Privacy Policy
This Privacy Policy explains how Corner Bird handles personal data when you visit our website, create or use an account, apply for or complete research missions, receive rewards, redeem vouchers or contact us.
Corner Bird is a trading name of Nestium Technologies OÜ.
1. Who controls your personal data
The controller is:
Nestium Technologies OÜ
Registry code: 17500052
Registered address: Harju maakond, Tallinn, Lasnamäe linnaosa, Katusepapi tn 6, 11412, Estonia
Privacy: privacy@cornerbird.com
Support: hello@cornerbird.com
2. What Corner Bird does
Corner Bird operates a web-based research panel for adults. Research tasks are called missions in our service.
Corner Bird offers missions directly to participants, selects participants, contracts for the resulting research, reviews submissions and provides rewards for accepted work. Our business, public-sector and research clients separately purchase research services or research data from Corner Bird. Participants do not contract with those clients merely by taking part in a mission.
Corner Bird may license accepted research to more than one current or future client. Depending on the mission, clients may receive a project-specific participant ID, individual answers, necessary photographs, mission location, recordings, transcripts or derived research. We do not provide clients with your Corner Bird account name, email address, phone number or other account contact details unless a specific mission expressly requires identifiable participation, explains this in advance and has an appropriate lawful basis.
Removing your name does not always make research anonymous. Answers, photographs, recordings and location information may still be personal data if you could reasonably be identified from them.
3. Personal data we collect
The data we collect depends on how you use Corner Bird and on the requirements of each mission.
Website and technical data
This may include your IP address, device and browser information, operating system, timestamps, referring page, campaign parameters, cookie identifiers, pages viewed, security logs and interaction events.
Account and profile data
This may include your name or display name, email address, country, city, date of birth, confirmation that you are at least 18, account status, participation goal, languages, mission preferences, profile answers and records of your acceptance of our Terms and notices.
Corner Bird does not collect general availability as a standing profile field. A particular mission may ask a specific scheduling question when genuinely necessary.
Authentication and verification data
This may include magic-link requests, login timestamps, security information and verification status. If we identify unusual or potentially fraudulent activity, we may request proportionate additional verification, such as a phone number or identity information. We will provide a specific notice before collecting it.
Identity-document verification is not part of ordinary registration. If introduced, we will minimise what is collected and delete document images promptly after verification where reasonably possible.
Optional connected-account data
If this feature is available and you voluntarily connect a social-media account, we may collect the platform name, public account identifier or URL, public display name, account age or creation information, verification status and connection date.
We do not seek access to private messages, contacts, friends, non-public posts, private photographs or likes.
Mission application and screening data
This may include eligibility answers, relevant experience, city or area, mission-specific scheduling answers, application status, selection outcome and other information required to determine whether you fit a particular mission.
Mission submissions
This may include survey answers, diary entries, interview statements, notes, receipts, photographs, videos, audio, files and other research content you submit.
Photographs and metadata
We may collect required images, capture time and relevant metadata. We seek to remove or obscure unnecessary faces, vehicle licence plates, identity documents, payment information and other incidental personal information.
Location data
Depending on the mission, this may include a location you enter, device GPS, photograph metadata, task venue, route or approximate area. The mission notice will explain whether approximate or precise location is required and why.
Corner Bird does not collect continuous or background location.
Live and recorded session data
This may include your voice, image, statements, attendance, transcript, interviewer notes and recording metadata. Before a recorded session, a separate notice will explain who will attend, what will be recorded, client access, reuse and retention.
Sensitive survey answers
A mission may ask about data protected by Article 9 of the GDPR, such as health, disability, ethnicity, political opinions, religion, trade-union membership or sexual orientation. We collect such data only where genuinely required and after obtaining separate explicit consent or identifying another valid legal condition.
Declining sensitive-data consent does not affect your eligibility for unrelated missions. If the information is genuinely necessary for a particular mission, declining may mean that you cannot complete that mission or receive its reward.
Quality and fraud data
This may include an internal quality score, completeness, timeliness, compliance with instructions, duplicate-account indicators, IP and device patterns, unusual voucher-delivery activity, photograph or location inconsistencies, and AI-assisted or human review outcomes.
Reward and voucher data
This may include reward amount, currency, credit and expiry date, Available Reward Balance, selected voucher, provider, denomination, redemption date, fulfilment status and support history.
Communications
This may include emails to and from Corner Bird, web notifications, clarification requests, complaints, disputes, privacy requests and marketing preferences.
Client-recipient records
We record which client received a project dataset, recording or download, together with delivery time, access logs and contractual restrictions.
4. Where personal data comes from
We obtain personal data:
- directly from you when you register, update your profile, apply for a mission, submit research, redeem a reward or contact us;
- from your device, browser, cookies and mission permissions;
- from an optional connected social account, if you choose to connect one;
- from clients or research partners when they provide mission materials, attendance information or quality feedback;
- from voucher providers about fulfilment and voucher status; and
- from security, fraud-prevention, analytics, advertising and hosting providers acting for Corner Bird.
5. Why we use personal data and our legal bases
| Purpose | GDPR legal basis |
|---|---|
| Create and secure your account and send sign-in links | Contract or steps requested before entering a contract; legitimate interests in account security |
| Review panel and mission applications and select participants | Steps requested before a mission contract; legitimate interests in relevant and reliable research |
| Provide mission instructions and collect, review or correct submissions | Performance of the mission contract |
| Collect mission-specific location or media | Performance of the mission contract where necessary; legitimate interests in verifying work and preventing fraud |
| Record and license a live session | Performance of the disclosed mission agreement and legitimate interests in delivering the research; separate agreement before recording; explicit consent for special-category data where required |
| Use and license accepted research to clients | Performance of the mission agreement and legitimate interests in providing research services, subject to the notice given before the mission and appropriate safeguards |
| Process sensitive survey answers | Explicit consent under Articles 6(1)(a) and 9(2)(a) GDPR, unless another valid Article 9 condition is identified in the mission notice |
| Maintain internal quality and fraud indicators | Legitimate interests in research integrity, fair allocation, security and fraud prevention |
| Use AI for transcription, quality support, research analysis or fraud detection | The legal basis for the underlying activity, normally contract or legitimate interests |
| Credit rewards and deliver vouchers | Performance of the mission contract; legal obligations relating to accounting and tax |
| Send account, mission, support, security and policy messages | Contract, legal obligations and legitimate interests in administering the service |
| Send optional marketing | Consent, which may be withdrawn at any time |
| Operate necessary cookies and similar technologies | Providing the service requested and legitimate interests in security, subject to applicable national ePrivacy rules |
| Use optional analytics or advertising technologies | Consent |
| Comply with law and establish, exercise or defend legal claims | Legal obligations and legitimate interests in legal compliance and protecting rights |
Where we rely on legitimate interests, we assess the necessity of the processing and balance our interests against your rights and reasonable expectations.
6. Mission applications and selection
Applying to Corner Bird or to a mission does not guarantee selection. We may use your city, profile, eligibility answers, previous response quality and fraud indicators to decide which missions to show and whether to accept an application. Ignoring or declining a mission does not penalise you.
We maintain an internal quality score. We do not publish exact scores, model logic or anti-fraud thresholds because doing so could undermine research quality and security. Where an adverse decision significantly affects you, we may provide a general explanation subject to lawful confidentiality and security limits.
7. Automated processing and artificial intelligence
Corner Bird may use automated systems to:
- rank mission applications;
- check completeness;
- identify possible duplicate accounts or fraud;
- compare IP, device, voucher, photograph and location patterns;
- create transcripts; and
- help analyse research.
For AI-assisted processing, we may use Google Cloud Vertex AI, including Gemini models, and Google Cloud Speech-to-Text. We configure supported EU processing locations where available, prohibit provider training on Corner Bird data, and disable unnecessary request-response logging, stored-conversation features and search or maps grounding.
We do not use AI to infer emotions or sensitive traits such as health, ethnicity, political opinions, religion or sexual orientation.
Routine mission selection may be automated. If automation contributes to account suspension or termination, cancellation of an approved reward, a fraud finding or a material restriction on future mission access, you may request human review, provide your view and challenge the decision. We do not promise human review of every routine decision not to select an applicant for a particular mission.
8. Photographs, recordings and information about other people
Mission instructions prohibit intentionally photographing or recording identifiable people, faces, vehicle licence plates, private interiors, identity documents, payment information or restricted property unless the mission expressly requires it and lawful permission is in place.
Do not trespass or make covert recordings.
If submitted material accidentally contains unrelated personal information, Corner Bird may blur, crop, mute, remove or delete it. Material that cannot be made suitable may be rejected.
An identifiable recording may be licensed to more than one client for the research purposes disclosed before the mission and for up to three years after recording, unless the mission notice states a shorter period. Recordings will not be publicly published or used in advertising without a separate model release that clearly explains that public use.
10. Client responsibilities and research reuse
A client receiving participant-level project data will generally act as an independent controller for its agreed use. Our client contracts require appropriate security, limited lawful purposes, defined retention and restrictions on identifying or contacting participants. Clients may use authorised service providers or group companies subject to appropriate protections.
Corner Bird may license accepted research to more than one current or future client. Where reasonably possible, repeated licensing uses irreversibly anonymised or aggregated information. Properly anonymised information is no longer personal data and may be retained and used indefinitely.
Corner Bird cannot guarantee that every independent client will comply with its legal and contractual obligations. If we become aware of misuse, we may suspend access, investigate, notify affected people or authorities where required, and take other appropriate action.
11. International transfers
Corner Bird initially provides participant-level research only to clients in the EU or EEA and stores mission data in EU or EEA Google Cloud regions. Some technology and voucher providers are headquartered, or may provide support, outside the EEA. EU hosting does not always prevent remote access from another country.
Where personal data is transferred outside the EEA, Corner Bird uses an applicable adequacy decision, the European Commission's Standard Contractual Clauses with supplementary measures where appropriate, or another lawful transfer mechanism.
Contact privacy@cornerbird.com for information about the safeguards relevant to a particular transfer.
12. How long we keep personal data
We keep personal data only for as long as necessary for the purposes described below, including legal, accounting, security and dispute requirements.
| Data | Normal retention period or criterion |
|---|---|
| Rejected panel or mission application and screening answers | 90 days after the decision, unless required for an active dispute or fraud investigation |
| Rejected completed submission | Until 30 days after the 14-day dispute period ends, or 30 days after the dispute is resolved |
| Raw photographs and precise location from accepted missions | Normally 12 months after the client project ends, then deleted, blurred, reduced in precision or de-identified unless an active dispute or legal obligation requires longer |
| Accepted answers linked to a participant ID | Normally three years after project completion, then deleted or irreversibly anonymised |
| Identifiable recordings | Available for licensing to new clients for up to three years after recording, then deleted or irreversibly de-identified where reasonably possible, subject to existing client rights and legal claims |
| Account and profile data | While the account is active, then deleted or de-identified within 30 days after closure except for the records listed below |
| Unredeemed rewards after ordinary account closure | Available for 30 days after closure, subject to each reward's original 12-month expiry |
| Fraud, security and verification evidence | Up to three years after the investigation or account closure, or longer while a claim or legal requirement remains active |
| Identity-document image, if introduced | Deleted within 30 days after verification where reasonably possible; the verification result may be retained as described above |
| Technical and security logs | Normally 90 days, unless required for a security incident, investigation or legal claim |
| Marketing preference | Until consent is withdrawn; a minimal suppression record may be retained for up to three years to respect and demonstrate the opt-out |
| Voucher, tax and accounting records | Seven years, or another period required by applicable law |
| Properly anonymised research | Indefinitely |
| Cookies and similar identifiers | For the session or the maximum period stated in Section 15, subject to shorter browser or provider limits |
We may preserve relevant records for longer where reasonably necessary to establish, exercise or defend a legal claim, comply with a legal hold or investigate a security incident.
13. Your choices and rights
Subject to applicable conditions and exceptions, you may:
- request access to your personal data and information about its recipients;
- correct inaccurate or incomplete data;
- request deletion;
- restrict processing;
- object to processing based on legitimate interests;
- object to direct marketing at any time;
- receive portable data where Article 20 GDPR applies;
- withdraw consent at any time, without affecting processing already carried out lawfully;
- request human review of a qualifying automated decision; and
- complain to a supervisory authority.
To exercise a right, email privacy@cornerbird.com. We may request proportionate information to verify your identity.
These rights are not absolute. For example, Corner Bird may retain accepted research where another lawful basis applies, preserve evidence of a contract or dispute, comply with law, or continue using information that has been irreversibly anonymised.
Our lead supervisory authority is expected to be the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, at www.aki.ee. You may also complain to the supervisory authority in the country where you live or work, or where you believe an infringement occurred.
14. Marketing and service messages
Marketing is optional and is not a condition of registration, mission eligibility or rewards. We send marketing email only after a separate affirmative choice. You may unsubscribe through the message or contact hello@cornerbird.com.
Messages necessary for sign-in, security, applications, missions, clarification requests, rewards, vouchers, support and policy changes are service messages, not marketing.
Local updates, address sign-ups and local rewards
On some local pages (for example cornerbird.com/pl/kielce/…) you can sign up for updates, rewards or short missions for the street where you live without creating an account.
For these sign-ups we collect your city, street and building number (we do not ask for an apartment number), your email address, whether you asked to be notified or reserved a reward, any mission you chose and the answers you submit, the time and version of your consent, and the campaign parameters of the page you arrived from. We may look up the approximate coordinates and neighbourhood of the building from OpenStreetMap data.
We use this data to send you the local updates, reward information and mission invitations you asked for (legal basis: your consent), to reserve and deliver a reward you requested (legal basis: performance of a contract), and to produce aggregated statistics by building, street, neighbourhood and city (legal basis: our legitimate interest in understanding local demand). Mission answers may be used and published in local guides and materials; please do not include other people’s personal data.
Your email address and building number are never sent to advertising or analytics providers. Analytics events only include the funnel, the street and the campaign.
We keep this data until you withdraw consent, and at the latest 12 months after the local campaign ends, unless we need it longer to handle a reward claim or legal obligation. Recipients are our infrastructure and email providers and, only when you reserve a reward, the partner providing that reward. You can withdraw consent at any time by using the unsubscribe link in any message or by writing to privacy@cornerbird.com.
15. Cookies and similar technologies
Necessary cookies support security, authentication, consent records and core website functions. Optional analytics may include PostHog EU and Google Analytics. Optional advertising may include Meta Pixel and Google Ads.
Optional technologies remain disabled until you make the relevant choice. Rejecting optional cookies does not prevent account use or mission participation. You can change your choices through the Cookie settings link on our website.
| Purpose | Provider or example | Category | Maximum lifetime |
|---|---|---|---|
| Authentication and security | Corner Bird, Vercel or infrastructure providers | Necessary | Session; persistent security or sign-in identifiers no longer than 30 days |
| Consent preferences | Corner Bird consent manager | Necessary | Six months, then we ask again; withdrawal takes effect immediately |
| Product analytics | PostHog EU | Analytics | 12 months |
| Website analytics | Google Analytics, including `_ga` and `_ga_<container>` | Analytics | 13 months; user and event retention configured to 14 months with identifier reset disabled |
| Advertising measurement | Google Ads, including `_gcl_*` | Advertising | 90 days |
| Advertising measurement | Meta Pixel, including `_fbp` and `_fbc` where set | Advertising | 90 days |
These are maximum periods, not a statement that every technology is always active. The live Cookie settings panel identifies the technologies currently in use.
We do not place advertising pixels on registration, mission, upload, precise-location, reward, dispute or account-security pages. On local sign-up pages described in section 14, Meta Pixel may run after advertising consent, but it never receives your address, email address or mission answers. We do not use session replay.
16. Data security
Corner Bird uses measures appropriate to the risk, including access controls, authentication, encryption in transit, protected cloud storage, limited client downloads, logging, backups, vendor review, confidentiality obligations and incident-response procedures.
No service can guarantee absolute security. If a personal-data breach creates a legally reportable risk, Corner Bird will notify the competent authority and affected people as required by law.
17. Children
Corner Bird is only for people aged 18 or over. We do not knowingly allow minors to register or complete missions. If you believe that a minor has provided personal data, contact privacy@cornerbird.com.
18. If you do not provide data
Some information is required to create and secure an account, assess eligibility, perform a mission, review a submission or issue a reward. If you do not provide required information, Corner Bird may be unable to offer the account or mission.
Refusing optional marketing, an optional connected account or optional cookies does not affect account eligibility. Refusing sensitive-data consent affects only a mission that genuinely requires that information.
19. Changes to this Privacy Policy
We may update this Privacy Policy when our service, providers or legal obligations change. We will update the effective date and provide prominent notice of material changes. Where appropriate, we will notify account holders by email or in-app message.
Changes will not retroactively give Corner Bird broader rights over a completed mission than the participant was told about when accepting it.
20. Contact
Privacy requests: privacy@cornerbird.com
Support: hello@cornerbird.com
Postal address: Nestium Technologies OÜ, Harju maakond, Tallinn, Lasnamäe linnaosa, Katusepapi tn 6, 11412, Estonia