Privacy Policy

We collect minimal data necessary for operational assessments and system design. This includes: organizational metrics submitted through our assessment forms, email addresses for communication, and basic analytics to improve our site.

Assessment responses are encrypted at rest using AES-256 encryption. Data is stored in secure cloud infrastructure with regular security audits. Client-side data may be stored in your browser's local storage for convenience and is never transmitted without explicit action.

We never sell, rent, or share your data with third parties. Assessment results and organizational information remain strictly confidential. Anonymized, aggregated metrics may be used to improve our site, but individual responses are never disclosed.

Assessment data is retained for 90 days after submission to allow for follow-up and consultation. After this period, data is automatically purged from our systems. You may request immediate deletion at any time.

You have the right to access, correct, or delete your data at any time. To exercise these rights or for any privacy-related inquiries, contact us at privacy@candlefish.ai. We respond to all requests within 48 hours.

We implement industry-standard security measures including HTTPS encryption for all data transmission, regular security audits, access controls, and monitoring. Our infrastructure is designed with privacy and security as foundational principles.

This site is protected by Google reCAPTCHA Enterprise to prevent automated abuse. Your use of our forms is subject to the Google Privacy Policy and Terms of Service. reCAPTCHA analyzes user behavior to distinguish humans from bots without requiring user interaction.

This privacy policy may be updated to reflect changes in our practices. Significant changes will be communicated via email to affected users. Last updated: August 2025.