Security and data protection
A Delphi panel collects what people actually think — material that deserves careful handling. This page tells you where the material is, who sees it, what the AI does and what it does not. The formal notice is separate; this is its readable version.
How does the service work?
This page describes how the service works. The binding terms are in the privacy notice and in the data processing agreement (DPA), which is made separately with an organisational customer.
Where is the material?
The service runs on a server located in the EU. Backups stay within the EU and are kept for at most 30 days. The database is part of the server rather than a separate cloud database service. Material is not sold or handed on, and it leaves the service in only two cases: the AI features (see below) and a file export the facilitator makes themselves.
Who sees what?
Panelists see each other only as pseudonyms (such as Aristonike), never as names. Roles are per study — owner, facilitator and panelist — and a panelist never receives other people's personal data. A panel on a sensitive topic can be run blind, which hides names and addresses from the facilitator as well. Exports and the handoff to analysis always use the pseudonym: the name does not leave the service even when the facilitator can see it.
Access, accounts and the trail
Everyone running a study has a personal account, and shared credentials are not used. Administrator rights require two-factor authentication, because they open access to the material of every study. Users see their own sessions and can end them at any time. A panelist's invite link is personal and protected. It can be reused, but it expires and can be revoked.
AI in the panel: three levels
AI use is chosen per study. At level 1 (off) the AI is not used at all, and nothing is sent to an AI service. At level 2 (assist), the default for new studies, the AI helps only the facilitator with method questions, and nothing panelists have written is given to the AI. Level 3 (full) adds the features that use panel content, such as AI panelists and Round 0 conversations. Round 0 services also work rule-based, without AI.
What goes to the AI?
AI calls contain no panelist name and no email address, only the pseudonym and the content. No material is used to train AI models. Panelists are told about AI panelists before they respond, and AI-generated content is marked. An AI panelist's name always takes the form AI · role, alongside the 🤖 marker. The marker does not stop at the interface: it travels as a machine-readable field into the analysis and file exports. Human and machine "speech" therefore cannot be confused after the fact. The cost of AI (credits) is shown per study, and the study's owner or facilitator can set a ceiling for it.
Deletion and anonymisation
Studies, panelists, theses and comments can be deleted, and so can a user account. When a study ends, the facilitator can anonymise the material: names, addresses and invite links are permanently deleted, and what remains is anonymous research data. Two things are kept on purpose: the event history and the AI usage records. Neither names the deleted person by address, and each has its own reason: a transparent record of events and the duty to show who has had access to the material.
Limits and risks
Want to know more about security?
You can ask more about security, or read the full privacy notice and the logging policy, including the administrator commitment.
You can also write directly toinfo@metodix.fi