Privacy

When you visit the site

We count visits to the site without cookies and without storing anything on your device. For each page, your browser sends the page's address, the site you came from (its domain only) and any campaign tags in the address. A press on a link to the scan, or a request for a template, is counted too, without anything you wrote.

The counts go to our own customer platform. It drops bots, and turns your network address and browser into a visitor code with a key that changes every day. Neither is stored. It also notes whether you use a phone, a tablet or a computer.

We also use Vercel Web Analytics, from the company that hosts the site. It sets no cookies and stores nothing on your device. For each page it records the address, the site you came from, your country, and your browser, system and type of device. It tells visits apart by a code made from your request, which Vercel discards after 24 hours. An address keeps no query string except campaign tags.

Both follow the same rules. Nothing is sent from a browser that asks not to be tracked (Global Privacy Control or Do Not Track). Nothing is counted on the scan, an invitation link, the app, sign-in or the Leader Profile's tests. Our own statistics are deleted after 13 months. The basis is our legitimate interest in knowing how the site is used, GDPR Article 6(1)(f).

When you ask for a template or the guide

To get a free template or the guide, you give your name and work email, and your organisation and role if you wish. You can also tick a box to hear about new templates and articles.

Your request goes to our customer platform, where it becomes a sales lead with what you asked for. We also get a copy by email, sent through Brevo. LeaderPact itself keeps only a cookie that remembers which files you asked for.

The basis is our legitimate interest in knowing who uses the templates, Article 6(1)(f). We keep the request until you ask us to delete it. We email you about new templates and articles only if you ticked the box. Then the basis is your consent, Article 6(1)(a), and you can withdraw it at any time.

When you take the scan

You can take the Leadership Team Scan without an account. Your answers stay in your browser until you save your group. Then they are stored as the group's first anonymous answers, and nothing is kept for a visitor who never saves.

When you create an account

We keep your name, your email address and your company if you give it. A password is kept only as a one-way hash, and signing in by email link needs none.

If you sign in with Google or Microsoft, we receive your name and email address from them. We never receive your password there.

The basis is the agreement to give you the service you signed up for, Article 6(1)(b). We get a copy of each new account by email, sent through Brevo: your name, email, company and how you signed up. That tells us who uses LeaderPact, a legitimate interest, Article 6(1)(f).

When you lead or join a group

A group holds its name, its organisation's name and its members: each member's name, email address, role and the dates they joined or left.

When a team leader invites you by email, they give us your name and address. We use them to send the invitation, and keep it with the group. Members of a group see each other's names, and only the team leader sees the addresses of those invited.

What a group writes stays with the group: its charter, agenda items, decisions, actions and focus areas. Each records who wrote or owns it. Signals about how a meeting is going, such as off track, are stored without a name and deleted when the meeting is ended.

For each round we record whether you answered, never when. That gives the group its count of answers, and sends reminders only to those who have not answered.

Our customer platform receives what it needs to look after customers and billing. That is each member's name, email and role, the organisation's name and size, and its plan. It also gets daily counts, such as members, rounds and meetings, and the latest sign-in date. It never gets an answer, a score, a Leader Profile or a comment.

The basis is the agreement to give the group the service, Article 6(1)(b), and our legitimate interest in running it well, Article 6(1)(f).

The Leader Profile

The Leader Profile is yours alone. We keep your result: for each trait, the sum of your answers and their number. We also keep the test and when you took it. Your answers themselves are not stored.

A group sees it only if you share it, at the level you choose, and then only as bands. You can change what each group sees, or delete the profile, at any time. A delete takes effect at once.

You can also download it as a PDF, or make a private link to it. Anyone with the link sees your name, the test and your bands at the level you chose. We keep only a fingerprint of the link, never the link itself. It stops working when you turn it off, make a new one, take the test again or delete the profile. A PDF you have sent is a copy we cannot recall.

The basis is your consent, Article 6(1)(a), which you give when you keep your result. Withdrawing it is deleting the profile.

The email we send

We send email through Brevo: sign-in links, invitations, round reminders and the link to your data export. A weekly or monthly summary comes only if you want one. You choose the summary in Settings, under Notifications.

If an address bounces, reports spam or unsubscribes, we keep a one-way hash of it, so we do not mail it again.

Logs and abuse

Supabase and Vercel log each request with its network address for a short time, for security and to find faults. Our own logs carry codes, never what you wrote.

To stop abuse, we count requests per network, per email address or per account, over an hour or a day. Each count is kept under a one-way hash, never the address itself, and deleted soon after.

Cookies and storage on your device

We use only what the service needs to work. Nothing is used for statistics or advertising.

Drafts stay in your browser and are sent nowhere until you submit them.

Who helps us

• Supabase (Supabase Inc., USA): the database, sign-in and scheduled jobs. Your data is stored and processed in Frankfurt, Germany.
• Vercel (Vercel Inc., USA): hosts the site and the app, and counts visits to the site (Web Analytics). The app runs in Frankfurt, Germany.
• Brevo (Brevo SAS, France): sends our email, and records whether a message was delivered, opened or clicked.
• Google and Microsoft (Ireland): sign-in, only if you choose it.
• Our customer platform: our own system for customers, billing and sales, which also runs on Supabase in Frankfurt.

Supabase and Vercel are US companies. Any transfer outside the EEA, for example for their support, rests on the EU Commission's standard contractual clauses. We do not sell personal data, and we share it with nobody for their marketing.

How long we keep it

Your rights

You can ask to see, correct or delete the data about you. You can ask us to limit its use, and object to use based on legitimate interest. You can also ask for the data you gave us in a machine-readable form.

Much of this you can do yourself, in Settings under Privacy:

• Download my data: a file of your data, by a link that works once, for 24 hours.
• Delete my results: removes your Leader Profile, and what each group could see of it, at once.
• Delete account: removes you and everything that names you in LeaderPact. What you wrote for a group stays with it, without your name.

Deleting your account does not reach the copies our customer platform and our mailbox hold. Write to us, and we delete those too.

Anonymous answers cannot be shown, corrected or deleted for one person, because nothing links them to anyone. If you think we handle your data unlawfully, you can complain to the data protection authority where you live or work.