How we handle your data

We collect the minimum necessary.

• Required: your email address, your assessment answers and computed results.
• Automatic: usage logs and browser/device data (security and error handling).

We do not collect your name or phone number.

• Email delivery and web viewing of your report.
• Passwordless (magic-link) account creation and identity confirmation.
• (With optional consent) product updates.
• (With optional consent) anonymous, non-identifying benchmark statistics.

We delete your data without undue delay once its purpose is met, or when you delete your account or withdraw consent, except where law requires retention.

We use the following processors (including cross-border processing):

• Supabase, Inc.Database, authentication, hosting
• Resend (Plus Five Five, Inc.)Transactional email delivery
• OpenRouter, Inc.AI analysis of assessment inputs
• Vercel Inc.Application hosting / CDN

You may access, correct, delete, restrict processing of, or withdraw consent for your data at any time. Deleting your account destroys the associated data. Unsubscribe links opt you out of marketing.

Row-level security (RLS), encryption in transit, least-privilege access, and server-only service keys.

The service targets business users and does not knowingly collect data from children under 14.

Privacy inquiries: esgbrain@gmail.com. Changes to this policy are posted here with a new effective date.

Informational only — not a substitute for an official ESG evaluation.