AI products have a trust problem. Many don't explain what happens in the background. Data flows somewhere, algorithms do something, and eventually a result comes out. For qualitative research, where people share sensitive information, that's not acceptable.
At QUALLEE, we chose a different path from the start. This article explains where and how AI is used, what limits we've set, and what that concretely means for your research.
Overview
- Our AI Governance Strategy
- Human-in-the-Loop: AI as Support
- The Analysis Chat
- Vector and Graph Databases
- Privacy by Design and Encryption
- Support: AI with Human Oversight
- Why German Servers Are Non-Negotiable
- AI and GDPR: How Do They Work Together?
- Which AI Systems We Use
- What AI Doesn't Do for Us
- Frequently Asked Questions
Our AI Governance Strategy
AI Governance isn't a buzzword we slap onto our product. It's a framework of principles and processes that guide how we develop and operate QUALLEE. We've oriented ourselves around the NIST AI Risk Management Framework and the requirements of the EU AI Act.
Four pillars support our strategy: Transparency, Controllability, Accountability, and Data Integrity.
Transparency
You always know where AI is working and where it isn't. No hidden usage, no surprises. When AI plays a role, we say so. When it doesn't, we say that too.
Controllability
You retain control over your data and the interpretation of results. AI delivers suggestions and analyses; you decide what to do with them.
Accountability
We document which systems are deployed, how they're configured, and what security measures are in place. We can provide information when asked.
Data Integrity
The foundation of every AI analysis is trustworthy data. We store who gave which consent and when. We track where data flows. We delete according to defined timelines.
These principles aren't declarations of intent gathering dust in a PDF. They're built into the product's architecture.
Human-in-the-Loop: AI as Support, Not Replacement
The biggest misconception about AI in research is the idea that it replaces researchers. The opposite is true. We consistently apply the Human-in-the-Loop principle: AI assists, humans decide.
At QUALLEE, AI handles the time-intensive, repetitive tasks: conducting interviews, transcribing responses, clustering themes, identifying patterns. These are activities that can consume hours and days. Hours and days that you then miss for the actually important work.
The actually important work is what only humans can do: understanding connections that don't emerge from data alone. Developing recommendations that consider the company's context. Convincing stakeholders, setting priorities, making strategic decisions.
A concrete example. You're running a research project with 25 interviews. Without AI support, you spend about 15 hours on guide development, 35 hours on preparation and conducting conversations, 8 hours on transcription, and another 15 hours on initial clustering and theme analysis. That's almost eight days before you even start developing recommendations.
With QUALLEE, AI conducts the interviews, transcribes automatically, and delivers an initial theme structure. You might invest two hours in quality control and fine-tuning. The remaining 7.5 days now belong to analysis, interpretation, strategic work.
That's not replacement, it's liberation.
The Analysis Chat: Finding the Needle in the Haystack
25 interviews quickly become 200 pages of transcript. Somewhere in there is the statement that captures your entire project. But where?
The analysis chat is your access to the data. You ask questions in natural language; the AI searches all transcripts and finds relevant passages. We use vector and graph databases that recognize semantic similarities. You ask about "checkout frustration," and the system also finds statements like "I always got annoyed and gave up" or "It was just too complicated."
You can question the AI's answers. Where does this interpretation come from? Which statements support it? The AI shows you the original quotes, participant by participant. You decide whether the conclusion holds or whether you need to dig deeper.
The special thing: You don't have to blindly trust the AI. You can download all transcripts and raw data as exports at any time – Excel, CSV, JSON, PDF. This way you keep full control and can run your own analyses if the system doesn't deliver what you need.
Vector and Graph Databases: Less Hallucination, More Precision
A common problem with AI systems is hallucination: the AI invents statements that were never made, or mixes information from different sources. In research, that's fatal.
We deploy technologies that minimize this risk. Vector databases store statements as mathematical representations of their meaning. When you ask a question, the system searches for statements with similar meaning, not identical words. That's more precise than simple full-text search.
Graph databases map relationships. Which participant made which statement? In what context? To which question? These connections ensure that statements aren't taken out of context.
The effect: When the AI gives you an answer, it's anchored in the actual data. You can trace every step, from the original transcript to the interpretation.
This architecture also enables secure analysis of very large amounts of data. 50 interviews, 100 interviews – the system scales without losing precision.
Privacy by Design and Encryption
QUALLEE was developed from the beginning according to the Privacy by Design principle. This means: Data protection isn't an afterthought, but has flowed into every architectural decision.
All data is strongly encrypted, both during transmission and storage. This applies not only to personal data like email addresses and passwords, but also to your research content: interviews, questionnaires, transcripts, analyses. Even if someone had physical access to our servers, they couldn't do anything with the encrypted data.
Consent management is granular and traceable. We store not only whether consent was given, but also when, with which IP address, which browser, and which exact version of the consent text. When someone revokes their consent, we document that too.
Retention periods are defined and automatically enforced. Our privacy tool checks daily which data has exceeded the retention period and deletes it. No data lying around forever.
Self-service for data subject rights allows you to export your data, revoke consents, and delete your account. Without tickets, without waiting.
Support: AI with Human Oversight
Our support uses AI at three levels, all with clear boundaries and the Human-in-the-Loop principle.
The live support chat is an AI assistant that accesses our knowledge base. It can answer questions about features, help with navigation, and give tips. When a question is outside its knowledge, it honestly says so and refers to human support.
For initial inquiries through the support form, we've developed a first-level support AI. It analyzes incoming tickets, categorizes them, and creates an initial response draft. It answers common questions directly; more complex inquiries are forwarded with a summary to the human support team. This way you get faster initial feedback, and our team can focus on cases that really need human attention.
For technical problems that go to the code level, we've developed a semi-autonomous support agent. It analyzes bug reports, searches the codebase for relevant locations, and delivers structured analyses with concrete suggestions. The agent has read-only access; it can't change or delete anything. And every analysis is reviewed by a human before it becomes a solution.
All three systems follow the principle: AI speeds up the work, a human makes the decisions.
Why German Servers Are Non-Negotiable
Our infrastructure is located in Germany. This isn't a marketing claim but a deliberate decision with concrete consequences.
German data centers are subject to German and European data protection law. GDPR applies here not just on paper, but is actively enforced by supervisory authorities. This gives you and your participants legal certainty.
The US CLOUD Act theoretically allows American authorities access to data processed by US companies – even when servers are in Europe. By using European providers, we completely avoid this risk.
For sensitive research data, especially in B2B, this is often a dealbreaker. Many companies aren't allowed for compliance reasons to give data to systems that could fall under US jurisdiction. With QUALLEE, you don't have this problem.
AI and GDPR: How Do They Work Together?
A question that keeps coming up: How can AI be GDPR-compliant when the models come from American companies?
The short answer: Through proper contractual and technical safeguards.
The detailed answer starts with distinguishing between legal bases. According to Article 6 GDPR, there are various ways to legitimize data processing. At QUALLEE, we primarily rely on contract fulfillment: You enter into a contract with us, and AI-powered analysis is part of the agreed service. For this processing, we don't need separate consent; a transparent notice suffices.
It's different when third-party data comes into play, such as with interview participants. Here we obtain explicit consent and store it in an audit-proof manner.
For collaboration with AI providers, we've concluded Data Processing Agreements (DPAs). These contracts, as required by Article 28 GDPR, precisely regulate what the provider may and may not do with the data. Specifically: no use for model training, no passing on to third parties, deletion after processing.
Since July 2023, the EU-US Data Privacy Framework (DPF) has been in effect, an adequacy decision by the EU Commission for data transfers to the USA. In September 2025, the EU Court dismissed a lawsuit against it, providing additional legal certainty. Additionally, we use Standard Contractual Clauses (SCCs), which provide an additional legal framework.
But contracts alone aren't enough. That's why the technical measures: encryption during transmission and storage, minimization of transmitted data, no permanent storage with providers. Raw data stays on our German servers; only the text content necessary for each task goes to the AI APIs.
Which AI Systems We Use
Transparency also means being specific. Here are the AI components working at QUALLEE.
Opus 4.5 conducts the interviews. This is a Large Language Model that can hold natural conversations. It asks questions, listens, follows up. No rigid script, but adaptive conversation management that adapts to responses.
Automatic transcription converts spoken language into text. Less than 4 percent error rate, even with accents and background noise. You speak, the system writes along.
Theme analysis clusters statements by content similarity. The system recognizes which statements belong together, even when different words are used.
Content moderation protects the platform from abuse. Automatic detection of problematic content, without you noticing anything.
All these systems work according to the principles I described above: transparent, controllable, on German servers.
What AI Doesn't Do for Us
This is the more important part. Here are the limits we've drawn.
No profiling. The AI doesn't create profiles of you or your participants. It doesn't remember who said what in previous interviews. Each conversation stands alone. No cross-referencing behavior analysis, no personality models, no scoring systems.
No biometric analysis. We don't evaluate video or audio biometrically. No facial recognition, no emotion recognition from voice or facial expressions. The EU AI Act has banned this in certain contexts; we excluded it from the start.
No training with your data. Interview content doesn't flow into AI model training. We've concluded Data Processing Agreements with all AI providers that exclude the use of API data for model training.
No data sharing for marketing. Your research data stays research data. We don't sell it, don't share it, don't use it for advertising. The only ones who see your project data are you and your team.
No automated decisions about people. The AI analyzes statements, but it doesn't evaluate people. No participant is filtered out because an AI classified them as "not relevant." All interpretations and decisions are up to you.
Frequently Asked Questions
What does Human-in-the-Loop mean concretely?
Human-in-the-Loop means that a human always makes the final decisions. The AI delivers analyses, suggestions, and patterns. You decide what's relevant, what recommendations you derive from it, and how you interpret the results. The AI doesn't replace your judgment; it gives you more time to use it.
Is my data used for AI training?
No. We've concluded Data Processing Agreements with all AI providers that explicitly exclude the use of API data for model training.
Can I export my raw data?
Yes. You can export all transcripts, analyses, and project data at any time. Available formats: Excel, CSV, JSON, and PDF.
How does AI-powered support work?
Three levels: The live chat answers general questions using our knowledge base. The first-level support AI processes initial inquiries through the support form, categorizes tickets, and creates response drafts. The technical support agent analyzes bug reports and searches the codebase. For all three: AI works ahead, humans decide and review.
How can AI be GDPR-compliant if it comes from US providers?
Through contractual and technical safeguards. We've concluded Data Processing Agreements with all providers that regulate that data isn't used for training and is deleted after processing. Additionally, the EU-US Data Privacy Framework has been in effect since 2023. Technically, we minimize transmitted data and encrypt everything; raw data stays on German servers.
Why are German servers important?
German servers are subject to German and European data protection law. The US CLOUD Act, which theoretically allows American authorities access to data at US companies, doesn't apply here. For sensitive research data, this is often a compliance requirement.
Experience It Yourself
Want to see what an AI-led interview feels like? Start a test interview and experience firsthand how the AI asks questions, probes, and guides the conversation. Afterward, you can try out the analysis and analysis chat. Takes about 30 minutes total.
