enabled, the Given Time interview uses an essential signed site-access cookie. It is Secure, HttpOnly and SameSite Strict and expires after approximately eight hours. It confirms access to the protected site; it is separate from the interview record.

The browser stores the random interview reference so it can offer to resume the saved interview, together with limited interface preferences such as sound and Cath arrival state. The interview reference is not an authentication credential. Possession of it may permit lookup of that interview, so it should not be shared. These are functional, not advertising or cross-site tracking technologies.

The Given Time interview does not contain advertising trackers or its own optional analytics implementation. The public Participant Information and Privacy Notice pages are hosted by Squarespace. Squarespace processes ordinary website request and usage information—including IP address, browser, network and device information, referring and requested pages, clicks, scrolling and timestamps—to deliver and secure the pages and provide Squarespace Analytics. This website-visitor information is separate from the Given Time research interview record.

Squarespace sets necessary cookies, including a session crumb cookie for CSRF protection, and stores visitors’ cookie choices. Squarespace Analytics and Google Analytics 4 are enabled on these pages. Non-essential Squarespace analytics/performance cookies and Google Analytics storage are restricted unless the visitor accepts performance and analytics cookies. Google Analytics loads in consent mode with analytics storage denied by default; when consent is denied it does not set Analytics cookies, although Google may still receive consent-state and cookieless measurement requests.

If analytics consent is given, Squarespace may use ss_cid, ss_cpvisit, ss_cvisit, ss_cvr and ss_cvt, and Google Analytics may use the GA4 client cookie named “_ga” and the corresponding GA4 session-state cookie to distinguish visitors and sessions and measure page activity. Visitors can Accept all, Decline non-essential cookies or Manage cookies, and can change their choice through Cookie Preferences. Neither Squarespace nor Google Analytics receives the Given Time research interview record through these public pages.

Your rights

Depending on the circumstances, UK data-protection law may give you rights to request access, correction, deletion or restriction; object to processing; and complain about how your information is used. These rights are not absolute. Contact hello@rich-baker.com so the request can be assessed and the record located safely.

You may also complain to the Information Commissioner’s Office at https://ico.org.uk/ or 0303 123 1113.

Changes

This notice will be updated when the study, service providers, retention arrangements or data flow changes. The current version and date will appear on the published page.