Privacy policy

Product Assessment (productassessment.org) is operated by Stone Circle Partners. In this policy, “we”, “us”, and “our” mean Stone Circle Partners.

This policy explains what personal data we collect when you use the site and the product, why we collect it, who we share it with, how long we keep it, and what you can do about it.

To make a request about your data, use the request options on your account page. You can request deletion of your account, flag a conclusion in a report that you think is wrong, add clarifying evidence, or report a factual error. Every request is recorded. Questions about this policy can be raised through the same account page.

To report a security vulnerability privately, use the security advisory feature on the project’s repository. Please do not post it publicly.

Account data: your email address. Your password is handled by our authentication provider. Our application does not store it.

Profile and intake answers: your job level, your target level, and your career goals, as you give them to us.

Interview content: your answers and the full conversation transcript, plus text extracted from any resume or document you upload. The uploaded file itself is kept in private storage that only your account can reach.

Generated output: your scorecard, your participant report, and your development plan. If your assessment is sponsored by an organization, also the evaluator report.

Organization data: team invitations, your manager or organization relationship, and your sharing consent and any revocation.

Usage and device data: product analytics events such as pages viewed and buttons clicked, your approximate location derived from your IP address, your browser and device type, and how you arrived (referrer and campaign parameters). We also collect performance measurements and error reports.

Session recordings: we record how public pages of the site are used so we can find and fix problems. A recording replays what appeared on the screen and how a visitor moved through the site, including the address, status and timing of each network request. Console messages are not recorded, and request addresses have tokens and email addresses removed, with no request or response contents. Text typed into form fields is masked. Recording is switched off while you are on the home page, the assessment, check-in, report, shared result, development plan, onboarding, account, sign-in, registration, 1-on-1, or team and organization pages, including any menu or dialog shown on them, and starts again when you move to a public page. The interview conversation is also blocked on its own. Email addresses shown in the page header and registration confirmation are masked. The anonymous Decision Snapshot and the synthetic sample reports are recorded. Recordings are kept for 30 days.

Analytics events and error reports: before an analytics event or error report leaves our systems we remove email addresses, sign-in tokens, signed file links and the text of interview answers, uploaded documents and reports, and we shorten long free text. Error reports do not include request bodies or local variables. This filtering reduces the risk; it is not a guarantee that nothing identifying is ever sent.

Email and verification data: delivery records for the emails we send you, and the result of a bot check at registration.

The interview does not ask about protected characteristics.

To run your assessment, generate your reports and development plan, and let you return to them.

To operate your account, send the emails described next, and keep the service secure and free of abuse.

Email we send: account emails you need (confirmation and password reset, which cannot be turned off); notifications about your assessment, report, plan, check-ins and team invitations; reminders about unfinished work; a feedback request after an assessment; and a written breakdown if you ask for one. Reminders have a link to turn them off, the feedback request has an unsubscribe link, and you can change email preferences from your account page.

To understand how the product is used, and to find and fix errors and performance problems.

To show your report to a manager or organization only where you accepted their invitation or an organization sponsored the assessment.

Results inform development conversations. They do not make employment decisions, and they need human review.

We use these providers to run the service. Each handles only the job described.

Supabase stores your account, your interview, your reports, and your uploaded documents. Railway hosts the Product Assessment application. Anthropic’s Claude API receives your interview content to generate follow-up questions and your report. Resend sends our emails. Cloudflare Turnstile checks registration, and Cloudflare provides DNS and delivery. PostHog receives product analytics events and the session recordings described above. Sentry receives error reports.

Anthropic’s published API terms state that customer inputs and outputs are not used to train its models by default. The data and AI processing page describes what is sent.

If your assessment is sponsored, the sponsor’s authorized viewers can see the reports that were shown to you before you began. You can revoke a manager’s or organization’s access from your account. Revocation stops future access. It does not undo anything already seen.

We do not sell personal data.

There is no automatic deletion of account data today. Your account, profile, interview transcripts, reports, and plans are kept until your account is deleted through a completed deletion request. Uploaded document files are removed from storage when a deletion request is completed.

Session recordings are kept for 30 days. The administrator audit log is kept after an account is deleted, so that a record of who accessed what remains. Email delivery records, analytics events, error reports, and records held by our AI provider follow those providers’ own retention.

Request deletion from your account page. The request shows a status of requested, completed, or cancelled. An administrator completes it, which removes your account data and your uploaded files. Deletion is a manual step, and we do not currently commit to a fixed completion time.

You can view your reports and plans in your account and download a report as a PDF. From your account you can flag a conclusion you think is wrong, add clarifying evidence, or report a factual error.

A single self-serve export of all your data is not available today.

We use the controls described on our security page, including authentication, layered access controls, private document storage, rate limiting, an audit log of sensitive actions, and automated code and dependency checks.

No system is perfectly secure. We have not had an external penetration test or audit, and we hold no security certification.

The assessment is designed for working professionals and is not directed to children. We do not knowingly collect personal data from children.

Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal data, to object to some processing, and to withdraw consent. Use the request options on your account page to exercise them. We respond as applicable law requires.

The application runs on Railway in the United States. Our other providers process data in their own locations. By using the service you understand that your data can be processed in the United States and in other places where our providers operate.

The site uses cookies and local storage in your browser. They keep you signed in, remember your place in some flows, and hold an identifier for our analytics and session recordings. You can clear this storage or block it in your browser settings. Blocking the sign-in storage will stop you from staying signed in.

We will post changes on this page and update the effective date. For material changes we intend to tell account holders by email before they take effect.