How we handle your data

Interview answers, recordings and documents are read by AI models. Which ones depends on how your engagement is configured, and we will tell you before we start. Some deployments run entirely on machines we control; others use a commercial AI provider under a business agreement. Either way it is a short, named list, it is written down for your engagement, and it does not change without telling you.

What does not vary: your organization’s content is not used to train general-purpose AI models, it is not sold, and it is not used for advertising. Where a provider is involved, we use the business terms that carry those commitments rather than the consumer product that does not.

Typed answers are stored as written. Where transcription is configured for your engagement, spoken answers are recorded, stored, and written up as text the person can read and correct before moving on; where it is not, the interview asks people to type and records nothing.

Every statement in an assessment points back to the interview passage or the document it came from, and the software checks that the link resolves. A claim that cannot cite real evidence is rejected before publication, and a finding that rests only on rejected claims does not reach you.

What you receive says how much evidence is behind each finding — how many interviews, how many current documents, how many different roles — without saying who. That is a deliberate limit and it is the subject of the section below.

Where the evidence is thin, the report says so. Sometimes the honest answer is that we do not know yet, and we would rather write that down than round it up.

Before a recommendation reaches you it is put through a critique that looks for the reasons it might be wrong: too few people describing it, a conclusion reaching further than the evidence, a cost nobody has actually measured. A recommendation to build software on a single account is downgraded automatically, and the critique it received is kept alongside it.

Recommending nothing is a real outcome. Where the evidence points at a process rather than at software, that is what the report says, and we would rather tell you not to build something than sell you one.

Nothing reaches you on a model’s say-so. A person reads the findings and the recommendations, signed in under their own name, and presses publish; that name stays attached to the decision in a log we add to and do not edit.

Anything the confidentiality check has held back stays held back when they press it. Publishing releases what passed, not everything.

Leadership can see who was invited and who has finished. It cannot read a transcript, play a recording, or find out which member of staff said any particular thing. That is not a setting; there is no permission in the software that grants it.

Every record carries your organization on it, and the software will not mix material from two organizations. Interview links are private, unguessable, expire, and can be turned off; each one opens exactly one person’s interview and nothing else. Once somebody starts, their interview can only be continued in the browser they started it in — so a person who has a copy of the link, including whoever passed it on, cannot open what has been said.

You can ask for a copy of what we hold for your organization and get it back as a file: your records — interviews, transcripts, evidence, findings, recommendations and reports — and a list of every document and recording we store. The documents and recordings themselves are separate files, which we hand back on request. You can ask us to delete it, and a member of staff deletes it deliberately — the records, the recordings, the transcripts, the analysis, and the accounts that belonged only to your organization — leaving an audit trail that records that a deletion happened and when, and nothing of what was deleted.

Backups are the exception worth stating plainly rather than glossing: a deletion does not reach backups already taken. They are kept for a limited period that we set and tell you before we start, and until the last backup taken before your deletion is removed, your material still exists in it.