Privacy Policy

1. What we collect

Assessment answers, including the option you picked and how long you spent on each question.

Setup answers (what you are building, who pays, raise stage) and wrap answers (your 90-day goal and current blocker).

Email address, only if you choose to enter it on the email-capture step or sign in.

Account information for investors who sign up: display name, organization, slug, branding, custom message.

Usage analytics: page views, completion events, the assessment id and view-token, and basic browser metadata. We do not use third-party advertising trackers.

2. How we use it

To deliver your gap report and verdict.

To send the emails you opted into (sign-in link, results, share notifications, compare reports, weekly summaries).

To compute aggregate insights using anonymized, ID-stripped data so we can publish patterns without identifying any single founder.

To run the platform: error monitoring, performance, abuse prevention.

3. Who we share it with

No one, unless you explicitly opt in by sharing.

When you arrive via an investor's link, sharing with that investor is on by default. You can revoke this from your account at any time. The default is opt-in shaped, not silent.

Co-founder compare reports are only visible to the two participants who took the assessments.

We do not sell data. We do not share data with third parties for advertising.

4. How long we keep it

Until you delete it. Account deletion is one click in your account settings; we hard-delete after a 7-day grace period.

Abandoned in-progress assessments are auto-deleted 60 days after the last activity.

Audit log entries (sensitive admin actions, share toggles) are kept for 180 days then auto-deleted.

Aggregate insights, once computed, no longer reference any individual.

5. Your rights

You can export every assessment you have completed as JSON from your account settings.

You can delete your account and all associated data at any time.

You can revoke an investor's access to a previously shared report at any time.

You can withdraw consent for marketing emails (insights, weekly summary) at any time. Critical emails (sign-in, share notifications) cannot be turned off.

If you are in the EU/UK, you have the right to lodge a complaint with your local data protection authority.

6. Retake transparency

If you took an assessment via an investor's link, that investor can see metadata about every retake you do of the same test: the date, the attempt number, and pattern signals (multiple retakes in a short period, large score jumps, share revocations, retakes you did not re-share).

They cannot see the score or answers of a retake unless you choose to share that specific assessment.

We surface this rule clearly before you initiate any retake. You always have the choice not to retake.

7. Data residency and security

Data is stored in MongoDB Atlas, currently hosted in AWS US-East. We will document any data-residency change in this policy.

All connections use HTTPS. Authentication uses single-use email magic links with a 24-hour expiry.

Sensitive admin actions are written to an audit log.

8. Cookies

Strictly necessary cookies: session id, active-assessment id, sign-in token. These are required for the platform to function and are not opt-in.

Analytics cookies (Google Analytics): used to count page views and completion events. Opt-in via the cookie banner. We do not load Google Analytics until you accept.

9. Contact

Privacy questions: privacy@deepnodestudios.com.

We respond within 30 days.