Privacy Policy
Last Updated: January 2025
Our Commitment to Privacy
FactorFactory is committed to protecting the privacy and security of all personal information entrusted to us. This policy describes how we collect, use, and protect your data.
Information We Collect
Partner Account Information
- Name and contact information
- Organization details
- Account credentials
- Payment information
Assessment Data
- Assessment taker information (as provided)
- Assessment responses
- Scores and results
- Demographic information (optional)
Usage Information
- Platform usage analytics
- Assessment administration data
- Technical information (IP address, browser)
How We Use Information
We use collected information to:
- Provide assessment services
- Generate assessment reports
- Process payments and commissions
- Improve our services
- Comply with legal obligations
- Communicate with partners
Data Security
We implement enterprise-grade security measures:
- TLS encryption for all data in transit; databases and backups encrypted at rest
- Hosted on Heroku (Salesforce), whose infrastructure holds SOC 2 Type II and ISO 27001 attestations
- Partner accounts see only their own respondents; administrative access is limited to named accounts
- Error monitoring configured not to receive personal data
- See our information security statement for the full picture
Data Sharing
We do not sell or rent personal information. We share data only:
- With your explicit consent
- To provide requested services
- As required by law
- With service providers under strict agreements
Your Rights
You have the right to:
- Access your personal information
- Correct inaccurate data
- Request deletion of your data
- Opt-out of marketing communications
- Data portability where applicable
GDPR Compliance
For EU residents, we comply with GDPR requirements including:
- Lawful basis for processing
- Data minimization
- Purpose limitation
- Data subject rights
- Data protection by design
Data Retention
We retain data only as long as necessary for:
- Providing services
- Legal compliance
- Legitimate business purposes
How long we keep information
We keep personal information for as long as we need it to provide the service you asked for, to meet legal and accounting obligations, and to answer questions about work we did for you. Database backups expire after 35 days.
Deleting your information
On a verified request we delete a participant's identifying information: name, email, phone, and any free-text answers that could identify a person. De-identified assessment responses and scores are retained for research and norm development and cannot be linked back to the individual. Job applicants can ask us to delete their application and attachments. Write to [email protected]; we answer within 30 days.
Contact Us
For privacy questions or to exercise your rights, contact:
Email: [email protected]
Data Protection Officer: Available upon request