Verified participation, without surveillance.
Political opinions deserve stronger protection than ordinary customer data. Verification tells us a participant is a real, unique, eligible person. It is not a licence to build a record of what any named citizen believes — and the two are kept structurally apart.
The false trade-off
Verification and privacy are not opposites
The usual assumption is that you can have confirmed real participants or you can have privacy, and the more you verify the more you surveil. That only holds if identity and answers live in the same place. Separate them, and verification becomes a gate a participant passes through rather than a file that follows them.
That separation is the whole design. Identity is required to join a research population and is deliberately excluded from the research record, so the thing that makes a sample trustworthy is not the thing that makes a participant exposed.
Restricted identity layer
- Legal name and contact details
- Government-ID and liveness verification outcome
- Eligibility and account standing
- Reward payout records required by law
Research environment
- Pseudonymous research identifier
- Responses and completion quality
- Declared demographics used for weighting
- Typology and participation history
The disclosure ladder
Less travels forward at every stage
A participant's data does not sit in one pool that everyone queries. It moves through stages, and each stage forwards less than the one before it. Read this as a narrowing: by the time a buyer sees anything, the identifying material has already been left behind.
From verification to a buyer-facing result
- 01
Identity verification
Live· in place todayA government-ID and liveness check confirms a real, unique, eligible person. This is the only stage where identity documents exist at all.
Who can reach itThe verification process and a small number of authorised staff operating under a privileged, logged access path. Never buyers, and never other participants.
Dropped before the next stageDocument imagery and verification artefacts are not carried into the research environment. What continues forward is the fact of verification, not the evidence used to establish it.
- 02
Restricted identity layer
Live· in place todayLegal identity, contact details, and verification status, held apart from any answer a participant has ever given.
Who can reach itA limited set of privileged roles, for verification, fraud review, support, and legal obligations. Access is scoped by role and recorded.
Dropped before the next stageNothing joins this layer to response content. There is no buyer-facing path into it, and it is not a product surface.
- 03
Pseudonymous research account
Live· in place todayA stable research identifier that lets us count a participant once, track participation history, and pay rewards — without carrying their name.
Who can reach itResearch and integrity systems. Buyers interact with this layer only through aggregated output.
Dropped before the next stageLegal name and contact details do not travel here. The link back to the identity layer is a restricted, privileged lookup, not an ordinary field.
- 04
Analytical profile
Live· in place todayThe attributes research actually needs: geography at a research-appropriate level, eligibility, declared demographics, typology, and participation quality.
Who can reach itStudy design, matching, and weighting. Individual-level records are not sold, licensed, or exported as a product.
Dropped before the next stageDirect identifiers. Sensitive attributes are collected only where a study justifies them, with consent captured for that purpose.
- 05
Aggregate result
Live· in place todayPopulation-level figures with the frame, weighting approach, uncertainty, and limitations attached.
Who can reach itBuyers, and where a study is public, everyone. This is the layer commercial work runs on.
Dropped before the next stageIndividual responses. Cuts thin enough to make a person identifiable are suppressed rather than published.
What a buyer receivesAggregated, weighted findings with methodology and uncertainty attached — never participant identities, never individual response records, and never a route back to a named person.
Conceptual model. It describes what each stage holds and who can reach it, not system architecture, storage design, key management, or fraud-detection technique. The binding commitments are in the privacy notice.
Buyer boundary
Buyers do not need to know who answered
Institutional buyers need to know that a sample is real, that it matches a declared frame, and how much the estimate could move. None of that requires a participant's legal identity — so we do not supply it, and there is no premium tier that changes the answer.
This is also a product decision, not only a policy one. PolitiMind is not building a political-dossier marketplace, and a re-identification feature would destroy the participation trust the whole business depends on.
What a buyer receives
- Population-level and subgroup estimates, with the frame and interval attached
- Confirmation that participation was identity-verified and integrity-reviewed
- Methodology, weighting approach, and named limitations for the study
- Trend and longitudinal comparisons across studies they commissioned
- Suppression notices where a requested cut was too small to publish safely
What a buyer never receives
- Participant legal names, contact details, or verification documents
- Individual response records tied to a person
- Re-identification of a respondent, on request or for any fee
- Targeting narrow enough that an individual becomes identifiable
- A standing dossier on a named citizen's political views
Sensitive-attribute research runs under additional consent and governance requirements, and some requested cuts are declined or suppressed on privacy grounds even when a buyer has paid for the study.
Posture
How this differs from panel-industry practice
Most research panels treat respondent identity as an asset to be enriched and monetised. The comparison below describes that general pattern and names no specific vendor. The difference is not that we care more — it is that political opinion is the wrong data to hold loosely.
Privacy posture compared with common panel practice
| Dimension | Common panel practice | PolitiMind |
|---|---|---|
| Why identity is collected | Often collected as a marketing asset — usable for retargeting, list building, and enrichment well beyond the research purpose. | Collected to establish that a participant is a real, unique, eligible person, and kept out of the research record. |
| What the buyer gets | Respondent-level files and appended attributes are frequently part of the deliverable. | Aggregated findings with methodology attached. Participant identity is not part of any deliverable. |
| Sensitive attributes | Inferred and appended from third-party data, often without the person knowing the inference exists. | Only where a study justifies them, declared by the participant, with consent captured for that purpose. |
| Data resale | Panel data is commonly licensed onward through brokers and enrichment vendors. | Participant-level data is not sold or licensed. There is no political-dossier product, now or planned. |
| Privileged access | Broad internal access to respondent records, typically undocumented from the outside. | Role-scoped access to the identity layer, recorded when used, and separated from the research environment. |
| Participant control | Opt-out buried in a preferences page; deletion handled inconsistently. | Documented access, correction, deletion, and opt-out rights, with the process stated in the privacy notice. |
Describes prevalent industry patterns in general terms. Specific controls, vendors, and internal safeguards are not published here.
Known limits
What this posture does not claim
Separation reduces exposure; it does not make a breach impossible. No organisation can honestly promise that, and we are not going to. Identity data exists because verification requires it, privileged access exists because verification, fraud review, support, and legal obligations require it, and every access path that exists is a path that could be misused. What we commit to is keeping those paths narrow, recorded, and separate from the research record.
The methodology limits are just as real. Verification confirms that a participant is a real, unique, eligible person. It does not confirm that they answered honestly, that a verified sample mirrors the country, or that a privacy-preserving design corrects sampling and coverage error. Suppression of small cells reduces re-identification risk but cannot eliminate it in every combination of published cuts, which is why some requested breakdowns are declined outright.
PolitiMind is not independently audited or third-party certified, and nothing on this page should be read as a certification, a regulatory-compliance determination, or a guarantee. The binding statement of what we collect, why, how long we keep it, and the rights you can exercise is the privacy notice.
What we claim about privacy, and what we do not
- Participant identity and response data are held separately, so buyers receive population-level intelligence and never participant identities.
- Participation requires identity verification, so responses come from confirmed real people rather than anonymous traffic.
- Every study runs behind integrity controls that detect duplicate, coordinated, and low-quality participation before results are published.
PolitiMind claims structural separation between identity and response data, aggregate-only buyer output, purpose-limited collection of sensitive attributes, and role-scoped, recorded privileged access. It does not claim responses are anonymous, that no personal data is stored, that responses are end-to-end encrypted, that re-identification is mathematically impossible, or that any system is breach-proof. It makes no certification or regulatory-compliance claim. Participant rights and retention are governed by the privacy notice at /legal/privacy.
Check the posture
Participant identity and response data are held separately, so buyers receive population-level intelligence and never participant identities.
Read the privacy noticeParticipation requires identity verification, so responses come from confirmed real people rather than anonymous traffic.
How verification worksEvery study runs behind integrity controls that detect duplicate, coordinated, and low-quality participation before results are published.
What a record provesWhy it matters to you
Participation only survives if privacy holds
People will tell you what they actually think about politics only if answering carries no personal risk. Every shortcut that makes participants easier to identify buys a little targeting precision and costs the honest answers that make the research worth commissioning.
So the boundary is not a compliance obligation we work around. It is the reason the data is good.