When you describe an unreleased product to Cast, you are trusting us with something valuable. And when we show you what twelve people said about it, you are trusting that we are honest about who those people are. Both promises are built into the product, not bolted on.
Promise one: your brief stays yours
Studies are private to your workspace. Your brief, your questions, your transcripts and your reports are visible only to people you invite. We do not use your content or your results to train AI models without your written consent. That commitment is in our Terms and Conditions, in plain words.
Behind the scenes, the AI model providers we rely on are bound by data protection terms, and we design to the expectations of the EU General Data Protection Regulation (opens in a new tab) and comparable laws in the Gulf. Enterprise workspaces add single sign-on, an audit log and data controls.
We also take our cues from frameworks like the NIST AI Risk Management Framework (opens in a new tab), which asks AI builders to map, measure and manage risk across a system's life rather than treat safety as a one-time checklist.
Promise two: labeled, always
AI users are carefully synthesized and questioned AI users. They have names and faces because that makes interviews easier to read and remember, but they are labeled as AI in every transcript, report and deck. Our terms prohibit presenting them, or their quotes, as real customers, real reviews or real survey data.
This matters beyond honesty. Research by Wang, Morgenstern and Dickerson in Nature Machine Intelligence (opens in a new tab) warns that AI stand-ins can "misportray and flatten identity groups." Being clear that an AI user is synthetic keeps everyone, including your board, reading findings for what they are: fast, structured signals that point you to the right questions for real customers.
“AI users are carefully synthesized and questioned AI users.”
Why trust produces better results
People share more when they feel safe, and teams act better on research they trust. A private workspace means you can test the idea that might embarrass you. A clear label means nobody mistakes a pilot for a verdict. Together they make Cast a place to think out loud, early, which is exactly when research is cheapest and most useful.
What we collect, and what we do not
We follow the principle of data minimization (opens in a new tab) from the EU General Data Protection Regulation (opens in a new tab): collect what the service needs and nothing more. For Cast that means your account details, your billing details through our payment provider, and the content of your studies. We do not need personal data about your customers to run a study, and we recommend you do not put any in your brief.
- Your brief and questions: stored in your workspace, visible to people you invite.
- Transcripts and reports: stored in your workspace, exportable and deletable.
- Usage data: used to run and improve the service, with cookies only as you consent.
Labeling is becoming law
Being open about synthetic content is moving from good practice to regulation. The EU AI Act includes transparency obligations (opens in a new tab) for AI systems that generate content or interact with people. Cast was built with labels from day one, so every AI user, quote and chart is marked as coming from AI users. When you share a Cast report, the label travels with it.
Good habits for your team
- Do not paste customer personal data or confidential contracts into a brief.
- Keep the "AI users" label when you copy quotes into decks or documents.
- Treat Cast findings as hypotheses in board and investor materials.
- Remove team members' access when they leave, from Team and billing.
AI research data privacy and GDPR: the basics in plain English
If you use any AI tool for research, three GDPR ideas are worth knowing, whether or not you are based in Europe. The first is the difference between a controller, the organization that decides why and how personal data is used, and a processor, which handles data on the controller's behalf. Both terms are defined in Article 4 of the GDPR (opens in a new tab). The second is that processors must work under a written contract with specific protections, set out in Article 28 (opens in a new tab). The third is the data protection impact assessment (opens in a new tab) in Article 35, a structured check that organizations must carry out when processing is likely to pose a high risk to people.
Regulators have been busy applying these ideas to AI. The UK Information Commissioner's Office publishes detailed guidance on AI and data protection (opens in a new tab), covering fairness, transparency, accountability and accuracy. In December 2024 the European Data Protection Board adopted Opinion 28/2024 (opens in a new tab), which looks at when AI models trained on personal data can be considered anonymous, when legitimate interest can be a legal basis, and what happens when data was processed unlawfully during development.
Why synthetic users help with privacy, and where they do not
A useful side effect of interviewing synthetic people is that a study does not need anyone's personal data to run. AI users are built from public research about circumstances, not from records about real individuals. That keeps a typical study a long way from the high-risk processing that triggers the heaviest obligations.
The weak point is usually the brief. A brief is whatever you type into it, and people under deadline paste in surprising things. In 2023 Samsung temporarily restricted generative AI on company computers (opens in a new tab) after reports that staff had uploaded sensitive code to a chatbot. The lesson is not that AI tools are unsafe. It is that the safest data is the data you never put in.
A walk-through: writing a privacy-friendly brief
Imagine a product lead at a regional bank exploring a savings feature for gig workers. Her first draft of the brief includes a spreadsheet extract with real customer names and balances. Here is how she might rewrite it:
- Replace individual records with a description of the segment: "self-employed delivery riders, aged 22 to 40, irregular weekly income."
- Summarize internal findings instead of pasting them: "our data suggests most of this group saves nothing in a typical month."
- Remove anything covered by a confidentiality agreement, such as a partner's pricing.
- Keep the brief in a private workspace and invite only the people who need it.
The study loses nothing. AI users do not need a real rider's balance to tell her why a locked savings pot feels risky when rent is due on Friday. The example is hypothetical, but the pattern applies to any team: describe people, do not export them.
Glossary
Controller: the organization that decides the purpose and means of processing personal data. Processor: an organization that processes personal data on a controller's behalf. DPIA: a data protection impact assessment, required for likely high-risk processing. Personal data: information relating to an identified or identifiable person. Synthetic user: an AI-generated person used for research, not a record of a real one.
Limitations and what this is not
This article is a plain-English orientation, not legal advice, and the rules differ between countries and sectors. If your organization handles regulated data, your data protection officer or lawyer should decide what may go into any AI tool. What Cast can promise is what is built into the product: studies private to your workspace, and every AI user clearly labeled as AI.
Questions about privacy and labeling
Can I delete a study?
Yes. Deleting a study removes its brief, transcripts and reports from your workspace.
Do AI providers see my brief?
The models that run Cast process your content to produce results, under data protection terms that do not allow training on it.
Why do AI users have faces if they are not real?
Faces and names make twelve interviews easier to tell apart and remember. The AI label keeps them honest.
Is it GDPR compliant to use AI tools for customer research?
It can be, but compliance depends on what data you put in, your legal basis and the terms with your providers. The simplest step is to keep personal data out of briefs entirely, which synthetic research usually makes possible.
Do synthetic users count as personal data?
An AI user is an AI-generated person, not a record about a real individual. The privacy question is mainly about what you put in your brief, so describe segments rather than pasting customer records.
Start with the science: the paper that made silicon samples respectable.
