Privacy Policy

1. Who We Are

Goldilocks Standard, Inc. ("Goldilocks HR," "we," "us," or "our") operates the website goldilockshr.com and provides employee survey services. This Privacy Policy explains how we collect, use, and protect information when you use our website and services.

If you have questions about this policy, contact us at privacy@goldilockshr.com.

2. Information We Collect

From Admins (the business owner or HR lead who purchases a survey):

• Name, email address, and company name provided at account creation
• Company size, industry, and stage (used to provide benchmark context in reports)
• Payment information — processed by our payment provider; we do not store full card numbers
• Survey configuration details (close date, employee count)

From Survey Respondents (your employees):

• Survey responses submitted via the survey link
• For the Standard Survey: no account, name, email, or identifying information is required or collected from respondents
• For the Exit Interview: respondents may optionally provide their name
• IP addresses are not stored in connection with survey responses

From Website Visitors:

• Analytics data collected via Google Analytics — including pages visited, time on site, referral source, and general geographic region (country/state level). This data is aggregated and not linked to individual identities.
• Standard server log data (browser type, device type, IP address) retained for a limited period for security purposes

3. How We Use Your Information

We use the information we collect to:

• Create and manage your admin account
• Process payment and deliver your survey run
• Generate and deliver your PDF report
• Send transactional emails related to your account and survey (confirmation, report delivery, data purge notification)
• Provide anonymized, aggregated benchmark data across our customer base (no individual company or respondent is identifiable in benchmarks)
• Improve our website and services through aggregated analytics
• Respond to support requests

We do not use your information for advertising. We do not sell your information to third parties. We do not share your information with third parties except as described in Section 5.

4. The 30-Day Data Purge

Survey response data — including all individual employee responses — is permanently and irreversibly deleted from our systems 30 days after your survey closes. This is not a policy we reserve the right to change — it is a core architectural commitment of our service.

Your PDF report is delivered to you before purge and is your permanent record. We do not retain a copy of your report after delivery.

Admin account data (your name, email, company information, and transaction history) is retained for as long as your account is active, and for a reasonable period thereafter for tax, legal, and accounting purposes.

5. Third Parties We Work With

We share limited data with the following categories of service providers, solely as necessary to operate the service:

• Payment processing: We use a third-party payment processor (Stripe) to handle transactions. Your payment data is subject to their privacy policy.
• Email delivery: Transactional emails are sent via Resend. Email addresses are shared with this provider solely to deliver emails on our behalf.
• Hosting and infrastructure: Our application is hosted on Vercel and Supabase. Data is stored in the United States.
• Analytics: We use Google Analytics to collect aggregated, anonymized website usage data. We have configured this service to anonymize IP addresses and not share data for advertising purposes.

We do not sell, rent, or trade your personal information to any third party.

6. Data Security

We implement industry-standard security practices including encrypted data transmission (HTTPS), encrypted data storage, and access controls limiting who within our organization can access personal data. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security, but we take reasonable precautions to protect your information.

7. California Residents (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect about you
• Request deletion of your personal information
• Opt out of the sale of your personal information (we do not sell personal information)
• Not be discriminated against for exercising these rights

To exercise these rights, contact us at privacy@goldilockshr.com. We will respond within 45 days.

8. Children's Privacy

Our services are intended for use by businesses and are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify active account holders by email and update the Effective Date above. Your continued use of the service after changes are posted constitutes acceptance of the updated policy.