Privacy.

What we store

When you unlock the field guide, the lead record includes:

• email address
• first name, if given
• stage you named
• calculated floor stage
• floor stage name
• slide stage
• Achilles heel question
• crash risk flags
• effectiveness, safety, and measurement gauges
• shareable result code, which encodes your answers
• submission source
• call inquiry details; team copies inquiry name, organization, quantity, format, timeframe and note; or speaking inquiry name, organization, event, date or timeframe, audience size, format, location and message
• optional marketing consent (0 or 1)
• time of consent, if given
• campaign source tag from the link you arrived on, if any
• campaign medium tag, if any
• campaign name tag, if any
• campaign content tag, if any
• the website that referred you (domain only), if any

We also record a row ID, creation time, and lead status. An administrator may add internal notes under your email address for follow-up; those notes are not sent to the optional CRM webhook or included in the lead CSV.

We count a benchmark completion only when analytics events for that page visit show the full quiz and enough time to read it. If analytics is off, including Global Privacy Control, your run is excluded from comparisons. An eligible fresh finish stores the anonymous fields below, without its result code, page-visit ID or individual score profile. Opening a shared result does not add a completion.

• anonymous completion row ID
• UTC completion day, without the time
• calculated floor stage
• stage you named, if any
• optional industry choice
• hash of a short-lived random industry edit token, removed after use

Ten-piece scores contribute to monthly industry averages. Buckets with fewer than ten completions store only a count, without a score profile.

• UTC month of the completed assessments
• industry choice, or untagged
• number of completions in that month and industry
• ten-piece sums after ten completions; otherwise empty

Where it goes

Leads, privacy requests and anonymous assessment completions are stored in SQLite on our own server.

An optional CRM webhook may receive a copy of a lead. A failed forward does not erase our stored record.

For a lead signup, we may send only your email address to OpenRouter and its model provider to check whether it appears genuine. We request a provider that does not collect the request data. If the check is unavailable, we let the request through. Privacy requests are exempt.

We keep leads, internal admin notes and privacy requests for 24 months. We keep analytics events and anonymous assessment completions for 13 months.

Tracking and cookies

Our first-party analytics is cookieless. Optional Google Analytics, Google Ads, Meta and LinkedIn tags load only after you accept analytics and ads. Those vendors may use cookies or similar identifiers for measurement and remarketing. The admin login has its own first-party session cookie.

We count funnel steps (for example: quiz started, question answered, result viewed) with our own cookieless analytics. Each event stores the step name, a random ID that lasts one page visit, a device class, campaign tags and the referring domain. It never stores your IP address, browser user agent, email or answer text, and it sends nothing when your browser signals Global Privacy Control.

If you accept, we send allowed event names and limited numeric or named properties to the configured vendors. We do not send your email, answer text, result code, campaign query or page URL to those tags. They run in a separate frame with a fixed address. Reject or withdraw consent with Manage analytics and ads. Your choice is kept in one first-party local storage key, achilles_marketing_consent_v1, so we can remember it.

Global Privacy Control is treated as rejection and also stops our first-party event counts. You can turn it off in your browser settings if you want to make a different choice here.