Privacy notice

What we process

• Answers and assessment context (organization, system name, scope): kept only in your browser tab (session storage). They are sent to the server only to generate a PDF or an email, processed in memory and not stored.
• Email address (only if you request delivery by email): used solely to send the report. It is not stored, not added to any mailing list and never used for marketing.
• Technical data: your IP address is kept briefly in memory to protect the service against abuse (rate limiting). Server logs record technical events and errors, without your answers or email address.

Retention

No assessment is stored on our servers. Your answers are deleted when you close the browser tab or click "Clear my answers" on the report page. Rate-limiting data expires within one hour. Emails sent remain subject to the retention of the email providers involved.

Legal basis and your rights

Processing is based on your request (sending the report you asked for) and on the legitimate interest of protecting the service. Under the GDPR you have the right to access, rectify and erase your data and to object to processing. As no assessment data is retained, there is usually nothing to access or erase after your session ends.

Security

All communications use HTTPS. Reports are never published at a URL: they exist only in your browser and in the PDF you download or receive.