Terms of use
Last updated: 28 September 2026
The service
This platform lets organisations run management diagnostics with their own people and see combined results. It is provided by Expertivity Technologies LLC, 3 Newtown Terrace, Norwalk, CT 06851, USA.
Accounts
Sign-in uses links sent to your email address. Keep access to your mailbox secure, because anyone who can read it can sign in as you.
Organisation administrators
The person who registers an organisation becomes its administrator, and may appoint others. Administrators agree to:
- register only an organisation they are authorised to act for;
- invite only people who work for or with the organisation;
- tell the people they invite why the diagnostic is being run and how the results will be used.
Your data
How personal data is handled is set out in the privacy notice. Where we process data for an organisation, the data processing agreement in these terms applies.
Acceptable use
Don't try to identify how an individual answered, get around the minimum group size, access another organisation's data, or disrupt the service.
Intellectual property
The diagnostics, questions, scoring methods and reports belong to Expertivity Technologies LLC. Your organisation may use its own results for its own purposes.
Availability and liability
We aim to keep the service available but don't guarantee it will be uninterrupted. Our total liability to your organisation is limited to the fees it paid for the platform in the 12 months before the claim arose, except where the law does not allow liability to be limited.
Ending use
An administrator can delete the organisation and all its data at any time from the organisation page. We may suspend an account that breaks these terms.
Changes and law
We'll post changes on this page with the date. These terms are governed by the laws of the State of Connecticut, and the courts of Connecticut have jurisdiction.
Data processing agreement
This agreement is between Expertivity Technologies LLC (the Processor) and the organisation that registers on the platform (the Client). It forms part of the platform's terms of use and applies when the Client's administrator registers or opens a diagnostic.
1. Subject matter and duration
1.1 The Processor provides the diagnostics platform and processes personal data for the Client only to run the diagnostics the Client opens and to report the results to the Client.
1.2 This agreement lasts while the Client uses the platform and until its data is deleted or returned under clause 9.
2. Nature and purpose of processing
| Item | Detail |
|---|---|
| People whose data is processed | The Client's directors, managers and staff whom the Client invites |
| Types of data | Name, work email, unit, management level, function, diagnostic answers, sign-up and submission dates |
| Special category data | None requested |
| Purpose | Running diagnostics, producing individual and combined results, comparing measurement rounds |
| Processing operations | Collecting, storing, calculating scores, reporting, emailing sign-in links and invitations, deleting |
3. The Client's instructions
3.1 The Processor processes the Client's personal data only on the Client's documented instructions. Using the platform's features, such as inviting people, opening rounds and viewing results, counts as an instruction.
3.2 The Processor will tell the Client if it believes an instruction breaks data protection law.
4. Confidentiality
Anyone the Processor allows to access the Client's personal data is bound by confidentiality.
5. Security
The Processor applies the measures in the Annex and keeps them appropriate to the risk. In particular, the platform shows individual answers only to the person who gave them, and shows combined results only for groups of at least 3 people.
6. Sub-processors
6.1 The Client authorises the sub-processors listed in the Annex.
6.2 The Processor will give the Client 30 days' notice of any new sub-processor. The Client may object on reasonable data protection grounds.
6.3 The Processor will bind each sub-processor to data protection terms at least as protective as this agreement.
7. International transfers
The Client's data is stored in the United States. Where the Client or its staff are in the EEA or UK, transfers are made under the EU standard contractual clauses and the UK addendum, including those in Hostinger's data processing agreement.
8. Assistance and breaches
8.1 The Processor will help the Client respond to requests from individuals exercising their rights, and with any data protection impact assessment the Client carries out.
8.2 The Processor will tell the Client without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting the Client's data. It will give the information the Client needs to meet its own notification duties.
9. Deletion and return
When the Client stops using the platform or asks for deletion, the Processor will, at the Client's choice, return the Client's results in a usable format and then delete the Client's personal data within 30 days. Backups are overwritten on their normal cycle.
10. Anonymised benchmarks
The Client agrees that the Processor may use the Client's results to create anonymised benchmarks across organisations. Benchmarks will not identify any person or the Client, and will not include any group of fewer than 3 organisations. Once data has been anonymised, it is no longer personal data and this agreement does not apply to it.
11. Audits
The Processor will make available the information needed to show it complies with this agreement, and will allow reasonable audits on 30 days' notice, at the Client's cost, no more than once a year unless a breach has occurred.
12. Liability, law and precedence
Each party's total liability under this agreement is limited to the fees the Client paid for the platform in the 12 months before the claim arose, except where the law does not allow liability to be limited. This agreement is governed by the laws of the State of Connecticut, and the courts of Connecticut have jurisdiction, except where standard contractual clauses under clause 7 require otherwise. If it conflicts with the platform's other terms, this agreement prevails on data protection matters.
Annex: security measures and sub-processors
| Area | Measure |
|---|---|
| Connection | All traffic is encrypted over HTTPS |
| Sign-in | No passwords. Sign-in uses single-use email links that expire after 30 minutes; only a scrambled (hashed) copy of each link is stored |
| Sessions | A signed cookie that scripts cannot read, sent only over HTTPS, lasting up to 30 days |
| Invitations | An invitation link cannot be used to sign in to an existing account |
| Database | Accepts connections only from the application on the same server |
| Credentials | Database and email passwords are held in the hosting settings, not in the application code |
| Reporting | Individual answers are visible only to the person who gave them. Combined results need at least 3 people per group, and small groups are merged so hidden answers cannot be worked out from the totals |
| Backups | Daily backups by the hosting provider |
| Search engines | All pages tell search engines not to index them |
| Sub-processor | Service | Location |
|---|---|---|
| Hostinger International Ltd | Web hosting, database, backups and email delivery | Data stored in the United States (Boston area); company based in Lithuania |