Privacy Policy

Admin data is used to operate your account, send transactional emails (password resets, account notifications), and improve the Service. Survey response data is used solely to generate analytics and AI-powered insights for your organisation. We never sell any data.

Respondent anonymity is a core design principle, not an afterthought. Access keys are one-time-use and are hashed before storage. No IP addresses, device fingerprints, or timing patterns are recorded against individual responses. Aggregate results are only surfaced when sufficient responses exist to prevent inference.

We do not sell, trade, or rent user data to third parties. We use the following sub-processors to operate the Service:

• Supabase: Database and authentication hosting (EU/US)
• Vercel: Application hosting (US/EU edge network)
• Anthropic: AI-powered insights generation (survey data is sent to generate reports; not used to train models)

Survey response data is retained for as long as your account is active. Admin account data is retained for 30 days after account closure before permanent deletion. You may request early deletion by contacting us.

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data. To exercise these rights, contact us at hello@candorhq.io. Note that survey responses cannot be attributed to individuals by design, so individual response deletion is not technically possible.

We use strictly necessary session cookies to maintain your login state. We do not use advertising, analytics, or tracking cookies.

Data is encrypted in transit (TLS 1.2+) and at rest. Access to production systems is restricted to authorised personnel. We conduct regular security reviews.

We will notify account holders of material changes to this policy by email at least 14 days before changes take effect.

For privacy enquiries: hello@candorhq.io