Privacy is not a feature — it's the product

AI Adoption Pulse is a behavioral diagnostics tool built on a simple premise: employees will only share honest feedback if they trust that their responses cannot be traced back to them. Every architectural decision we make starts from this principle.

link_offIdentity and responses are cryptographically separated

When an employee receives an invitation, their email is stored separately from their survey answers. The link between "who was invited" and "who said what" is permanently severed at the moment of survey completion:

• The invitation record is marked "completed" — nothing more.
• The survey response is written to a separate data store with no name, email, user ID, or invitation reference.
• The diagnostic write contains only: campaign ID, optional department/role cohort, and the answers themselves.
• No manager or administrator can ever retrieve an individual's answers.

groupMinimum group-size protection

Results are only shown for groups that meet a minimum reporting threshold. Our default minimum is 8 respondents, and the hard floor is 5. This prevents anyone from identifying an individual through small-group results.

• Groups below the minimum show "suppressed for privacy" — never a fake zero or null.
• We prevent differencing attacks: overall scores may be withheld if visible department results could be subtracted from the total to reveal a small group.
• Open-text comments appear only as redacted summaries from sufficiently large cohorts.

blockWhat we don't collect

• We do not store raw IP addresses. If abuse controls require one, we use a rotating keyed hash with short retention.
• We do not expose exact response timestamps to organization users.
• We do not log survey answers, invite tokens, or result tokens.
• We do not use browser fingerprinting.
• Optional Google Analytics runs only on public marketing pages after you explicitly allow it. We never measure surveys, private reports, authentication pages, customer workspaces, or the support console, and reported page paths omit query strings.

visibilityWhat managers see

Organization administrators see only aggregated, privacy-protected results: completion counts, construct scores for qualifying groups, and deterministic recommendations. They can see how many people completed the survey and what the group patterns are — never who said what.

scheduleData retention and deletion

Retention periods are configuration-backed and documented. Account and invitation data support export and deletion workflows. Truly severed anonymous responses may be impossible to locate by email after completion — we disclose this transparently before you submit a privacy request.

smart_toyAI and LLM boundaries

Our scoring and recommendation selection are deterministic and versioned. An LLM may help explain verified aggregates in report prose, but it:

• Never calculates scores or makes privacy decisions.
• Never receives invitation emails, tokens, IPs, user IDs, or small-cohort data.
• Only receives minimized, anonymized aggregate payloads.
• If LLM generation fails, a deterministic non-LLM report is always produced as fallback.