Privacy Policy
Effective date: September 9, 2026
This Privacy Policy explains how Panel Labs s.r.o. processes personal data in connection with the Panel informational website, communications, newsletter, online surveys (including surveys operated through Google Forms), research, user interviews, private testing and legacy data from earlier versions of Panel.
1. Controller
The controller for Panel’s own purposes is:
Panel Labs s.r.o.
Company ID (IČO): 24106682
Registered office: Příčná 1892/4, Nové Město, 110 00 Praha 1, Czech Republic
Registered in the Commercial Register maintained by the Municipal Court in Prague, file C 437858
Email: hello@panel.design
Contact: https://www.panel.design/contact
Panel has not appointed a data protection officer. You may send all privacy questions and requests to the contacts above.
2. Scope
This Policy applies when you:
visit panel.design or a related Panel page;
contact us or submit a form;
complete an online survey or research questionnaire, including a Panel survey hosted in Google Forms;
subscribe to Panel updates;
express interest in research, a follow-up interview or testing;
schedule or participate in a user interview;
receive or use access to a private test;
report a security, legal or rights concern; or
ask about or exercise rights concerning an earlier Panel account or other legacy data.
Panel is not currently offered as a public self-service SaaS product. Public subscriptions, AI generation, public project publishing and other previously described product features are not part of the current public offer.
An independent website or service linked from Panel has its own privacy practices.
3. Personal data we process
3.1 Website and technical data
When you visit the website, Panel and its infrastructure providers may process:
IP address and approximate location derived from it;
browser, device and operating-system information;
requested page, date, time, referrer and basic interaction data;
server, delivery, diagnostic and security logs; and
aggregate website statistics.
3.2 Online surveys and creator research
When you complete a Panel survey or research questionnaire, we may process:
your eligibility confirmation, age confirmation and participation choice;
your professional roles, main role, experience, region or working language;
information about your audience, recent comic or storytelling projects, formats, release channels and publishing platforms;
workflow, collaboration, handoff, tool, software and file-format information;
time and effort estimates relating to your creative or publishing process;
experience with, use of and opinions about AI-assisted tools;
publishing, discoverability, audience analytics and audience- or customer-data portability experiences;
publisher, studio or rights-holder relationships, including the types of support, control or difficulty involved;
income-source categories, approximate income-share bands, approximate software-spending bands and supporter-payment models;
views on motion, interactive formats, barriers, priorities and possible future product adoption;
free-text answers, comments and feedback;
the follow-up activities you select, such as an interview, prototype test, import pilot, publishing or monetization test, future research or product updates; and
if you choose to provide them, your name or creator name, email address and portfolio link.
We do not ask for exact income, bank or payment-card details, passwords, private contracts, confidential or unpublished artwork, medical information, government identifiers or other special-category or highly sensitive data. Please do not include such information, or another person’s personal data, in a free-text answer unless it is necessary, lawful and specifically requested.
Participation is voluntary. We use individual responses for the research purposes described below. Findings may be reported in aggregate or anonymized form. We will not publish an identifiable response, case study or quotation without separate permission.
3.3 Interviews and research sessions
If you participate, we may process:
your answers, opinions, experiences and feedback;
research notes, quotes and observations;
information you choose to show or discuss;
audio, video, screen or transcript data only where we give a separate recording notice and obtain any required consent; and
incentive or reimbursement details if separately offered.
We will not publicly identify you or attribute a quote to you without separate permission.
3.4 Private-test data
If you receive an invitation to a private test, we may process:
invitation, eligibility and participant records;
name, email, authentication or access identifiers;
test session, feature-use and interaction events;
device, browser, IP, security and diagnostic data;
feedback, survey answers, support messages and interview notes;
files, examples or content you deliberately submit to the test; and
records concerning access restrictions, incidents or policy enforcement.
A test invitation or just-in-time notice may provide additional details for a particular test. Do not submit passwords, medical records, government identifiers, payment-card data, confidential client material or other highly sensitive information unless we expressly confirm that the test is designed to receive it.
3.5 Newsletter data
If you subscribe to updates, we process your email address, subscription status, consent record, delivery information, and basic engagement information where lawfully enabled.
3.6 Legacy data
Panel may still hold limited data created through an earlier account, subscription, project, support request or private test. This may include account identifiers, contact details, project or file metadata, content, access and security logs, support correspondence, and transaction or subscription records.
Legacy data does not mean that the earlier service remains publicly available. We process it only as reasonably necessary to close or decommission earlier access, answer support and deletion requests, protect security, comply with accounting or legal duties, and establish or defend legal claims.
4. How we obtain data
We receive personal data:
directly from you, including when you submit a Google Forms questionnaire;
automatically from your browser or device;
from an organization or person that refers or invites you;
from Google Forms and any linked Google Sheets or Google Drive file used to administer and analyze the research;
from website, email, scheduling, newsletter, authentication, hosting and test-infrastructure providers; and
from authorities or other parties where relevant to a security, legal or rights matter.
If a form states that your Google account name or email address is not shared with Panel, we do not receive that account information as part of the submitted response unless you enter it in an answer or the form settings are later changed with an appropriate notice.
5. Purposes and legal bases
Under EU and Czech data-protection law, we rely on the following legal bases where applicable:
5.1 Legitimate interests
We process data where necessary for our legitimate interests in:
operating, securing and understanding the informational website;
responding to ordinary inquiries;
administering research communications that you reasonably expect;
operating, troubleshooting and improving private tests;
preventing misuse, fraud and security incidents;
producing and retaining aggregate or anonymized research findings;
managing business records and communications; and
establishing, exercising or defending legal claims.
We balance these interests against your rights, the nature of the data and your reasonable expectations. You may object as described below. We do not rely on legitimate interests to send optional product marketing where consent is required.
5.2 Steps at your request and performance of an agreement
We may process data to take steps you request and to arrange or perform an interview, incentive arrangement or private-test agreement with you. We do not treat completion of an ordinary voluntary research questionnaire, by itself, as a paid service contract.
5.3 Consent
We rely on consent where requested for:
collecting and using answers submitted through a voluntary research questionnaire;
contacting you about the specific follow-up research or testing activities you select;
sending optional product updates, a newsletter or other marketing communications;
recording an interview or screen; and
another optional use that we specifically explain when asking for consent.
Choices for research follow-up and product updates are treated separately. Choosing product updates is not required to participate in research. You may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully. It also does not require deletion of results that were already irreversibly anonymized so that they are no longer personal data.
5.4 Legal obligations
We process data where necessary to comply with tax, accounting, corporate, regulatory, law-enforcement or other legal duties.
5.5 Protection of rights and safety
Where legally permitted, we may process data to protect the rights, property, security or safety of Panel, participants or others.
6. Required and optional information
Participation in Panel research is voluntary. A questionnaire may mark some questions as required so that the submitted response is usable for the stated research. If you do not answer a required question, you may be unable to submit the questionnaire, but you may stop before submission without participating.
Questions about name, email address, portfolio, follow-up contact, product updates and interview recording are optional unless a particular follow-up activity cannot reasonably be arranged without the relevant contact detail. Where a question could be sensitive in context, we aim to offer an optional answer or a “prefer not to say” choice.
7. Cookies, storage and analytics
The public website is hosted using Framer and uses Framer’s cookieless, aggregate website analytics in the intended publication configuration. Panel does not use the public website for cross-site behavioral advertising or sell personal data.
The website and its providers may use strictly necessary storage or similar technology for security, network delivery, form operation and preferences requested by you. Such technology does not require consent where the legal exemption for necessary operation applies.
If Panel introduces non-essential analytics, marketing cookies or similar tracking, we will request any consent required by law before using them and provide a way to withdraw it. The website should not load such technology merely because this Policy describes the possibility.
A private test may use necessary cookies or local storage for authentication, security and basic operation. Additional test analytics will be described in the invitation or test notice where needed.
Google Forms may save an unsubmitted draft to the Google account of a signed-in respondent for up to 30 days. This is controlled by Google, and Panel ordinarily cannot view an unsubmitted draft. You may use the form without intentionally providing your Google account email to Panel where the form shows that the account information is “not shared.”
8. Recipients and service providers
We disclose personal data only as reasonably necessary. Recipients may include:
Framer and website hosting or delivery providers;
Google, which provides Google Forms and may provide linked Google Sheets and Google Drive storage used for the research;
email, newsletter, calendar, videoconferencing and other research providers;
authentication, hosting, database, storage, security, logging and error-monitoring providers used for an invited test;
professional advisers, accountants, insurers or transaction advisers subject to appropriate duties;
a buyer, investor or successor in a genuine corporate transaction with appropriate safeguards; and
courts, regulators, law-enforcement bodies or other recipients where disclosure is required or lawfully necessary.
Different providers receive different data. We do not give every provider every category listed in this Policy.
For submitted survey-response data held in our Google Workspace, Google generally acts as our processor under its applicable data-processing terms. Google may separately process Google-account, service and technical data for its own purposes as described in its privacy notices. Panel controls the research questions, purposes, access to submitted responses and the retention of copies under Panel’s control.
We do not sell personal data or share it for third-party cross-context behavioral advertising.
9. International transfers
Panel is established in the Czech Republic. Some service providers may process data outside the European Economic Area.
Where EU data-protection law requires a transfer safeguard, we seek to use an applicable adequacy decision, the EU–US Data Privacy Framework for an eligible recipient, Standard Contractual Clauses, or another lawful mechanism. This also applies where Google or another research provider processes relevant data outside the EEA. You may contact us for information about safeguards relevant to your data.
10. Retention
We keep personal data only as long as reasonably necessary for the relevant purpose, security, legal duties and claims. Our normal targets are:
website and security logs: according to provider settings, typically no longer than 90 days unless needed for an incident;
ordinary inquiries and related correspondence: up to 24 months after the last meaningful contact;
raw responses submitted through a research questionnaire: up to 24 months from submission, after which they are deleted or irreversibly anonymized;
contact details and selections for research follow-up: for the relevant research program and normally no longer than 24 months from submission, unless you withdraw earlier or separately consent to a longer period;
unsuccessful research applications that are not part of a questionnaire response: up to 12 months, unless you consent to longer contact;
research notes and feedback from interviews or tests: up to 24 months after the activity, after which they are deleted or anonymized;
interview recordings: up to 12 months unless a shorter period or different research arrangement is stated;
private-test identity and operational records: for the test and up to 12 months after it ends;
private-test content: deleted or anonymized when the test no longer needs it, normally within 90 days after the relevant test ends;
product-update and newsletter data: until you unsubscribe, withdraw consent or we discontinue the list, followed by a minimal suppression record where needed to respect your choice; and
legal, accounting, security and dispute records: for the period required by law or reasonably necessary for the claim or issue.
Legacy product data is reviewed separately and deleted or anonymized when no longer needed for closure, support, security, legal obligations or claims. A verified deletion request may accelerate this review, subject to legal exceptions.
Anonymous or aggregate research results that no longer identify any person may be retained for longer because they are no longer personal data.
Where a deletion or withdrawal request applies to identifiable survey data, we will take reasonable steps to address the response in Google Forms, any linked Google Sheet, relevant Drive files and active exports under our control. Deleting a Form response does not automatically remove every separately created copy, so these locations form part of our internal deletion process.
Protected backups may retain a copy until ordinary rotation. Backup data is not used for ordinary operations and will be re-deleted or suppressed if restored where reasonably possible.
11. Your rights
Depending on applicable law, you may have the right to:
receive information about processing;
access your personal data;
correct inaccurate or incomplete data;
request deletion;
restrict processing;
receive certain data in a portable format;
object to processing based on legitimate interests;
withdraw consent at any time;
object to direct marketing; and
lodge a complaint with a supervisory authority.
To exercise a right, use https://www.panel.design/contact, email hello@panel.design, or—where your request concerns the Panel creator-research form—email ondrej@panel.design. A request sent to either Panel address will be treated as a privacy request and routed appropriately. We may ask for information reasonably needed to verify your identity and authority.
Under GDPR, we normally respond within one month. Where legally permitted because of complexity or the number of requests, this period may be extended by up to two additional months, and we will tell you.
Rights are subject to legal conditions and exceptions. For example, deletion does not require removal of a record that must be retained by law or is needed for a legal claim.
12. Complaints
You may complain to the supervisory authority in the country where you live, work or believe an infringement occurred.
Panel’s Czech supervisory authority is:
Úřad pro ochranu osobních údajů
Pplk. Sochora 27
170 00 Praha 7
Czech Republic
https://uoou.gov.cz
You may contact us first so that we can try to resolve the matter, but this is not a condition for making a complaint.
13. Automated decisions
Panel does not use the processing described in this Policy to make solely automated decisions that produce legal or similarly significant effects about you.
14. Security
We use reasonable technical and organizational measures appropriate to the nature and current stage of Panel. These may include encrypted transmission, access controls, provider security features, data minimization and restricted access to research information.
No online system is completely secure. Do not send highly sensitive or confidential information unless we have expressly agreed on an appropriate method.
15. Children
The public website is informational and is not directed specifically to children. Research participation and private testing are limited to people aged 18 or older unless Panel expressly establishes an appropriate written arrangement involving a parent or legal guardian.
If you believe a child has provided personal data contrary to this Policy, contact us. We will review the situation and take appropriate steps.
16. Changes
We may update this Policy when our website, research, testing, providers or legal obligations change. The effective date identifies the current version.
For a material change, we will use an appropriate notice, such as a website notice, email or notice before further participation. A new purpose that legally requires consent will not be treated as accepted merely because you continue visiting the website.
17. Contact
For privacy questions, access or deletion requests, objections, complaints or other data-protection matters:
for the Panel creator-research form: ondrej@panel.design
Please include enough information for us to identify and handle the request, but do not send unnecessary sensitive data.