How your data is handled

A plain-language summary of what this site stores and why.

What we store

Your email address, and your password stored as a one-way hash (a scrambled form that can't be turned back into your password).
Whether you've chosen to get occasional emails from dollop technology, and when you chose it.
If you arrived from one of our ads or tagged links, which one (for example, "linkedin"), so we can tell which ads work.
Your assessment answers and any notes you add, plus the dates you signed up and completed assessments.
If you use the action plan on your results, the owners, target dates, and progress you enter for each priority.
A cookie that keeps you logged in. If you arrive from one of our ads or tagged links, a second cookie remembers which one for 30 days. It holds only the ad's name, nothing about you, and isn't shared with anyone. There are no advertising networks, cross-site tracking, or third-party analytics.
Anonymous visit statistics from Umami, an analytics tool dollop technology runs on its own server: which pages are viewed, the site that linked here, and your browser, device type, language, and approximate location (country and region). Visits are grouped using a scrambled code made from your IP address and browser that changes regularly; the IP address itself isn't kept. Umami sets no cookies, doesn't follow you to other sites, and leaves out the parts of page addresses that could include a scanned domain or an assessment. It also records when a check is started or finished, a domain scan is run, or the results-review link is clicked, never your answers or results.
Anonymous counts of a few key steps, such as a quick check being started or finished, a report being downloaded, or a contact message being sent, with the ad's name if you came from one. They're stored on this site's own server and don't include your answers, your IP address, or anything else that identifies you.
If you take the quick check without an account, your answers are kept only in your browser. They're sent to this site's server only: to create your PDF when you download one; to write a results summary if you tick the box to include one with a contact message (only the summary is passed on with your message); or to save them if you create an account or log in and choose to. For the PDF and the summary, your answers are used once and not kept, and your notes are only sent if you choose to include them in a full report.
The cyber insurance readiness check works the same way: your answers are kept only in your browser, and are sent to this site's server only if you tick the box to include a summary with a contact message. They're used once to write that summary and not kept.
If you use the domain scan, the domain you enter is sent to this site's server, which looks up the domain's public DNS records and connects to its website the way a browser would. The domain and its results aren't stored, apart from an anonymous count that a scan was run. Your latest result is kept in your browser tab until you close it, so it's still there if you visit the contact page. If you include it with a contact message, the scan is run again and its summary is sent with your message.

Why

To run your account, save your progress, calculate your results, and send the emails you need: confirming your address, resetting your password, and your results.
If you tick the box to hear from dollop technology, which provides this self-assessment, we may email you occasional cybersecurity tips and news about our services. This is optional and off unless you choose it. You can turn it off anytime in account settings, or by replying to any of those emails. These emails never include your answers or results.

Who can see it

Your answers are only shown to you when you're logged in.
dollop technology runs this site. Its staff can access the server and database that store your data, as with any hosted service, and are emailed your address, and whether you opted in to emails, when a new account is created. Those notification emails stay in dollop technology's inbox, separately from this site.
Emails are delivered by Resend, an email provider, which handles your email address and the content of those emails.
The domain scan asks public DNS services (Cloudflare, Google, and Quad9) about the domain you enter, and the website you scan will see a visit from this site's server. Nothing about you is sent to either.
If you use the contact form, your message and the details you enter are sent through Formspree, a form-delivery service, to dollop technology so we can reply. Your assessment answers aren't included unless you tick the box to include a summary of your results: your overall result, area scores, and top next steps, never your notes.
Your data is never sold, and isn't shared with anyone beyond the providers named above.

How it's protected

All traffic to this site is encrypted (HTTPS). Passwords are hashed, never stored as plain text.
Your answers describe your organization's security, so don't put passwords or other secrets in the notes fields.
Result emails contain a link rather than your report, unless you choose to have the PDF attached.

Keeping and deleting it

Your data is kept until you delete it. You can delete any assessment from your dashboard, or your whole account from account settings. Either removes it from the database right away.
The database is backed up nightly on the same server, and each backup is kept for 14 days, so anything you delete is gone from the backups within 14 days. Backups are only used to recover from a fault.
Server logs record events like account creation using an internal account ID, not your email address. They're capped in size, so the oldest entries are deleted automatically as new ones are written, and they're cleared whenever the site is updated.

Manage your data in account settings.