Agency addendum · not the marketing privacy page
Participant data for a Scale cohort.
The public privacy policy is general. This addendum is what HR, privacy, and counsel should file with an office order at $50 or $95 a person. If they conflict on roster ownership or deletion, this addendum controls for that order.
What is collected
| Category | Examples | Required? |
|---|---|---|
| Identifiers | Seat code we issued. Buyer email on the order. Not a name, not an employee number, not SSN, not EDIPI | The seat code is how the office downloads the file |
| Assessment content | The 50 answers are read in memory to build a one-page PDF (composite and six domain counts). The answers are not written to the database. The PDF is held 14 days | Yes, to deliver the file. Then deleted |
| Technical | Cloudflare can see ordinary connection logs. We do not write an IP onto the seat. Wallet link token | Host logs, not a personnel file |
| Not collected | SSN, medical data, biometrics, camera, microphone, precise geo, USAJOBS passwords | — |
Ownership and roles
The agency keeps the map from seat code to person on its own systems. ALA does not receive that map. Completers sit in the browser. The office downloads the PDF. This is exploration and development support, not a qualification determination.
Who can see it
- Named agency admins on the order.
- ALA operators (founder and designated staff) on a need-to-know basis for support.
- Cloudflare, Stripe, Mailgun as subprocessors listed on the security statement.
- Not sold. Not used to train a public model from this cohort. Not posted to USAJOBS.
Retention, deletion, holds, records
- The one-page PDF is held 14 days so the office can download it, then deleted. We cannot rebuild that grade.
- Invoice, buyer email, and used or unused seat codes stay as the purchase record. The answers are not stored.
- A PDF still inside the 14 days is deleted on a written request. We confirm that deletion. We cannot delete the copy already in the agency’s mail.
- FOIA / records: the agency is the records authority for the PDF it downloaded. ALA cannot produce a name roster. We do not have one.
- Breach: 72-hour notice to the named contact as in the security statement.
Reuse for algorithm development
Default for Scale: no. De-identified method research, if any, requires a separate written agency opt-in. This SKU is delivery of profiles and a cohort map, not a research grant.