Privacy Policy

BolderBrain operates bolderbrain.com and the BolderBrain assessment platform. In this policy, "BolderBrain", "we", "us" and "our" refer to BolderBrain.

For personal data that we collect through our website, sales enquiries and our own account administration, we act as the data controller. For assessment, feedback, training and development data that a customer organisation uploads or creates in its workspace, the customer organisation is the controller and we act as its processor. Our Data Processing Agreement governs that processing.

You can contact us about privacy at [email protected].

We collect the following categories of personal data:

• Account and organisation data, including name, work email, password hash, organisation, role, department, manager relationships, email verification status and multi-factor authentication status.
• Assessment and development data, including responses to 360, cognitive, emotional intelligence, psychometric, training and performance review assessments, scores, reports, development goals, training needs, manager notes and talent grid placements.
• Candidate and employee data supplied by customer organisations.
• Payment and billing data, including plan, order identifier, payment identifier, amount, currency and billing email. Card and payment instrument details are handled by our payment partner and are not stored by us.
• Demo and contact data, including name, work email, company, team size and message.
• Communications and support data, including emails, support requests, and WhatsApp number and opt-in status where that feature is enabled.
• Technical data, including IP address, request logs, device and browser information, cookies, error reports, and analytics events where you have consented.
• AI-generated content, including prompts and outputs used to generate assessment narratives and insights.

We use personal data to:

• provide, operate and secure the platform;
• create and administer accounts and workspaces;
• run assessments, score responses and generate reports;
• provide support and respond to demo requests;
• process payments and provision workspaces;
• send service messages such as verification, password reset, reminders and notifications;
• monitor, debug and improve the service;
• comply with legal obligations and enforce our terms;
• generate AI narratives and insights where the feature is enabled;
• measure public site usage with Google Analytics only where you have consented.

Where the GDPR or a similar law applies, we rely on the following legal bases:

• Contract: to provide the service that you or your organisation have requested.
• Legitimate interests: to secure, support and improve the service, and to respond to business enquiries.
• Consent: for analytics cookies, WhatsApp notifications and any optional feature that asks for consent.
• Legal obligation: to meet tax, accounting, security and other legal requirements.

For assessment data, the customer organisation is responsible for choosing the legal basis and for giving notices to its employees and candidates. We process that data on the organisation's instructions.

We may share personal data with:

• customer organisations and their authorised administrators;
• service providers that help us run the service, including hosting and database providers, email delivery, payment processing, AI model providers, error monitoring, analytics, messaging and integration providers;
• professional advisers, auditors, insurers and authorities where required by law;
• a buyer or successor in a business transfer.

We do not sell personal data. We require service providers to protect personal data and to process it only for the purposes we specify. Some providers may process data outside your country. Where required, we rely on appropriate transfer safeguards.

Some features use a third-party AI model provider to generate narratives and insights. AI narratives are opt-in for each customer organisation. An organisation administrator can turn them off in the workspace settings. When they are off, we generate narratives on our own systems and do not send assessment data to the AI provider.

Where these features are enabled, we send the assessment scores, trait names and the minimum context needed to produce the requested text. Before sending a prompt, we remove direct identifiers such as names, email addresses and phone numbers. For the AI coach, we send the signed-in user's name and organisation details because the user has asked for a personal response. We do not send email addresses to the AI provider unless they appear in free-text content that a user has entered, and we remove them before sending.

Our AI model provider is listed as a sub-processor in our Data Processing Agreement. We require the provider to process the data only to return the requested output and under the terms of that agreement.

AI-generated content may be inaccurate or incomplete. It is a decision-support aid and should be reviewed before it is relied on.

We keep personal data for as long as needed to provide the service, comply with legal obligations, resolve disputes and enforce agreements.

Customer organisations control the data in their workspace. When a workspace is deleted, we delete or anonymise its data within a reasonable period, except where we must keep it for legal reasons or in backups. Backups are kept for a limited period and then deleted.

Demo request details are kept for as long as needed to respond and for a reasonable period afterwards. We may keep aggregated or de-identified data that cannot reasonably identify you.

We use technical and organisational measures to protect personal data, including TLS in transit, access controls, tenant isolation, password hashing, optional multi-factor authentication and audit logging.

No method of transmission or storage is completely secure. If we become aware of a security incident affecting personal data, we will investigate and notify affected parties and regulators where required by law. You can contact our security team at [email protected].

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive a portable copy, to withdraw consent, and to complain to a supervisory authority.

To exercise a right, contact us at [email protected]. We may need to verify your identity before we act on a request.

If your data was provided by an employer or another organisation, contact that organisation first. We will assist it in responding to your request. We will respond within the time required by applicable law.

You can withdraw analytics consent at any time by clearing the bb_analytics_consent cookie for this site and reloading the page.

We use essential cookies to keep you signed in and to remember your choices. We use analytics cookies only if you consent. See our Cookie Policy for details.

The service is intended for workplace use and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us and we will take appropriate steps.

We may update this policy from time to time. We will post the new version on this page and update the date. If changes are material, we will take reasonable steps to notify you.

For privacy questions or requests, email [email protected]. For legal notices, email [email protected].