StaffAnalysis is operated by Staff Analysis, a series of Balanced Company LLC (“StaffAnalysis,” “we,” “us”). This policy covers personal information we handle through staffanalysis.com, our forms, checks, tools, reports, emails, and related services (the “Services”). Our Terms of Service also apply.
We play two roles:
For visitors and customers, we decide how your information is used. We are the “controller” or “business.”
For people a customer invites to answer questions (“Respondents”), we act for the customer, usually your employer. We are the customer’s “processor” or “service provider.” Section 7 explains what that means for you.
This policy does not cover the privacy practices of other companies, including the payment and booking services we link to, which have their own policies.
2. What we collect
What you give us
Free check: your first name, work email, your answers to eight questions about your company, and whether you ticked the box asking for tips.
Tools, Founder Read, Staff Analysis, and With Ben: your name, email, company name, company size, role, and your answers about how your company runs. These answers can describe your business, its people, and its problems.
Your team roster, if you invite people: each person’s name, email address, job title, and whether they make decisions or contribute.
Payments: Stripe collects your payment details directly. We receive the result: amounts, discounts, fees, refunds, disputes, and Stripe reference numbers. We never receive your full card number.
Booking a call (With Ben): before the scheduler opens, we ask for your name, work email, and company website. If you then book through the Cal.com scheduler on our site, Cal.com collects your name, email, chosen time, and anything you add, and shares the booking with us.
Contact and custom-work forms: your name, email, company, topic, and message.
What Respondents give us
Answers to questions about how work gets done: roles, handoffs, workload, tools, and what gets in the way. We ask Respondents to talk about roles, not people, and not to share sensitive information.
What we collect automatically
Security and network data: IP address, browser and device type, and request details. Cloudflare processes these to deliver the site and block attacks. We use IP addresses briefly for rate limiting and abuse prevention, and keep a hashed key for up to about three days to limit how many orders one connection can start.
Bot checks: Cloudflare Turnstile checks whether a form is being filled in by a person, using signals from your browser. It is not used for advertising.
Activity in the Services: events like “started a check,” “opened an invitation,” “submitted answers,” “paid,” and email delivery status, with timestamps.
Cookies: see Section 6.
What we don’t collect
We don’t ask for, and you should not send us, sensitive personal information. That includes Social Security or other government ID numbers, financial account numbers, passwords, health or medical information, genetic or biometric data, precise geolocation, immigration status, union membership, sex life or sexual orientation, religious beliefs, or criminal history. We do not collect biometric identifiers. If sensitive information appears in a free-text answer anyway, we use it only to provide the Services, and you can ask us to delete it.
3. How we use it
To provide the Services: score checks, write reports, run Staff Analyses, send invitations and reminders on a customer’s behalf, show progress, and deliver results.
To communicate with you: results, receipts, progress updates, answers to your messages, and, only if you asked for them, tips.
To take payment and keep accurate financial, tax, and accounting records.
To keep the Services safe: prevent fraud, spam, and abuse; enforce rate limits; secure links; investigate problems.
To support and improve the Services: fix errors, measure reliability and cost, and understand which pages and products help people. We use aggregated or de-identified data for this where we can.
To meet legal obligations and to establish, exercise, or defend legal claims.
We do not use personal information for targeted advertising. We do not make decisions about people that produce legal or similarly significant effects based solely on automated processing.
4. How AI is used
We send answers and intake details to Anthropic’s Claude models through Anthropic’s commercial API to score checks and write reports. Under its commercial terms, Anthropic acts as our service provider, may not use this data to train its models, and keeps it only for a limited time for safety and legal purposes.
We never use your information to train AI models, ours or anyone’s.
Our instructions tell the AI to describe roles, not people. Before a report is saved, our software scans it for the names of people the customer invited and replaces each one with that person’s role. While a report is being written, the AI’s draft passes through our hosting provider’s job system, which keeps temporary job records for up to 30 days.
Reports may quote short phrases from answers to make a point. Quotes are labeled by role, never by name.
Reports are about how an organization works. They are not assessments of individuals, and our Terms forbid customers from using them for decisions about a specific person’s job.
We keep a log of each AI request’s size, model, cost, and status, without its content.
5. How we share it
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as follows:
Service providers and subprocessors that host, secure, email, analyze, or process data for us under contracts that limit their use of it. They are listed, with what each one does, on our Subprocessors page.
Payment and booking providers. Stripe processes payments, and Cal.com handles call scheduling. Each also follows its own privacy policy for data it collects directly.
The customer who invited a Respondent receives the report built from Respondents’ answers, and sees who has completed their questions. See Section 7.
Our parent company and affiliates, Balanced Company LLC and its other series, for operations, support, and administration, under this policy.
Legal and safety. When we believe in good faith that the law, a court order, or legal process requires it, or that it is needed to protect the rights, property, or safety of anyone, or to prevent fraud or abuse.
Business transfers. As part of a merger, acquisition, financing, or sale of assets, subject to this policy’s protections.
With your direction or consent.
6. Cookies, analytics, and signals
Strictly necessary cookies. When a Respondent opens their questions, we set a secure, HTTP-only session cookie so answers save to the right place. Cloudflare may set security cookies to tell people from bots. These cookies are needed for the Services to work, so they can’t be turned off on our side.
Fonts. Our pages load typefaces from Google Fonts, which means your browser sends your IP address and browser details to Google when it fetches them.
Analytics. We may use Google Analytics to understand how many people visit and which pages help them. If we do, we configure it without advertising features, without Google signals, and without sharing data with Google for advertising, and we do not send it names, email addresses, or answers. Google Analytics uses first-party cookies. You can opt out with Google’s browser add-on or by sending a Global Privacy Control signal.
Search Console. We use Google Search Console to see how our pages appear in Google search. It gives us aggregated search data, not information about individual visitors.
Global Privacy Control. We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of your personal information, and we turn off optional analytics for that browser.
Do Not Track. There is no common standard for Do Not Track signals. Because we don’t track people across other websites or sell data, we respond to the stronger Global Privacy Control signal instead.
We do not use advertising pixels, retargeting, or session-recording tools.
7. If your employer invited you
If you got an invitation to answer questions for a Staff Analysis, your employer or the organization you work with (the “customer”) chose to run it and gave us your name, email, and job title. We process your information for the customer, on its instructions, and only to deliver the Staff Analysis.
What the customer sees: whether you have opened and finished your questions, and the final report. The report is written about roles, not people. It doesn’t name you, and quotes are labeled by role. In a small team, a role can still point to one person, so write as you would in any work setting.
What the customer doesn’t see in the report: your name next to your answers.
What we do with your information: send your invitation, up to two automatic reminders, and any re-sends the customer asks for (no more than one an hour), save your answers, and use them with others’ answers to write the report. We don’t send you marketing, sell your information, or use it for any other customer.
Please don’t include health details, information about anyone’s private life, or anything else sensitive.
Your choices: taking part is voluntary. Our Terms require customers not to retaliate against anyone for taking part, declining, or what they said, and not to use reports for decisions about any one person’s job.
Your rights: because we act for the customer, requests to access, correct, or delete your information usually go to the customer. You can also write to legal@staffanalysis.com. We will help, and where the law requires it we will pass your request to the customer.
8. Emails from us
Service emails deliver results, receipts, invitations, reminders, and progress updates. They come from a send-only address. You will get these while you have an active check, order, or invitation.
Tips are short emails about running a team. We send them only if you tick the box asking for them, which is unticked by default. Every tips email has a one-click unsubscribe link, and we honor it right away. Unsubscribing does not stop service emails about something you ordered.
We do not sell or rent email addresses, and we do not share them with others for their marketing.
9. How long we keep it
We keep personal information only as long as we need it for the purposes in this policy, then delete or de-identify it.
Information
How long
Answers to an order you started but didn’t pay for
Deleted after 30 days without activity. Orders with no email address are deleted after 3 days.
Free check answers and results
Until you ask us to delete them, so the link to your result keeps working.
Paid orders, intake answers, Respondent answers, and reports
As long as you may need to return to your report, or until the customer asks us to delete them.
Respondent invitation links
Stop working the day after answers close. That is normally about 15 days after the invitation, or up to 22 days if we extend the deadline because nobody has answered yet.
Payment and billing records
As long as tax and accounting law requires, generally up to seven years. Names and emails can be removed sooner on request, while amounts and dates stay for the books.
Contact form messages
In our inbox as long as needed to answer you and keep a record of the conversation.
Custom-work enquiries, With Ben call requests, and waitlist sign-ups
As long as needed to follow up with you, or until you ask us to delete them.
Temporary report-generation job records
Up to 30 days, held by our hosting provider.
Email send log (recipient, type, date, status, never the content)
As long as the related order or check exists.
Rate-limiting keys
Up to about three days.
Database backups
Roll off automatically after 30 days.
When we delete a person at their request, we remove their name, email, answers, report content, and links everywhere they appear, including other customers’ rosters. We keep amounts, dates, and payment references for accounting. Temporary report-generation job records expire on their own within 30 days. Stripe and our email inbox keep their own records under their own policies.
10. Your rights and choices
Depending on where you live, you may have the right to:
Know and access the personal information we hold about you, and get a copy in a portable format;
Correct inaccurate information;
Delete your information;
Opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. We don’t do any of these, but you may still ask;
Limit the use of sensitive personal information. We don’t use it to infer characteristics about you;
Learn the specific third parties we have disclosed personal information to, where your state allows it; and
Not be discriminated against for using these rights. We will not deny service, charge different prices, or give a different quality of service because you exercised a privacy right.
We extend these rights to every U.S. resident, wherever you live, not only where the law requires.
How to make a request
Email legal@staffanalysis.com, or use our contact form and choose “Privacy or data request.” Tell us what you are asking for and the email address you used with us.
Verification. To protect you, we confirm requests by writing to the email address on file and asking you to reply. We may ask for more information if a request is unusual. We use it only to verify you.
Authorized agents. Someone you authorize may make a request for you. We may ask for signed proof of their authority and ask you to confirm your identity with us directly.
Timing. We confirm requests within 10 business days and respond within 45 days. If we need more time, we will tell you why and may take up to 45 more days, where the law allows. Requests are free, up to twice a year.
Appeals. If we decline your request, you may appeal by replying to our decision or writing to legal@staffanalysis.com with “Appeal” in the subject. We will respond within 60 days (45 days in some states) and explain our decision. If you disagree with the outcome, you may contact your state attorney general. For Texas residents, that is the Office of the Texas Attorney General.
Respondents. See Section 7. We may pass your request to the customer that invited you.
11. Security
We use administrative, technical, and physical safeguards suited to the information we hold, including:
encryption in transit (HTTPS) everywhere, and encryption at rest by our hosting provider;
private links that are long and random. We look them up by a one-way hash, and keep an encrypted copy only so we can re-send a link you already have. Links that should expire do;
bot protection, rate limits, and limits on how many orders one connection can start;
an admin area behind Cloudflare Access, open only to named people who must verify their identity;
logs that leave out link tokens and message content; and
vendors that maintain recognized security programs.
No system is perfectly secure. If a breach affects your personal information, we will notify you and regulators as the law requires, including under Texas Business and Commerce Code Chapter 521.
12. State-specific disclosures
California
This section, together with the rest of this policy, is our notice at collection and privacy policy under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. In the last 12 months, we collected the following categories of personal information:
Category
Examples
Disclosed for a business purpose to
Identifiers
Name, email address, IP address, order and link identifiers
Hosting, email, AI, payment, and booking providers; the customer that invited a Respondent
Customer records (Cal. Civ. Code § 1798.80(e))
Name, email, payment references
Hosting and payment providers
Commercial information
Products bought, amounts, refunds
Hosting and payment providers
Internet or network activity
Pages requested, form events, security signals
Hosting and security providers; analytics provider, if enabled
Professional or employment-related information
Job title, role, company, answers about how work gets done
Hosting and AI providers; the customer that invited a Respondent
Sources: you, the customer that invited you, your browser and device, and our payment and booking providers.
Purposes: those in Sections 3 and 4.
Sensitive personal information: we do not intentionally collect it, and we do not use or disclose it to infer characteristics about anyone.
Sale and sharing: we have not sold or shared personal information, including of consumers under 16, in the last 12 months.
Retention: see Section 9.
Shine the Light: we do not disclose personal information to third parties for their direct marketing purposes.
Minors: the Services are not for anyone under 18. If you are under 18 and posted content, ask us and we will remove it.
Texas
Under the Texas Data Privacy and Security Act, Texas residents have the rights in Section 10, including the right to appeal. We process the categories of personal data in Section 2 for the purposes in Sections 3 and 4, and disclose them to the categories of third parties in Section 5. We do not sell personal data, including sensitive personal data, and do not process personal data for targeted advertising. We are not a data broker. We do not capture biometric identifiers.
Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Utah, Virginia, and other states with privacy laws
Residents of these states have the rights in Section 10, including the right to appeal where the law provides it. We do not sell personal data, process it for targeted advertising, or profile people in furtherance of decisions that produce legal or similarly significant effects. Where a state law gives you a right to a list of specific third parties we have disclosed your personal data to, ask us and we will provide it.
Nevada
We do not sell covered information as defined in Nevada law. You may still send an opt-out request to legal@staffanalysis.com.
Washington, Nevada, and Connecticut consumer health data
We do not collect, use, or share consumer health data as defined by the Washington My Health My Data Act and similar laws, and we ask everyone not to send it.
13. Children
The Services are for adults acting for businesses. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you think a minor has given us personal information, contact us and we will delete it.
14. Visitors outside the United States
StaffAnalysis is built for businesses in the United States, and we and our providers process information in the United States and other countries where our providers operate. If you use the Services from elsewhere, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those where you live.
15. Changes to this policy
We may update this policy as the Services or the law change. We will post the new version here and change the “Last updated” date. If we make a material change, we will give notice on the site or by email before it takes effect. We will not use personal information in a materially different way from what we described when we collected it without your consent where the law requires it.