Privacy Policy

Last updated: July 2026 (policy version privacy-2026-07)

This document should be reviewed by legal counsel before being relied upon.

1. What We Collect

We collect information necessary to deliver the assessment service. For coaches and assessment subjects, this includes full name and email address. For raters and survey participants, this includes email address (used to send the survey link) and the survey responses they submit — numerical ratings on a 1–5 scale and optional free-text comments. Authentication-related data such as hashed passwords and session tokens is managed by Clerk and is subject to their privacy policy.

2. How We Use It

We use the data we collect to deliver and operate the Service: generating scored leadership profiles, producing feedback reports, sending survey invitations and reminders to designated raters, and enabling coaches to manage their assessment projects. We do not sell personal data to third parties, and we do not use personal data for advertising purposes. We may use aggregated, de-identified data to improve scoring models and calibration norms.

3. Anonymity Protections

To protect the confidentiality of survey participants, individual ratings from peer, direct report, and "other" rater groups are only displayed in reports when a minimum of three responses have been received from that group. Free-text comments are included in reports without attribution — no name or identifying information is attached to any individual comment. These protections are enforced at the application level and cannot be overridden by coaches or administrators.

4. Third-Party Services

We use Clerk (clerk.com) to manage user authentication and session handling; their privacy policy governs the data they collect in that context. We use Resend (resend.com) to deliver transactional email, including survey invitations and report delivery; Resend processes email addresses and message content as necessary to send those messages. Each third-party service operates under its own privacy policy, and we encourage you to review them. We host the Service and its database on Railway (railway.app), which processes all Service data as our infrastructure provider. Where you have opted in to receive our letters, your email address and preview result are processed by our email sequence provider, Bulbul, until you unsubscribe.

5. Data Storage

All application data — including survey responses, scored profiles, and user records — is stored in a PostgreSQL database. Data in transit between your browser and our servers is encrypted using TLS (Transport Layer Security). Database backups are retained for a limited period to support disaster recovery, and are subject to the same access controls as production data.

6. Data Retention

Data is retained for as long as the associated coach account remains active. Coaches may request a soft delete of specific assessment projects or their account in its entirety by contacting us. Following a deletion request, data will be removed from active systems within 30 days, subject to any legal obligations that require us to retain certain records for a longer period.

7. Cookies

The Service uses only the session cookies set by Clerk to maintain authenticated sessions for logged-in coaches. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. Survey participants who access the platform via token link are not issued any persistent cookies.

8. Your Rights

Depending on your jurisdiction, you may have rights regarding your personal data — including the right to access the data we hold about you, request correction of inaccurate data, or request deletion of your data. To exercise any of these rights, please contact us at the address below. We will respond to all verifiable requests within 30 days.

9. Changes

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, where the changes are material, notify affected users by email. We encourage you to review this page periodically so you remain informed about how we protect your data.

10. Contact

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at assessments@murgh.app.