Do they own your data? UserTesting Privacy Policy Reviewed.

Listen to this review

0:00

/0

1×

Final Enterprise Readiness Rating: 5/10

⚠️ Partially ready (Reviewed 2026).

⚠️ Recommendation for Enterprises:

Adopt UserTesting with caution. Be especially careful if you handle:

• Confidential client communications requiring specific data residency
• Health data requiring HIPAA compliance
• Financial data requiring SOC 2 certification
• Research involving highly sensitive trade secrets

Instead, consider AI tools that:

• Obtain SOC 2 Type II certification
• Provide configurable data retention policies
• Offer data residency controls
• Allow enterprise customers to opt out of AI processing
• Provide detailed subprocessor agreements

Better Alternative:

✅ BuildBetter.ai — GDPR, SOC 2 Type 2, and HIPAA compliant

✅ Zero training on customer data

✅ You own your data. Fully opt-in privacy model.

🔍  UserTesting Privacy Policy – Enterprise Risk Assessment

Audience: Security-conscious enterprise organizations evaluating User research and usability testing platform for internal use in highly sensitive or regulated environments (e.g. legal, healthcare, finance, tech/IP-heavy orgs).

⚠️ Where UserTesting Falls Short – Critical Gaps

🔒  1. Data Residency & Storage

Quote: "We may transfer the personal data we collect about you to the United States of America for the reasons set forth in this policy."

Risk: Enterprises in regulated industries often require data to remain in specific jurisdictions or have explicit control over storage locations. The blanket US transfer language provides no flexibility.

Enterprise Issue:

• No data residency options mentioned
• Forced US transfers
• No on-premises or VPC deployment options

Verdict: ⚠️ Limited control over data location

🧠  2. AI Model Use

Quote: "If you agree to your audio being recorded as part of a Test, Study Creators may request that a written transcript of what you said be generated... automated analysis of any such transcript... to analyse your comments, reviews or feedback to determine the overall sentiment"

Risk: For enterprises handling confidential client communications or sensitive IP, sending audio/video to unknown AI models creates unacceptable data exposure risks without model selection control.

Enterprise Issue:

• No bring-your-own AI model option
• Unclear which AI providers process data
• No opt-out from AI processing for enterprise accounts

Verdict: ⚠️ AI features disclosed but no enterprise controls

📊  3. Data Minimization

Quote: "Identity Data... Contact Data... Survey Data... Observed Data... Referral Data... Voluntary Data"

Risk: The data types collected are generally appropriate for the service, though behavioral tracking could be excessive for some enterprise use cases.

Enterprise Issue:

• Behavioral tracking enabled by default
• No granular data collection controls mentioned

Verdict: ✅ Reasonable data collection scope

⚙️  4. Privacy Controls

Quote: "Contact you for marketing purposes (if you opt in)... Survey Data... Please note, all survey data is voluntary. You can always choose not to provide Survey Data"

Risk: Good consent practices reduce compliance risk, though enterprise-level workspace controls aren't explicitly mentioned.

Enterprise Issue:

• No workspace-level privacy controls mentioned
• Individual consent model may not scale for enterprise deployments

Verdict: ✅ Solid consent framework

📦  5. Compliance & Auditability

Quote: "UserZoom Technologies, Inc. complies with the EU-U.S. Data Privacy Framework... has certified to the U.S. Department of Commerce... subject to the investigatory and enforcement powers of the Federal Trade Commission"

Risk: While DPF compliance is good, enterprises typically require SOC 2 Type II at minimum. Healthcare and financial enterprises need explicit HIPAA/industry compliance.

Enterprise Issue:

• No SOC 2 certification mentioned
• No HIPAA compliance
• No ISO 27001 certification
• Limited audit trail details

Verdict: ⚠️ DPF certified but missing key enterprise certifications

📬  6. Consent Handling

Quote: "If you agree to your audio being recorded as part of a Test... You can always choose not to provide Survey Data... By submitting the form, I agree to the Privacy Policy and Terms of Use"

Risk: Good consent handling reduces legal risk for user research activities, though enterprise bulk consent management isn't addressed.

Enterprise Issue:

• No enterprise consent management features mentioned

Verdict: ✅ Strong consent mechanisms for user research

🔍  7. Model Explainability

Quote: "Some features within the Platform may automatically process your information... Some of these features used artificial intelligence or machine learning"

Risk: Enterprises need to understand and audit AI decision-making, especially when processing sensitive customer feedback or research data.

Enterprise Issue:

• No AI model transparency
• No logging of AI processing
• No explainability features
• No audit trail for automated decisions

Verdict: ❌ AI black box with no transparency

🧼  8. Data Retention & Deletion

Quote: "the longest we will normally hold any personal data is 7 years from the date of your last interaction with us"

Risk: 7 years is excessive for most enterprise use cases and creates unnecessary compliance burden. Many enterprises require data deletion after project completion or specific shorter timeframes.

Enterprise Issue:

• Non-configurable 7-year retention
• No project-based deletion options
• No immediate deletion capabilities mentioned

Verdict: ❌ Excessive 7-year retention period

🤝  9. Third-Party Sharing

Quote: "We will never sell your personal data... We maintain an up-to-date list of sub-processors at https://www.usertesting.com/privacy-center... your data may be shared with Imperium, LLC in order to verify the quality of the data"

Risk: While they don't sell data, the subprocessor arrangements and quality verification sharing create additional data exposure points that enterprises need to evaluate.

Enterprise Issue:

• Subprocessor list not in main policy
• Quality verification sharing with third party
• No enterprise opt-out from subprocessor sharing

Verdict: ⚠️ Limited subprocessor transparency

✅ What UserTesting Does Right (Credit Where It's Due)

• Strong Data Privacy Framework compliance
• Clear consent mechanisms for research participants
• No data selling commitment
• Transparent data collection categories
• Proper legal basis mapping under GDPR

Disclaimer: This evaluation is based solely on publicly available information and documentation. For formal enterprise vetting, always request a vendor's latest DPA, security whitepaper, and third-party audit reports.