Privacy Notice

Last updated: April 2026  |  Version 1.2

This privacy notice describes how personal data are processed in the research study "The effect of AI assistance on human behavior", conducted at LUT University, Finland. It explains what data are collected, why, who has access, and your rights as a data subject under the General Data Protection Regulation (GDPR).

1. Data Controller

The data controller for this study is LUT University. The processing of personal data is carried out under the responsibility of the principal investigator.

2. Data Protection Officer

LUT University's Data Protection Officer can be contacted at LUT.Dataprotection@lut.fi. Further information about the Data Protection Officer is available on LUT University's website: https://www.lut.fi/en/data-protection

3. Purpose and Legal Basis for Processing

The study "The effect of AI assistance on human behavior" investigates how different levels of AI writing assistance affect user behaviour and engagement. Personal data are collected solely for this academic research purpose.

The legal basis for processing personal data is the performance of a task carried out in the public interest — specifically, scientific research (GDPR Art. 6(1)(e)), in accordance with the Finnish Data Protection Act (1050/2018, Section 4).

Please note that regardless of the legal basis for data processing, your informed consent to participate in the research is obtained separately through the onboarding form before any data are collected.

4. Categories of Personal Data Collected

The following data are collected during participation:

• A pseudonymous random ID (UUID) — generated in your browser and stored locally on your device. This ID is used to link your data across sessions. It is not connected to your name or any external identity.
• Optional hashed email — if you choose to provide it, your email address is converted to an irreversible cryptographic code on your device before transmission. The actual email address is never received or stored.
• Survey responses — self-reported writing experience, writing frequency, writing confidence, and domain expertise.
• Behavioural interaction data — typing patterns, pause durations, hover times, scroll behaviour, session duration, AI suggestion acceptance and rejection events, and tab visibility changes.
• Text content — snapshots of the text you write during the session, used to analyse writing behaviour in relation to AI assistance.
• Technical metadata — browser language, screen resolution, timezone, and referring URL. No IP addresses are stored by the research platform.

We do not collect your name, precise location, or any other directly identifying information.

5. Sources of Personal Data

All personal data are collected directly from participants during their use of the Draftspace platform. No personal data are obtained from external registers or third-party sources.

6. Recipients of Personal Data

Personal data are accessible only to the principal investigator and authorised members of the research team at LUT University. In addition, the following external service providers process personal data as part of the platform infrastructure:

• Supabase — research data are stored on Supabase database servers located in the EU. Supabase acts as a data processor under a data processing agreement. Supabase privacy policy →
• OpenAI — text submitted for AI improvement is transmitted to OpenAI's API for processing. OpenAI acts as a data processor. Data submitted via the API is not used to train OpenAI models. OpenAI privacy policy →
• Netlify — the platform is hosted on Netlify's servers. Standard server access logs may be retained by Netlify as part of its hosting service. Netlify privacy policy →

7. Transfer of Personal Data Outside the EU/EEA

Two of the service providers listed above are based in the United States and involve the transfer of personal data outside the European Economic Area:

• OpenAI (United States) — text data submitted for AI processing is transferred to OpenAI's servers in the US. This transfer is based on Standard Contractual Clauses (GDPR Art. 46).
• Netlify (United States) — website hosting involves transfer of technical access data to Netlify's US infrastructure. This transfer is based on Standard Contractual Clauses (GDPR Art. 46).

Supabase stores data within the EU and does not involve transfer outside the EEA.

If you have questions about international data transfers, please contact the Data Protection Officer at the address in Section 2.

8. Safeguards

The following technical and organisational safeguards are in place to protect personal data: pseudonymisation of all participant data using randomly generated IDs; encrypted data transmission (HTTPS); access to research data restricted to authorised members of the research team; no storage of directly identifying information such as names, email addresses, or IP addresses on the research platform.

9. Cookies and Local Storage

Draftspace uses your browser's local storage (not traditional cookies) to store your pseudonymous session ID and preferences. Local storage data does not leave your device unless explicitly transmitted as part of a session.

No third-party tracking or advertising cookies are used on this platform.

10. Automated Decision-Making

When you first visit the platform, you are automatically and randomly assigned to one of three experimental conditions that determine the level of AI writing assistance you receive. This assignment is performed by an algorithm with equal probability across conditions. It has no legal effects on you and no significant impact beyond the nature of the AI suggestions you receive during the session. No other automated decision-making or profiling takes place.

11. Retention Period

Research data are retained for a maximum of 5 years following the conclusion of the study, in line with LUT University's research data management policy, after which data are permanently deleted or fully anonymised. During this period, data may be retained to ensure the reliability and reproducibility of research results.

12. Your Rights as a Data Subject

As a data subject you have the following rights. To exercise any of these rights, please contact the principal investigator at the address in Section 1, or the Data Protection Officer at the address in Section 2.

• Right of access (Art. 15) — request information about the personal data held about you.
• Right to rectification (Art. 16) — request correction of inaccurate data.
• Right to erasure (Art. 17) — request deletion of your data. To do so, provide your pseudonymous ID, visible in your browser's local storage under the key ds_uuid. Note: the right to erasure may be limited where the processing is necessary for scientific research purposes and erasure would seriously impair the research.
• Right to restriction of processing (Art. 18) — request that processing of your data be restricted.
• Right to object (Art. 21) — object to the processing of your personal data on grounds relating to your particular situation. Where personal data are processed for scientific research purposes, this right may be limited if it would seriously impair the research.
• Right not to be subject to solely automated decision-making (Art. 22) — see Section 10 for information on the automated condition assignment used in this study.

Please note that the right to data portability (Art. 20) does not apply where processing is based on public interest, as is the case in this study.

13. Right to Lodge a Complaint

If you believe your personal data are being processed incorrectly, you may contact LUT University's Data Protection Officer (Section 2). You also have the right to lodge a complaint with the supervisory authority:

14. Changes to this Notice

We may update this notice periodically. The date at the top of this page reflects the most recent revision.