Your data, plainly.

Assessment responses (anonymous). When you take the Behaviour Code, we store your answers and your result without your name or email attached. We use this to generate your read, to improve and calibrate the instrument, and for aggregated research. On its own it does not identify you.

Contact details (only if you give them). If you ask for your full read or join our research, we collect your email, and optionally your name, role, and organization. We use these to send what you asked for and relevant follow-up you can stop at any time.

Technical basics. Standard server logs (e.g. request metadata) for security and reliability. We do not run advertising trackers.

To deliver your read; to improve and calibrate the instrument; to conduct research; and to send only the communications you opted into. This includes using anonymized or aggregated assessment data to develop, train, validate and improve our models and the instrument behind the Service. When we use data for research or model improvement, we use it in a form that does not identify you.

Separately from your personal data, parts of the Service analyze publicly available information about brands, organizations, and public works, to build category and cultural reads. This analysis is transformative: we derive behavioral signals and structure, and we do not republish the source content. We do not construct profiles of private individuals from this material, and it is not connected to your assessment unless you ask us to.

Some advanced reads (the Lived layer) can analyze real behavioral evidence, such as email or documents, to compare how a person or organization actually behaves with how it describes itself. This is entirely optional and off by default. If you ever choose to connect a source:

• We ask for explicit, per-source permission and the narrowest access needed (read-only).
• We analyze the content to derive behavioral signals and store only those signals, we do not retain the raw emails or documents.
• You can disconnect any source at any time, and we delete the derived data on request.
• Connected content is never sold, shared, or used to train third-party models.

This feature is not enabled today; the above describes how it will work when it is offered.

We do not sell, rent, or trade your personal information, and we do not use it for third-party advertising. Full stop.

We use a small set of reputable providers that process data on our behalf, under their own terms and safeguards:

• Vercel — application hosting.
• Supabase — our database (managed PostgreSQL).
• Resend — delivery of the read email you request.
• ConvertKit (Kit) — our email list and follow-up, if you opt in.

See our Trust & Security page for how the data is protected.

Anonymized assessment data is retained to support ongoing research and improvement; because it no longer identifies you, it may be kept indefinitely in aggregate. Identifiable data (your email and anything you provided with it) is kept until you unsubscribe or ask us to delete it, and then removed within 30 days.

You can ask us to access, correct, or delete your personal data, and you can withdraw consent or unsubscribe at any time (every email includes an unsubscribe link). Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA. To exercise any of these, email privacy@signallabs.ca.

We use only what is needed to run the site (e.g. remembering your sound preference). We do not use advertising or cross-site tracking cookies.

The Behaviour Code is intended for adults and is not directed to anyone under 16.

This policy works alongside our Terms of Service. If it changes materially, we will update this page and the date above. Questions, or to exercise a right: privacy@signallabs.ca.