Privacy policy.

Who is responsible for your data

Pioneership Ltd is the data controller. We are a private limited company registered in Scotland under company number SC759961. Our registered office is 31 Silverknowes Grove, Edinburgh, Scotland, EH4 5LZ. Contact us at support@pioneership.co.

Personal data we collect

We collect your email and account details; assessment answers and calculated results; reports, purchases and billing references; support messages; survey responses; guide requests; notification-list choices; consent records; and technical security information such as request identifiers and error records. Payment-card details are collected by Stripe and do not pass through Pioneership systems.

Survey responses are linked to your account email when you are already signed in. Responses from other visitors are stored without a name or email.

Historic Coach conversations, preferences and connection records remain stored for customers who used earlier Coach versions. Coach interactions and scheduled messages are currently inactive.

Why we use it and our lawful bases

Agreeing to our terms or reading this policy does not give permission for optional analytics, research or marketing. Those choices are separate. A contract with a parent does not by itself provide a lawful basis for using a child's data. If a participant cannot enter into a valid contract, contact us before creating their account or submitting assessment answers so we can establish the appropriate lawful basis and any necessary consent arrangements.

Staff access for support, faults and quality checks

Authorised administrators can see account details, purchase status and assessment progress to operate the service. They may open your full report when needed to respond to a support request, investigate a report fault or carry out a documented quality check. We limit this access to authorised administrators and record the administrator, time, report and whether it was viewed or downloaded. This applies to younger users' reports too.

Necessary support uses the applicable lawful basis described above. Fault investigation relies on our legitimate interests in providing a reliable service, subject to your rights and interests. Analytics and research choices do not control this operational access. You can contact support to object to processing based on legitimate interests. We assess each objection and explain our decision. Report access is not permission to use your report for personalised marketing or research.

Assessment profiling

The Full Assessment uses your answers to calculate scores across the Pioneership framework and assign primary and secondary contribution types. The report may use those calculated results to generate explanatory narrative. It is reflective guidance and produces no decision with a legal or similarly significant effect. Employers must not use it for hiring, selection or employment decisions. You can ask us to explain the data used to create your profile or correct account data by contacting support.

Calculating your profile is part of the assessment you request. Answers and results describe your responses at that time and should be considered alongside your own experience. AI may help write the report narrative; it can make mistakes. Contact support if a result or explanation concerns you. You can choose whether to share your report and should treat access links as private.

Service providers and international transfers

We use Vercel for website hosting and delivery; Supabase for database hosting; Stripe for payments and billing; Clerk for sign-in; Anthropic for report narrative generated from assessment results; Resend for guide, account and product email; Upstash for rate limiting; Sentry for error monitoring; and PostHog and Google Analytics for optional analytics. We give providers processing information on our behalf documented instructions and remain responsible for our use of their services. A provider may also process certain information for its own lawful purposes, such as payment compliance; its own privacy notice explains that processing.

Earlier Coach messaging used Twilio for WhatsApp delivery. That feature is inactive. We include any retained provider records in relevant privacy requests.

Some providers may process personal data outside the UK. Where this happens, we rely on an applicable UK adequacy regulation or contractual safeguards recognised under UK data-protection law. Contact us for information about the safeguard used for a particular provider.

How long we keep data

A deletion request covers eligible live records and identifiable copies under our control, including earlier exports and records held by providers on our behalf. We track these checks in a restricted deletion case and explain any justified retention. Backup copies may remain beyond use until their scheduled expiry. We take steps to prevent deleted information being restored to active use. Contact details and provider references in the case are removed when its tasks are complete. Limited case evidence is reviewed for deletion after 12 months.

• Accounts, answers and reports are kept to provide your saved profile. Account deletion removes live assessment records and shared report links. We retain limited records where needed for legal obligations or justified security purposes.
• Incomplete assessment sessions may be removed when they are no longer needed to resume the assessment.
• Notification-list records remain until the relevant launch, withdrawal of consent or list closure.
• Support and security records remain only for the period needed to resolve the issue and protect the service.
• Survey responses are kept while they remain useful for improving Pioneership, then deleted or anonymised.
• Transaction and accounting records are retained for the period required by UK tax and company law.
• Optional analytics follow the durations described in our cookie policy.

Your rights

Depending on the processing and lawful basis, you can:

• access the personal data we hold about you
• correct inaccurate or incomplete personal data
• ask us to erase or restrict the use of personal data where the law allows
• receive personal data you provided in a portable format where applicable
• object to processing based on legitimate interests or direct marketing
• withdraw consent at any time where consent is our lawful basis

Account settings provide report export and account-deletion controls. Service-provider records, support records and backups may require separate handling. Contact support for a complete erasure request, including any identifiable research extracts. We explain any information retained and the reason. Email support for any other request. You can complain to the Information Commissioner's Office through ico.org.uk/make-a-complaint.

Children and young people

We no longer request parent purchase approval through checkout. Records from earlier requests remain protected, are scheduled for deletion after 30 days and are included in privacy-request handling. Our service-message and provider retention arrangements also apply to those earlier emails. Your answers help us prepare your profile. Your email helps you return to it and receive service messages. You can ask support to explain what information we hold, correct it or help you request deletion. These privacy rights belong to you, including when an adult pays.

In the UK, where we rely on consent to provide an online service directly to a child under 13, that consent must come from a person with parental responsibility and must be appropriately verified. Other countries may set a different age. If this applies to you, ask that person to contact support before using a feature that asks for consent. Optional analytics stay off for UK under-18s, users outside the reviewed UK scope and anyone whose eligibility has not been established. We are not enabling under-13 analytics through parental consent. Optional reliability research is available only to eligible UK adults after the research review is complete. A tick in a box or a payment does not establish verified parental consent.

A parent or guardian can contact support about a child's information. Any request to act for the child or receive their information must take account of the child's understanding, wishes, best interests and applicable law. Payment alone does not establish authority to receive a child's answers or report. Tell support if account access or a shared link is causing concern.

Optional choices and withdrawing consent

We collect your self-declared age band (under 13, 13, 14–17 or 18+) and UK or non-UK location to apply privacy choices and purchase safeguards. For signed-in users and people using a verified account link, we save these choices against the account. We also use a signed essential browser cookie for 30 days. These choices are not included in analytics events. We do not request a date of birth for this purpose. You can change or delete saved privacy choices in account settings. Deleting these choices turns off optional analytics and withdraws research permission. We retain the completion status and any minimum age safeguard needed to protect younger users until the account is deleted. Contact support to correct a saved under-18 declaration. Optional analytics require eligible UK settings, completed privacy and supplier checks, and your separate consent. Existing cookie choices alone do not establish eligibility. We limit events to reviewed navigation and product-use information and exclude your email, assessment answers, report content and private access links. You can take the assessment without agreeing to optional analytics, published reliability research or launch notifications. Use cookie settings to withdraw analytics consent. For research, use the research-permission control in account settings or email support@pioneership.co. For launch notifications, email support from your contact address. Withdrawal does not affect processing that was lawful before you withdrew consent. Findings that have already been genuinely anonymised cannot be linked back to you for removal.

Optional research studies the consistency of our assessment questions and results, including comparisons between your assessments. Eligible UK adults can give separate permission in account settings after our research review is complete. We record the declared adult age band, UK location, permission wording version and dates. Permission lasts for 12 months and covers future completed assessments. Earlier permissions do not enrol you automatically. Researchers use coded participant identifiers; only genuinely anonymous findings may be published. Withdrawal excludes identifiable responses from future research. We also review earlier identifiable extracts and contact relevant recipients about removal. Assessment records continue under the service retention policy.