We sell measurement of people. That makes how we handle their data a product question, not just a legal one. This notice is written to be read, not to be survived.
Testamur is operated by Collaborative Braintrust Consulting Firm, Inc., a California S Corp with its registered address in San Francisco, California, USA. For questions about this notice or about personal data we hold, contact privacy@testamur.ai.
This distinction determines who you go to about your data, so we state it plainly rather than burying it.
| Situation | Our role |
|---|---|
| You use this website, the scoping tool, or contact us | Controller. We decide what is collected and why. This notice governs it. |
| Your employer engaged us and you completed an assessment | Processor. Your employer is the controller. We act on their documented instructions under a data processing agreement. Their privacy notice governs, and rights requests generally go to them first, though you may contact us and we will route it. |
If you completed an assessment and are not sure which applies to you, email us and we will tell you.
Your answers to the eight questions, the email address you enter to open your determination, and the reference number and timestamp of that determination. The questions are about your organization, not about you personally. We do not ask for your name or job title.
When your employer engages us, we process the email address used to invite you, the role band you are assigned to, your item responses, any free text you write, and the time taken. We process this as a processor on your employer's instructions.
What your employer does not receive: your individual responses. Results are reported to them only in aggregate, and never for any group smaller than five respondents. Where suppressing one group would let it be inferred by subtraction, we suppress the adjacent group as well. Free text is returned thematically, and a verbatim is released only where it cannot identify its author. We will not release an individual's responses to an employer on request, including from a senior sponsor.
You receive your own results directly.
Standard server logs, and privacy-preserving analytics that record page views without cookies and without building a profile of you across sites. If you email us, we keep the correspondence.
| What we do | Basis |
|---|---|
| Send you the determination you asked for | Performance of a contract, or steps taken at your request before entering one |
| Deliver an assessment your employer engaged us for | Our client's legal obligation and legitimate interests, as set out in their notice. We act on instruction |
| Contact you about your determination or a related enquiry | Legitimate interests in responding to a business enquiry you initiated |
| Send you occasional email about AI literacy and this area of regulation | Consent, which you give by opting in and can withdraw in one click in any message |
| Include your responses in an anonymized benchmark | Legitimate interests. Benchmark data is aggregated and stripped of identifiers, and no organization or individual is identifiable in it |
| Keep the site secure and working | Legitimate interests in operating a functioning service |
We do not sell personal data. We do not share it with advertisers. We do not use it to train machine learning models, our own or anyone else's.
| Data | Kept for |
|---|---|
| Scoping tool responses and email | 24 months from submission, unless you ask us to delete it sooner |
| Assessment responses | For the term of our client's engagement plus 12 months, or as their data processing agreement specifies. Deleted or returned on their instruction |
| Anonymized benchmark records | Indefinitely. These carry no identifiers and cannot be linked back to an individual or organization |
| Marketing contact details | Until you unsubscribe, or after 24 months of no engagement |
| Correspondence | 36 months |
We are established in the United States, so personal data of people in the European Economic Area or the United Kingdom is transferred there. Where that happens we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where the UK regime applies, together with supplementary technical measures including encryption in transit and at rest.
A copy of the relevant clauses is available on request. Where a client requires EU-resident data storage, we can accommodate that as part of the engagement.
Depending on where you live, you may have the right to:
If you are in California, you additionally have rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal data as those terms are defined there, and we do not offer financial incentives for data.
To exercise any of this, email privacy@testamur.ai. We respond within 30 days. We do not charge, and we will not ask you why.
If your data was collected through an assessment your employer commissioned, we will normally need to route your request to them as the controller, and we will tell you when we do that.
This site sets no advertising or tracking cookies, and there is no consent banner because there is nothing to consent to. Analytics are cookieless and aggregate. The scoping tool holds your answers in your browser's memory while you are using it, and that is discarded when you close the tab.
If we ever introduce anything requiring consent, we will ask first rather than assume.
Email privacy@testamur.ai for anything in this notice. For general enquiries, hello@testamur.ai.
We version this notice and keep prior versions available, so you can see what applied when your data was collected. If we make a change that materially affects how we use data we already hold, we will contact affected people directly rather than quietly updating the page.
If something here is unclear, or you want to know what we hold about you, just ask. We would rather answer than have you guess.