Privacy policy

Who we are

Doomers, Gloomers, Bloomers & Zoomers is a show, and Where You Stand is the instrument it runs: a short set of questions that ends in a job, the thing it makes most sense for you to do next. Both are run by Ocupop. In this policy, “we” and “us” mean [PLACEHOLDER: legal entity name], trading as Ocupop, of [PLACEHOLDER: registered address].

We decide why and how the information described here is used, which makes us its controller. You can reach us about anything in this policy at [PLACEHOLDER: privacy contact email]. [PLACEHOLDER: data protection officer or representative, if one is appointed; otherwise remove this sentence.]

This policy covers the website where you take Where You Stand, the phone pages of a live room, and the emails we send. It does not cover another organization’s website that links to us.

What we collect if you never give us an email

You can take Where You Stand without a name, an account or a sign-up. When you do, we keep your answers, the result they lead to, when you answered and how long each answer took, and which consent choices you made and when.

Your browser makes a random id the first time you begin, and keeps it, with your session, in this device’s local storage. That id is how you pick up where you left off. It is not your name and it is not linked to an account, because there is none.

If you choose to, you can also add your answers to your team’s combined results, make a link to your result that you can share, or ask us to email you when your team’s results unlock or to reply about an offer. Each is a separate choice you can withdraw.

Your answers are private. Nobody sees your individual answers but you. Your teammates see your team’s pattern only once at least five people have finished, and never anyone’s individual answers. Anyone holding a share link sees your result card, not your answers.

In a live room

In a room, your phone runs the same questions under a random id kept on that phone. You do not give your name, and no name is ever shown on the screen.

The room sees answers only all together, and only once at least eight people have answered. A position you record during the show is shown to the room as one anonymous point among the others, never as yours. Your own answer and your before and after are shown on your phone only.

The host sees how the room is answering, as counts, and how many phones are connected. The host never sees who you are, and the room’s export carries answers under an id made for that room alone, so it cannot be joined to another room’s or to the website’s.

What changes if you give us an email

Giving us an email is always optional, and is never asked for before your result. If you give one to keep your result, we use it only to send you a confirmation link, then your result with a link back to it, and a notice if you delete everything. With it you can come back to your result from any device.

We write to you about anything else only if you tick the separate box for occasional notes, a few times a year at most. That box is never ticked for you, and every note carries a link to unsubscribe.

Once you add an email, your result is no longer anonymous to us: we keep your answers and result under that email, for you. They stay private. The email is kept in a separate store, apart from your answers, linked to your result only through a one-way reference. You can remove it at any time.

The link in your result email is long and random, and anyone who has it can read that result and nothing more. Treat it like a key. You can get a new link at any time from the Your data page, which turns the old one off.

We never sell your email or your answers, and we never share your email with the room, your team, or a client organization. When we review interest in our offers, we see a reference, not your address.

How we use what we collect

To run the questions and compose your result. Offers we may show you follow from your result and never decide which job you get.

To show a team or a room its combined results, only above the minimum group size.

As research data. We use anonymous answers to test and improve the questions and to report how people answer. Nothing we report identifies you. Test sessions and rehearsal rooms are kept out of research data.

To keep the service working and safe: to stop abuse, limit how often requests can be made, and find faults.

The basis on which we use your information is [PLACEHOLDER: legal bases, as counsel sets them, e.g. consent for each opt-in and our legitimate interests for running the service and anonymous research].

How long we keep it

On the website, your saved session is linked to the random id on your device for 7 days, so you can pick up where you left off. After that, your answers are kept only as research data. [PLACEHOLDER: how the random device id is treated after the 7 days, once the owner has decided.]

In a room, your answers are kept for 90 days by default. After that they are deleted, and only anonymous combined results are kept.

In a client engagement, answers are kept for the period the engagement’s contract sets, 24 months unless the contract says otherwise. The organization’s leadership sees combined results only, and only for groups of at least five; a group smaller than that is left out. Leadership never sees an individual’s answers.

Combined, anonymous results are kept with no end date.

Your email is kept until you remove it or delete everything. A message you sent us through the contact form is deleted with your email, or 12 months after the conversation is closed.

Backups may hold deleted information for up to [PLACEHOLDER: backup retention period] before they expire.

Who processes it for us

Resend sends our emails. It receives your address and the email’s content in order to deliver it, and tells us if a message bounced or was marked as spam. What we label each message with is an opaque reference, never your address.

Our hosting provider, [PLACEHOLDER: hosting provider and data region], runs the service and the database that holds the information described here.

A short join address shown in a room, [PLACEHOLDER: join domain and who hosts it], only sends your phone on to the room’s page.

We do not use any other company to process your information. [PLACEHOLDER: confirm the list of processors at publication.]

Cookies and local storage

The website sets no cookies. It keeps a random id and your session in this device’s local storage, with the look of the page you started on, so that a reload or a return picks up where you left off. In a room, the phone also keeps an answer you tapped until it has been sent.

On a host’s device, the host console keeps the operator key and the room’s host key in local storage, so the host does not have to type them again.

There are no advertising or analytics trackers, and the pages load no fonts or scripts from other companies.

You can clear local storage in your browser’s settings at any time. Clearing it forgets your session on that device; it does not delete what we hold, which the Your data page does.

Logs and security

To answer your requests our servers see your internet address. To limit how often requests can be made, they count requests per address in memory for a minute at a time, and do not store the address.

When request logging is on, an address is cut short before it is written (to its first three parts for IPv4, a /48 for IPv6), the tokens in links and every session id are replaced, and no query string, header or request body is logged.

Links in our emails are single-use or long and random, are stored only as a one-way hash, and never act on their own when opened: you press a button on the page to confirm, unsubscribe or delete.

To respect a request not to be written to, and to limit how many emails go to one address, we keep a salted hash of the address rather than the address itself. That hash is the one thing that survives deletion, so that we never write to you again after you asked us not to.

Your rights and how to use them

On the Your data page (/me), on the device you used, you can see what that device holds and what we hold, get a new link, remove your email, or delete everything. Every email we send has an unsubscribe link and a link to the same choices, and none of them needs a password.

Unsubscribing stops occasional notes and keeps everything else. Removing your email deletes it and turns off every link under it; your session stays. Deleting everything removes your email the same way, forgets this device and closes every link. Deletion is immediate. Your anonymous answers stay as research data, because nothing in them identifies you any more.

Depending on where you live, you may have the right to ask for a copy of your information, to correct it, to delete it, to restrict or object to how it is used, to take it elsewhere, and to complain to a data protection authority. [PLACEHOLDER: the laws and the authority that apply.] To use any of these rights, write to [PLACEHOLDER: privacy contact email]. We will answer within [PLACEHOLDER: response period].

If you never gave us an email, we hold nothing that tells us which answers are yours unless you can show us the random id on your device. Without it we may not be able to find them.

Children

Where You Stand is about work and is not directed at anyone under 16. We do not knowingly collect information from children. If you believe a child has given us an email, write to us and we will delete it.

International transfers

[PLACEHOLDER: where the information is stored and processed, which transfers leave the country or region you are in, and the safeguards relied on for them.]

Changes to this policy

When we change what we collect or how we use it, we publish a new version of this policy with a new version number and date. The consent text you agreed to is kept with your session, and answers collected under one version are used only as that version allows.

About this draft

This is a draft written ahead of legal review. It is not in effect, and the bracketed items are still to be filled in.