Privacy Policy

What we collect

• Account data: your name, email address and password (stored hashed; we never see it).
• Assessment data: the assessments you create: setup details, answers, evidence notes, and any evidence files you attach.
• Feedback: anything you send through the in-app feedback tools, with the page it was sent from.
• Product events: minimal usage events (e.g. "created an assessment", "downloaded a report") tied to your account, used to understand how the product is used. No page-tracking, no behavioural analytics, no cookies beyond the session cookie that keeps you signed in.

How we use it

To provide the service: storing your assessments, generating reports, and emailing you about your account (verification, password resets). We do not sell your data, share it with advertisers, or use it to train AI models.

Where it lives

Your data is stored in a UK/EU-hosted database. The site loads no third-party fonts, scripts or trackers, so every page request stays between your browser and this service.

The one third party: AI summaries

If you use the AI executive summary feature, your assessment's findings (framework, scores, gap titles) are sent to Anthropic's API to generate the text. Evidence files and evidence notes are never transmitted. Anthropic does not train on API data. If you don't use the feature, nothing leaves the service.

Access and isolation

Your account can only ever read its own records, enforced server-side on every request, including evidence file downloads. Administrative oversight of the service is limited to metadata (counts, scores, dates); assessment titles, answers and evidence are not visible to administrators.

Retention and deletion

We keep your data while your account exists. You can delete individual assessments (including attached evidence) from your dashboard at any time, or delete your entire account, with all assessments, evidence files and feedback, from your Account page. Deletion is immediate and permanent.

Your rights

Under UK GDPR you can request access to, correction of, or erasure of your personal data. Most of this you can do yourself from the Account page; for anything else, contact us and we'll respond within 30 days.

Contact

Questions about this policy or your data: reply to any email from your account correspondence, or use the in-app feedback tool.