Legal · draft
Privacy Policy
Last updated 4 October 2026. Draft for review.
1. Who we are
This policy explains how KOZMO collects and uses personal data. KOZMO is a working name. The service is currently provided at thebimethod.com as The BI Method.
The data controller for the data described in sections 3 and 4 is [legal entity name and legal form, or, if not yet incorporated, the full names and addresses of Michael Huynh and Masha Omeragic as joint controllers], registration number [registration number], of [registered address].
Contact for privacy questions: [privacy contact email]. Data protection officer: [DPO name and contact, or a statement that none is appointed].
2. Two roles: controller and processor
- Controller. For visitors to our website, people who buy the individual product, people who contact us, and account holders, we decide why and how data is used.
- Processor. When an employer uses the team product to run a scan on its people, the employer is the controller of those people's answers and we process them on its instructions. The terms are in our Data Processing Agreement. If you answered a team scan, ask your employer first about your rights.
3. What we collect and why
The free Snapshot
Your Snapshot answers stay in your browser (local storage on your device). They are not sent to our servers unless you start checkout for a paid report. You can clear them at any time by clearing your browser data.
When you start checkout
When you begin checkout, your answers are stored on our servers so we can produce your report. When payment completes, we add the email address you give at checkout. Card details are handled by our payment provider and we do not store them.
If you start checkout but do not pay, we delete your saved answers after [retention period for abandoned checkouts, to be decided and built].
Other data
| Category | Data | Purpose | Lawful basis |
|---|---|---|---|
| Purchase and billing | Name, email, billing details, payment status | Delivering the report or subscription, invoicing | Contract; legal obligation (accounting) |
| Account | Name, email, organisation, role, hashed password [confirm fields collected] | Running your account | Contract |
| Contact and support | Name, email, message | Answering you | Legitimate interests |
| Website analytics | Pages visited, device and browser data, approximate location, and, for session recordings, how you click, scroll and type on pages | Understanding and improving the site | Consent |
| Security and service logs | IP address, log data | Keeping the service secure | Legitimate interests |
| Email address, delivery and bounce status | Account and receipt emails; experiment prompts you have asked for | Contract; consent for optional prompts [confirm] |
Session recordings
If you accept analytics, Microsoft Clarity records how you use our pages, including mouse movement, clicks and scrolling. [Before launch: configure Clarity to mask answer fields, or exclude the assessment pages from Clarity. Until then, do not state that answers are masked.]
Team scans
When an employer runs a team scan, we process the respondents' email addresses and answers for the employer. The employer decides who is invited and what they are told. See the Data Processing Agreement.
Respondent answers are linked to the respondent's email address in our systems. We do not currently guarantee that results shown to an employer cannot be traced to individuals. [Update this section once the minimum reporting threshold of [number] respondents is live.]
4. Email
We send emails needed to run your account and deliver what you bought. We are building optional weekly experiment prompts. We will send them only to people who have opted in and every message will carry an unsubscribe link [confirm once built].
5. Benchmark data
[We may use aggregated statistics derived from answers to improve our methodology and provide comparisons. Wording to be agreed once the aggregation and anonymisation process is built and confirmed.]
6. Cookies and similar technologies
We use strictly necessary storage (sign-in session, remembering your cookie choice) without consent. Google Analytics 4 and Microsoft Clarity load only if you accept analytics, using consent mode v2. See the Cookie Policy.
7. Who we share data with (sub-processors)
We do not sell personal data. We use these service providers. Each is evidenced in our current systems.
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Database, authentication, server functions | Accounts, answers, respondent emails | [confirm project region] |
| Stripe | Payments | Name, email, payment details, billing | [confirm; Stripe acts as independent controller for some data] |
| Mailgun | Sending email | Email address, message content, delivery status | [confirm: US or EU region] |
| Google Analytics 4 (Google) | Website analytics, consent only | Usage and device data | [confirm; Google may process in the US] |
| Microsoft Clarity (Microsoft) | Session recordings and heatmaps, consent only | Interaction data | [confirm; likely US] |
| Netlify | Website hosting | Request and log data (IP address) | [confirm] |
We may also disclose data where the law requires it, and to a successor if the business is sold, on terms that keep your data protected.
8. International transfers
Some providers may process data outside the UK and EEA. Where they do, we rely on [adequacy decisions, the EU-US Data Privacy Framework, or standard contractual clauses, to be confirmed per provider].
9. How long we keep data
- Snapshot answers kept only in your browser: until you clear them.
- Answers saved at checkout and not paid for: [retention period to be decided].
- Purchased report and account data: [period] after account closure.
- Financial records: [statutory period; seven years under Dutch law if the entity is Dutch, confirm].
- Contact enquiries: [period].
- Analytics: [period, set in Google Analytics and Clarity].
- Team scan data: as set in the Data Processing Agreement.
10. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or stop using it, or move it to another service. You can withdraw consent at any time, for example through the cookie preferences link. We reply within one month. Email [privacy contact email].
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
You can complain to [supervisory authority: Autoriteit Persoonsgegevens (Netherlands) if the entity is Dutch; Information Commissioner's Office (UK) if UK-established; confirm] or to the authority in your country.
11. Security
We use access controls, encryption in transit and other measures suited to the risk. [List only measures that engineering has verified. The live pages claim AES-256 at rest, MFA, rate limiting, anomaly detection and staff training; none were confirmed in this review.]
12. Children
The service is for people aged 18 and over. We do not knowingly collect data from children.
13. Changes
If we change this policy in a material way we will tell you by [method] and update the date above.
14. Contact
[Legal entity name], [registered address], [privacy contact email].