Privacy policy

1. Introduction

1.1 Scope

This Privacy Notice applies to all the products, services, websites and apps offered by IAYU Group Ltd, a company registered in the United Kingdom (company number 16938936), and its affiliates (collectively “IAYU”), except where otherwise noted. We refer to those IAYU products, services, websites, and apps collectively as the “services” in this Privacy Notice. Unless otherwise noted in your contract, our services are provided by IAYU Group Ltd.

This Privacy Notice does not apply to personal information we collect from our employees or job applicants in their capacity as employees or candidates.

1.2 Quick Links

If you want to identify your data controller please see the “Who is my data controller?” section below.

2. Personal Data we collect and the sources

2.1 What do we mean by 'Personal Data'?

References in this Privacy Notice to data, personal information, or information, are all references to Personal Data. Personal Data means information relating to a living individual (a "Data Subject") who is, or can be, reasonably identified from the information, either alone or in conjunction with other information.

2.2 Who do we collect data about?

We group persons or businesses into the following categories:

Creator: the business or person that holds an account within an IAYU service that either directly creates surveys, forms, applications, or questionnaires or that can collaborate, comment, or review surveys, forms, applications, or questionnaires within an account.

Respondent: the individual that receives a survey, form, application, or questionnaire powered by an IAYU service.

2.3 Types of Personal Data We Collect

(a) Contact information.

You might provide us with your contact information (for example: name or email address), whether through use of our services, a form on our website, an interaction with our sales or customer support team, or a response to one of IAYU’s own surveys or forms.

(b) Cookie information.

We use first-party cookies and similar browser storage on our websites and in our services, and PostHog (our analytics provider) to measure how they are used. This data includes usage and user statistics. We do not use third-party advertising cookies or marketing pixels. Section 13 lists what we store and when. Emails sent by IAYU or by users through our services include open and click tracking, which tells the sender whether an email was opened and which links in it were clicked.

We collect information submitted through our Customer Support portal, such as name, email, and message text. We also record the content of Customer Support, Customer Success, and Sales calls.

(d) Usage information.

We collect usage information about you whenever you interact with our websites and services. This includes which webpages you visit, what you click on, when you perform those actions, what language preference you have, what you buy and so on.

(e) Device and browser data.

We collect information from the device and application you use to access our services. Device data mainly means your IP address, operating system version, device type, device ID/MAC address, system and performance information, browser type, and other device, network and browser signals. If you are on a mobile device we also collect the UUID for that device. We also infer your geographic location based on your IP address.

(f) Event data.

Like most websites today, our web servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including originating IP addresses, internet service providers, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system versions, device type and timestamps.

(g) Referral information.

If you arrive at an IAYU website from an external source (such as a link on another website or in an email) or have been invited to review a survey as a guest, we record information about the source that referred you to us.

(h) Integration data.

We collect information from third parties with whom IAYU enables integrations in order to allow you to use both services.

(i) Account information.

Registration information.

You need an IAYU account before you can use IAYU services. When you register for an account, we collect your first and last name, username, password and email address.

Billing information.

If you make a payment to IAYU, we require you to provide your billing details, a name, address, email address and details of your selected method of payment. Card and bank details are collected and held by our payment processor, Stripe; we do not see or store them. If you provide a billing address, we will regard that as the location of the account holder to determine the IAYU entity with whom you contract and the sales tax, if applicable, to be applied to your purchase.

Account settings.

You can set various preferences and personal details on pages like your account settings page (or on your account settings page for our other products as applicable). These may include, for example, your default language, time zone and communication preferences (e.g., opting in or out of receiving marketing communications from IAYU).

(j) Address book information.

We may allow you to import email addresses and other contact information into an Address Book so you can easily invite people to take your surveys or fill in your form via our collectors. We do not use this data for our own purposes or to contact anyone, except at your direction.

(k) Survey/form/application data.

We store your survey/form/application data (questions and responses) for you and provide analysis tools for you to use with respect to this data.

(l) First party profile information.

When you sign up for our services you are asked to provide us with information about yourself and to give us more detailed insights into who you are.

(m) Third-party profile information.

We may combine information about you from third-party sources (such as LinkedIn, ZoomInfo, and other data brokers) with information we hold about you to create a user profile.

3. How we use the Personal Data we collect

3.1 Creator

We process Personal Data about you as a Creator where:

You have consented;
We need to fulfill our contractual responsibility;
We have a legitimate interest; and
We have a legal obligation.

3.1.1 Consent

We rely on your consent to process the following data elements:

(a) Cookies and similar technology.

Where the law requires consent, we rely on it for analytics cookies and similar storage (PostHog) and for the optional "Preferences" storage. Elsewhere these are on by default and you can turn them off. Section 13 explains which places are which and lists what is stored. You can withdraw your consent, or turn these off, at any time using the "Manage cookies" link in the footer of our pages.

We do not use advertising cookies, we do not work with advertising or data platforms, and we do not try to match your identity across different services or devices.

(b) Contact information.

We use contact information to respond to your inquiries, send you information as part of the services, and send you marketing information. In jurisdictions where opt-in is required, we will only send you marketing materials based on your consent.

3.1.2 Contract

We collect and use the following data elements on the basis that we have to use this information in order to fulfill our contract with you:

(a) Account information.

We need to use your account information to run your account, provide you with services, bill you for our services, resolve disputes such as chargebacks and refund requests, provide you with customer support, and contact you or your organization about your service or account. These communications are of a transactional nature (e.g., service-related announcements, billing-related matters, changes to our services or policies, a welcome email when you first register). You cannot opt out of these communications since they are required to provide our services to you.

We may also use billing information in aggregate to adjust or manage pricing at the individual level or across all service users.

(b) Customer support information.

We will use information submitted through our Customer Support emails, chats, or phone calls, such as name, email, and message content, in order to provide you with customer support.

We use data about how you use our services and how our services are performing to ensure that we’re meeting our service-level agreements (SLAs) or other contractual obligations to you.

(d) Device and browser data.

We use device data both to troubleshoot problems with our service and to make improvements to it. We will also use this data to facilitate account verification and sign in and to enforce our password sharing and security policies. We collect this to help us improve your service experience through a specific device/browser by optimizing how the website looks in a particular browser, how your screen brightness affects your experience and to ensure the service operates optimally and as it should on different devices and browsers.

(e) Integration data.

We collect and use information from third parties and integration partners, where applicable to one of our services, to:

Ensure you can sign-up to our service from a third-party integration like SSO;
Ensure you can use our service in conjunction with other services.

(f) Survey questions and survey responses.

We use machine learning techniques on survey data in order to provide users with useful statistics and more relevant insights from the data they have collected using our services. For example, if you have used open text questions in a survey, our machine learning may provide you with useful insights into sentiment and/or the trends in responses to that question in your workspace's analytics.

(g) Aggregated or de-identified survey questions and responses.

We use aggregated or de-identified information to provide users with useful benchmarking statistics and more relevant insights from the data they have collected using our services.

We also use this data to enforce our agreements, where applicable.

3.1.3 Legitimate interests

We process your personal information in the following categories of data for legitimate interests pursued by us. We have undertaken to ensure that we place clear limitations on each of these uses so that your privacy is respected and only the information necessary to achieve these legitimate aims is used.

(a) Contact information.

Where consent is not required, we use contact information to send you marketing information based on our legitimate interests for as long as you do not opt out. You can opt out of marketing communications at any time by clicking on the “unsubscribe” link in emails or changing the relevant setting on your My Account page.

(b) Customer support information.

We may use information provided to our Customer Support, Customer Success, and Sales teams such as name, email, and message content to train machine learning models to better predict customer support question type, provide answers, generate insights about customer support trends, and to improve our Customer Support for you. This data is de-identified where possible.

We use information about how you use our services to improve our services for you and all users and to make recommendations to you and your organization about our other services.

For example: We collect information about the types of surveys/forms/applications you create (e.g., HR surveys), the types of plans you purchase and your account transactional behavior to build a profile about you so as to help direct you and your organization to other relevant features and services we offer and to optimize user experience, for example by making recommendations to you or your organization.

We may also use usage information such as levels and nature of activity in your account and number of responses you are receiving to personalize the features and services we highlight for you and your organization in our Sites, improve user experience and to make recommendations to you and your organization about our services through our sales and marketing efforts.

(d) Event data.

We use events contained in log data for many different business purposes, including:

To create new services, features, content or make recommendations.
To track behavior at the aggregate/de-identified level to identify and understand trends in the various interactions with our services.
To fix bugs and troubleshoot product functionality.
To investigate security issues.

For example: Your IP address is used to determine where an unknown/unauthorized access may have occurred in your account (abuse monitoring).

(e) First party information.

We process other aspects of your account information (like the personal information you provide about your job, your job title, and your marketing preferences) as well as information obtained from public sources, to provide you with a personalized experience and relevant and useful marketing information as well as to make other product, feature and service recommendations to you and your organization to optimize the use of the services we offer (where permitted by law).

You can object to us using your information as described above but in some cases, our ability to fully and properly provide our services to you may be impacted if you do not want us to collect or use the above data.

(f) Third-party information.

We combine information about you from third-party sources (such as LinkedIn and ZoomInfo) with information we hold about you to create a user profile, which will help us to make our sales and marketing efforts more relevant to you and to personalize and improve your service experience.

(g) Referral information.

We use referral information to track the success of our integrations and referral processes.

(h) End page data.

If you use our survey tool, depending on the package you are on and the settings you have selected, your Respondents may reach the standard survey end page on completion of a survey. The end page is part of the IAYU website.

(i) De-identified Device Data.

We use aggregated or de-identified Device Data to extract usage patterns and to improve our services.

(j) De-identified Survey Data.

We use machine learning techniques on aggregated or de-identified survey questions and responses to understand usage and improve our services.

3.1.4 Legal obligation.

(a) To respond to legal requests, we may need to use and disclose information we hold about you. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.

(b) We may also use usage data, event data, and aggregated or (where possible) de-identified survey questions and responses:

To enforce our agreements where applicable;
To investigate security issues;
To prevent or address potentially unlawful activities; and
To screen for and prevent undesirable or abusive activity. For example, we have automated systems that screen content for phishing activities, spam, and fraud under our Acceptable Use Policy.

3.2 Respondent

We process Personal Data about you as a Respondent where:

We need to fulfill our contractual responsibility to deliver the services to the Creator of the survey;
We have a legitimate interest; and
We have a legal obligation.

3.2.1 Contract

(a) Contact information.

We only use contact information to respond to an inquiry on behalf of a Customer if you, as a Respondent, contact us.

(b) Cookies.

Survey pages do not set cookies of their own to run a survey - your progress is carried in the survey link. The cookie choices and analytics described in section 13 apply on survey pages as they do on the rest of the site. Section 13.8 covers survey pages specifically.

We use device data both to troubleshoot problems with our service and to make improvements to it.

We use your device and browser data to provide our services to the Creator. For example, your IP address is used to protect survey pages from abuse.

(d) Inferred geographic location.

We also may infer your geographic location based on your IP address. This allows Creators to filter responses by inferred geographic location. Note: we do not collect precise (GPS) location.

(e) Event data.

We use event data for many different business purposes including the following:

To create and improve services, features, content or make recommendations;
To track behavior at the aggregate/de-identified level to identify and understand trends in the various interactions with our services; and
To fix bugs and troubleshoot product functionality.

(f) Third parties and integration data.

We will collect and use information from third parties and integration partners to facilitate Creators in sending surveys/forms/applications/questionnaires to you.

(g) Survey response data.

IAYU may use first party machine learning or third-party artificial intelligence tools on data around the type of survey the Creator has sent you, the question type, survey responses (at an aggregated and de-identified/pseudonymized level only where possible), and device and event data associated with responses to fulfill our contract with Creators and provide Creators with useful and relevant insights from the data they have collected using our services. Specifically, we use machine learning on survey data to help Creators by:

identifying trends in their responses;
ongoing training of models to optimize responses;
extracting and analyzing usage patterns, for example, we might use this data to help improve analysis of responses;
undertaking personalization for survey Creators;
improving user experience (for example, by collecting and using device and browser information from Respondents to improve how our survey service operates on those devices and in those browsers or by altering questions to match the responses being provided by a Respondent); and
identify insightful data trends (which do not disclose Personal Data) and make recommendations to Creators based on those trends.

3.2.2 Legitimate Interests

(a) Usage information.

We use information about how you use our services to improve our services for you and all users and to make recommendations to our customers about usage of our services.

(b) Responses (in aggregated and/or de-identified form).

To build new product features.

We may infer your geographic location based on your IP address to produce aggregated data around Respondent location trends. We will use this information to compare and look at trends on how our service operates. Note: we do not collect precise (GPS) location.

(d) Email address.

We do not share Respondents' email addresses with marketing or advertising vendors, in hashed or any other form.

(e) Customer support information.

3.2.3 Legal obligation

(a) To respond to legal requests, we may need to disclose information we hold about you. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.

(b) We may also use usage data, event data, and aggregated or de-identified survey questions and responses:

To enforce our agreements where applicable;
To investigate security issues;
To prevent or address potentially unlawful activities; and
To screen for and prevent undesirable or abusive activity. For example, we have automated systems that screen content for phishing activities, spam, and fraud under our Acceptable Use Policy.

4.1 Information you share

Remember that when you share information publicly, it can be indexable by search engines. Our services provide you with different options on sharing and deleting your content but we cannot delete content from search engines so you need to be careful about information you make public.

4.2 Information we share

We do not share your information or data with third parties outside IAYU except in the following limited circumstances:

(a) If you are a Creator that is part of an IAYU team plan, your account information and data will be shared with the primary administrator(s). Your administrator(s) will be able to view your account data, change your passwords, suspend, transfer or terminate your account or restrict your settings.

(b) If you are the primary administrator of an IAYU team plan, the team name and the domain of the email address on your account may be shared with an individual who has been invited to preview a survey created by one of the members of your team in order to facilitate their request to join the team.

(c) If you are part of an IAYU team plan, your plan’s administrator(s) can transfer your survey questions and responses to, or share them with, other members in your team, including your plan’s administrator(s) themselves. Your plan’s administrator(s) can also delete your survey questions and responses.

(d) If your organization has purchased an IAYU plan and you are using an email address on a domain owned by your employer or organization your email address, name and account data will subsequently be visible to the primary administrator(s) for that account.

(e) To help us provide certain aspects of our services we use our affiliates and trusted key partners – in particular, we engage third parties to:

facilitate our collectors for sending surveys by email or text to Respondents. For email delivery, we use Amazon Simple Email Service (Amazon SES). We share the relevant contact information for respondents (their email address) with this provider.
to facilitate the delivery of certain features, for example if you use Holly AI, the questions you ask Holly and the workspace data it needs to answer them are sent to our AI vendor. We recommend that you do not include Personal Data in your questions, but if you do they will be shared with the AI vendor.
to detect fraud (to include, for example, performing identity checks or verifying malicious IPs).
help us track website conversion success metrics.
manage our sales and customer support services to you, including for resolving any disputes.

We enter into confidentiality and data processing terms with partners to ensure they comply with high levels of confidentiality and best practices in privacy and security standards and we regularly review these standards and practices.

(f) On your instructions, we share your information or data if you choose to use an integration in conjunction with IAYU services, to the extent necessary to facilitate that use.

(g) We also may have to share information or data for the following purposes:

To meet any applicable law, regulation, legal process or enforceable governmental request;
To enforce applicable policies, including investigation of potential violations;
To detect, prevent, or otherwise address fraud, security or technical issues;
To protect against harm to the rights, property or safety of our users, the public or to IAYU and/or as required or permitted by law; and
To facilitate a sale, merger or change in control of all or any part of our company or business or in preparation for any of these events.

5. Data retention

If you are a Creator, we generally do not delete the data in your account as long as your account is active – you are responsible for and control the time periods for which you retain this data. Here are some exceptions:

If your subscription ends and is not renewed, your account becomes read-only for 90 days so that you can export your data, after which your account and its data are deleted in accordance with our data retention policy (see section 11.4 of our Terms of Use).

We also encourage Creators to actively review their data retention practices in their account and take care to retain data only as long as is strictly necessary.

We describe how long the cookies on our websites last in section 13.

How long this website keeps other records:

Contact-form enquiries, from when they were sent: anonymised after 2 years (we keep when it was sent, what it was about, the kind of site the visitor came from, and whether and by which user it was dealt with - not who they were, how to reach them or what they wrote).
Emailed sign-in links, from when they expire: deleted after 1 day.
Sign-in sessions, from when they expire: deleted after 1 day.
Sign-in codes issued to connected apps, from when they expire: deleted after 1 day.
Access tokens issued to connected apps, from when they expire: deleted after 7 days.
Refresh tokens issued to connected apps, from when the last one in their chain expires: deleted after 7 days.
The internal application log, from when each line was written: deleted after 30 days.
Mailing-list sign-ups that were never confirmed, from when they were made: deleted after 14 days.
Mailing-list subscriptions that were cancelled, from when they were cancelled: anonymised after 2 years (we keep where the sign-up came from and when it was made, confirmed and cancelled - not the email address).

6. Personalized marketing and cookies

We use cookies and similar technologies on our websites. Section 13 lists them, says what each is for and how long it lasts, and section 13.8 covers survey pages. We do not use advertising cookies, we do not show you personalized advertising, and we do not share your email address, hashed or otherwise, with marketing vendors. If you are a customer of IAYU and separately use cookies or similar technologies in conjunction with any of our products and services, then you yourself will be responsible for complying with any laws related to the use of those technologies and this Privacy Notice is not applicable to that use by you.

You can withdraw consent to, or turn off, non-essential cookies at any time using the "Manage cookies" link in the footer of our pages. You can also remove or block cookies in your browser settings.

You can opt-out from direct marketing in your account and we provide opt-out options in all direct marketing emails.

7. Security

Our Security Statement describes how we protect the data we hold.

8. Safety of Minors

Our services (including creating and responding to surveys) are not intended for and may not be used by minors. “Minors” are individuals under the age of 16 (or under a higher age as provided in certain countries or territories). IAYU does not knowingly collect Personal Data from Minors or allow them to register. If it comes to our attention that we have collected Personal Data from a Minor, we may delete this information without notice. If you have reason to believe that this has occurred, please contact customer support.

9. Data Transfers

Your information and data may be processed in and transferred or disclosed in the United States and countries in which our affiliates are located and in which our service providers are located or have servers. Section 13.7 lists the service providers that receive personal data. We ensure that the recipient of your Personal Data offers an adequate level of protection, for instance by entering into the appropriate back-to-back agreements with standard contractual clauses or other transfer mechanisms as approved by the European Commission or relevant data protection authority.

10. Who is my data controller?

If you have provided survey responses, filled out a form, submitted an application, or provided website feedback to a Creator using IAYU services, that Creator is the controller of your data, and IAYU is the processor of that data.

If you are a member of a workspace that someone else owns, the workspace's owners control some basic account information you entered when you joined, such as your name and email address.

If you have provided survey responses, filled out a form, submitted an application, or provided website feedback directly to IAYU or at IAYU's request through a third party, then IAYU is the controller and our use of that data is described by this Notice.

11. Your rights

You may wish to exercise a right to obtain information about yourself or to correct, update or delete that information. Some of these rights may be subject to some exceptions or limitations in local law. Please note your rights and choices vary depending upon your location. We will take reasonable steps to verify your identity and we will respond to your request to exercise these rights within a reasonable time (and in all cases within 30 days of receiving a request) subject to the below for specific categories of person.

11.1 Creator

Where you hold an account with any IAYU service, you are entitled to a copy of all Personal Data which we hold in relation to you. You also may be entitled to request that we restrict how we use your data or object to some aspect of our treatment of your data. You can access a lot of your data in your own account when you log in. If you want to exercise your rights, please contact us here.

11.2 Respondent

Where you have responded to a survey, form, questionnaire or application sent to you by a Creator using an IAYU service, you will need to reach out directly to that individual or organization to discuss managing, deleting, accessing, restricting access to or otherwise withdrawing consent for use of the information which you provided to them in your responses. IAYU does not control your response data and, accordingly, is not in a position to directly handle these requests in relation to that data. If you are having difficulties finding this Creator or if you have any other questions after reading this Privacy Notice, you can contact us through our support team and we will try our best to help you.

11.3 Other rights and choices

If you are in the United States, you can use the contact details below to exercise any rights you have under the privacy law of the state where you live. We will take reasonable steps to verify your identity and the authenticity of your request.

11.4 Contact

Please contact us online here.

Except as explicitly provided herein, please use the following contact information for privacy inquiries:

IAYU Group Ltd (company number 16938936) 71-75 Shelton Street, Covent Garden London WC2H 9JQ United Kingdom

Or contact us online here.

Data Protection Officer: we have appointed a Data Protection Officer. IAYU Group Ltd is registered with the UK Information Commissioner's Office (ICO), registration number ZC075469. You can contact our DPO through our contact form.

Note that our contact form is the best way to make a rights request with us.

11.5 Complaints

If you are dissatisfied with how we have managed a complaint you have submitted to us, you are entitled to contact a data protection supervisory authority. As IAYU Group Ltd is registered in the United Kingdom, it operates under the remit of the UK Information Commissioner's Office (ICO). If you are a resident in the European Union, you may instead contact your local data protection supervisory authority.

12. Changes to our Privacy Notice

We can make changes to this Privacy Notice from time to time. We will identify the changes we have made on this page. In circumstances where a change will materially change the way in which we collect or use your personal information or data, we will send a notice of this change to all of our account holders.

13. Cookies and tracking

We use cookies and similar browser storage (such as localStorage) to make our services work and to learn how they are used. We group them into four categories. "Strictly necessary" is always on. The other three depend on where you are:

In the UK, the EU and EEA, Switzerland and Canada (just Quebec, if we can tell which province you are in), nothing outside "Strictly necessary" is stored on your device until you choose, and the cookie banner opens automatically. If we cannot tell where you are, we treat you as being in one of these places.
Everywhere else, the other categories are on by default, the banner does not open by itself, and you can turn them off at any time with the "Manage cookies" link.

You can change your choices at any time via the "Manage cookies" link in the footer of our pages. Your choices last for 12 months, after which we ask again. In the places listed above we also ask again when we materially change this Notice.

If your browser sends a Global Privacy Control signal (Sec-GPC: 1), we treat that as a refusal of analytics and marketing, wherever you are. You do not need to click anything.

13.1 Strictly necessary

These support things you have asked this website to do: recording your cookie choices, sending you to the right regional iAssistYU site when you sign in, and confirming that your contact form went through. The site does not work properly without them, so they cannot be turned off.

consent - your cookie choices. Lasts 12 months.
instance - set when you click "Sign in", to remember which regional iAssistYU site (for example gb.iassistyu.com) to send you to. Lasts 30 days.
flashtoast - carries the confirmation message after you send the contact form. Lasts 15 seconds.

Visitors do not sign in to this website - "Sign in" takes you to the iAssistYU app. Only members of our own team sign in here, to manage the site, and only they get sign-in cookies (auth, and the short-lived twad_oauth_state while signing in with Google).

13.2 Preferences

This website stores nothing in this category unless you switch on its developer debug view from your browser's console:

debug - shows diagnostic information on each page. Your browser deletes it when you close it.

13.3 Improvement

We use PostHog (operated by PostHog Inc., from its EU-hosted cloud) to count visits and see which pages get read. Your browser's PostHog traffic goes through our own domain and on to PostHog. We don't pass your IP address on: PostHog receives your country and region (for example, England), which we work out from the request, and nothing more precise.

Before you choose. Where consent is required and you have not yet made a choice, PostHog runs in a reduced mode. It stores nothing on your device (no cookies, localStorage or similar), records page views only (no clicks, no session recordings) and builds no visitor profile. It uses a temporary ID held in your browser's memory, which is gone when you close or reload the page. If you then allow analytics, PostHog starts with a fresh ID, so the earlier page views are not joined to it. If you reject analytics, PostHog does not run in your browser at all. We count these page views on the basis of our legitimate interest in knowing which pages are read so we can keep the site useful and working; because nothing is stored on your device and no profile is built, this doesn't need your consent. You can object at any time by rejecting analytics with the "Manage cookies" link.

With your consent, or by default outside the places listed above, PostHog:

stores a random visitor ID and session details in a cookie and in localStorage, both named ph_phc_<project key>_posthog, plus short-lived entries in sessionStorage for the current tab. PostHog's cookie lasts up to 365 days.
records clicks and other page interactions automatically, makes session recordings of your visit (what was on the page and how you moved, clicked and scrolled) and builds heatmaps. Session recordings are kept for 30 days. Other PostHog data is kept for up to 7 years.

If you later withdraw consent, we delete PostHog's cookies and storage from your browser.

Separately from your cookie choice, our server sends PostHog a record when certain things happen on this website - for example a contact-form submission, a guide download, or a mailing-list sign-up, confirmation or unsubscribe. The mailing-list records include the domain part of your email address (for example example.com), never the address itself, and none of these records include what you wrote. They store nothing on your device, so the cookie banner does not control them. We use them for the purposes described in section 3.1.3(c) and (d).

13.4 Marketing

We do not use advertising cookies, marketing pixels or advertising platforms, and we do not share data with marketing partners. Nothing on this website uses this category. It appears in the consent banner so that, if that ever changes, it is already there for you to control.

13.5 How to manage your choice

Use the "Manage cookies" link in the footer of any page. The consent banner clearly labels each category and lets you accept or reject them independently. The "Reject all" option is as prominent as "Accept all".

California residents: under CCPA/CPRA, the marketing-measurement category counts as "sharing" of personal information. To opt out, use the "Manage cookies" link and reject the Marketing toggle, or send a Global Privacy Control signal.

13.6 Record of consent

We keep an internal record of every consent decision you make - the timestamp, what you accepted, the policy version you saw and which set of regional rules applied - so we can prove to a regulator that you consented when you did, which is a requirement under GDPR Article 7(1). The record does not include your IP address, and as visitors do not sign in here, it is not linked to you.

13.7 Subprocessors

Wherever the categories above mention a third party, that party is a subprocessor receiving personal data on our behalf:

Amazon SES (email - passing contact-form enquiries to our team, and confirming mailing-list sign-ups).
PostHog (analytics - as described in 13.3: cookieless page-view counting before you choose, full measurement only with your consent where consent is required, and server-side records of the events listed there).
Google (sign-in for members of our own team only).

We will keep this list current. Adding a new subprocessor will bump the Notice's version and re-prompt for consent on your next visit where consent is required.

13.8 Survey pages

This covers the pages a Respondent uses to answer a survey sent through the iAssistYU service, and the invitation emails that lead to them.

Survey pages set no cookies of their own. Your progress through a survey is carried in the survey link.
The analytics described in 13.3 runs on survey pages on the same terms as elsewhere: where consent is required and you have not chosen, cookieless page-view counting only; if you allow analytics, or you are somewhere it is on by default, full PostHog measurement, including session recording.
Where consent is required, the cookie banner opens automatically on survey pages, and every survey page has a "Manage cookies" link in its footer.
Survey invitation emails include open and click tracking. When you open an invitation or click a link in it, that is recorded against the invitation in the account of the business that sent it.

Privacy policy

1. Introduction

2. Personal Data we collect and the sources

3. How we use the Personal Data we collect

4. How we share or disclose Personal Data

5. Data retention

6. Personalized marketing and cookies

7. Security

8. Safety of Minors

9. Data Transfers

10. Who is my data controller?

11. Your rights

12. Changes to our Privacy Notice

13. Cookies and tracking