The short version
- We collect what we need to run 50heads, pay heads and stop fraud: your email, your phone number, your answers, how you use the app, and payment and tax details when money moves.
- Tier 2 ID and face checks are done by a specialist provider. We get a yes or no; the photos are deleted within 30 days.
- Requesters never see who answered their question.
- We don't sell data, track you across other apps or sites, or collect your location or contacts.
- You can get a copy of your data, correct it or delete it. Write to privacy@50heads.com.
The rest of this notice gives the detail.
Who we are
50heads Ltd, Cambridgeshire, United Kingdom, is the controller of your personal data. Contact our data protection lead at privacy@50heads.com.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account: email, name, sign-in provider | To run your account | Contract |
| Answers and questions | To provide the service | Contract |
| Payments, payouts, invoices | To take and make payments | Contract; legal obligation for records |
| Phone number | One person, one account; sign-in checks | Contract; legitimate interest (fraud prevention) |
| Device attestation, touch and timing signals, device identifiers | To detect bots, emulators and account farms | Legitimate interest (fraud prevention) |
| ID document and face (Tier 2) | To verify identity and prevent duplicate accounts | Explicit consent |
| Age band from ID (Tier 2) | Targeted questions | Explicit consent |
| Tags you choose | Targeted questions | Consent |
| Tax details | Platform reporting to tax authorities | Legal obligation |
| Support messages | To help you | Legitimate interest |
| Marketing email | News about 50heads | Consent, or soft opt-in for customers |
We've assessed our legitimate interests against your rights. You can ask for a copy of that assessment.
Biometric data
The Tier 2 check uses your face, which is special category data. We ask for your explicit consent on a separate screen first. The check is run by our identity provider, which deletes your ID and face images after its decision, within 30 days, and keeps a face match only to stop one person holding two accounts. You can withdraw consent at any time; you'll move to Tier 1 and the face match is deleted.
Automated decisions
We use automated checks to detect fraud, which can lower a head's tier or reject answers. Any head can ask for a person to review a decision through appeals.
Who we share it with
- Service providers that host, secure and run 50heads, process payments and payouts, check identities, and send email and text messages. They're listed on our subprocessors page and act only on our instructions.
- Tax authorities, where the law requires.
- Anyone the law requires, such as the police with a valid order.
Requesters see answers, tiers and attestation references, never who answered.
International transfers
Some providers are outside the UK and EU, mainly in the United States. We use the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement or EU Standard Contractual Clauses, with a transfer risk assessment.
How long we keep it
| Data | Kept |
|---|---|
| ID and face images | Not by us; deleted by the provider within 30 days |
| Face match | With the provider while your account exists |
| Raw touch and timing signals | 90 days; derived patterns 24 months |
| Phone number | While your account exists; a scrambled copy 12 months after |
| Answers | As long as the requester keeps the result; cut loose from you if you delete your account |
| Payments, invoices, statements, tax identifiers | 6 years after the tax year |
| Support messages | 2 years |
| Email logs | 12 months |
Your rights
You can ask to access, correct, delete, restrict or move your data, object to processing based on legitimate interests, and withdraw consent. See your data rights. We reply within a month.
Children
50heads is for people aged 18 and over. If we find an account belongs to someone younger, we close it and delete their data.
Cookies
See our cookie policy. The public website sets no cookies other than your language and currency choices.
Complaints
Please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.
Changes
We'll tell you about material changes in the app and by email before they take effect.