This page sets out the terms on which Wyza processes personal data for clients who run studies on Wyza. It forms part of our Terms of Service and is read alongside our Privacy Policy. It is written to meet the Nigeria Data Protection Act 2023, the Kenya Data Protection Act 2019, Ghana's Data Protection Act 2012 and, where it applies, the EU and UK GDPR.
1. Scope and roles
For the answers, recordings and details participants give in a client's study, the client is the controller and Wyza is the processor. For Wyza's own respondent panel (accounts, profiles, rewards and fraud checks), Wyza is the controller; see Respondent Privacy.
2. Processing on instructions
We process client study data only to run the study and deliver its results (recruitment, interviewing, transcription, translation, validation, analysis and reporting), on the client's documented instructions, unless the law requires otherwise. We do not sell it and do not use one client's data for another client.
3. Confidentiality
Everyone at Wyza and every field agent who can access study data is bound by confidentiality. Staff access is limited to what their role needs.
4. Security
We encrypt data in transit and at rest, separate each client workspace, and protect staff tools with two-factor sign-in. See Security & Trust for detail.
5. Sub-processors
We use these sub-processors. Each is bound by written data protection terms at least as protective as these. We will update this list before adding a new one, and clients may object.
- Supabase: Database, authentication and file storage
- Vercel: Web hosting and delivery
- Railway: Background processing
- OpenAI: AI moderation, transcription, translation and analysis
- Google (Gemini): Audio and video understanding
- Anthropic: AI analysis and writing
- Twilio: SMS and WhatsApp messages to participants
- Africa's Talking: SMS and airtime rewards to participants
- Resend: Email
- Paystack and Stripe: Payments
- Sentry: Error monitoring
- PostHog and Google Analytics: Product and website analytics
- Meta: Advertising studies to panel members (hashed phone numbers only)
6. International transfers
Some sub-processors store or process data outside the country where it was collected. Where they do, we rely on the safeguards the applicable law allows, such as contractual clauses, and we disclose this to participants when they consent.
7. Data subject requests
We help clients answer participants' requests to access, correct or delete their data, and to withdraw consent. Requests sent to us directly are passed to the client unless they concern our own panel.
8. Breaches
If we become aware of a personal data breach affecting client data, we will tell the client without undue delay, with what we know and what we are doing about it, so the client can meet its own reporting duties.
9. Return and deletion
When a client asks, or when the service ends, we return or delete the client's study data, unless the law requires us to keep it. Clients can also exclude or delete responses themselves in Studio.
10. Information and audits
We give clients the information they reasonably need to show compliance, and answer security questionnaires on request.
11. Signed DPA
If your organisation needs a countersigned Data Processing Agreement, email privacy@wyza.ai with your company name and we will send one for signature.