Privacy Policy

The short version

We collect the minimum needed to run the product: your assessment answers, your email if you ask for a report or buy something, and cookieless usage analytics. We don't run ad trackers, we don't sell data, and your individual answers are never shared with insurers or anyone else.

What we collect

• Readiness Check answers. Stored with a random session identifier (not your name). If you request the emailed report, your email is attached to that assessment so we can send it.
• Email addresses you submit for reports, waitlists, or purchases — with a record of what you signed up for (consent basis).
• Purchase records from our payment partner (email, product, amount). Card details never touch our servers — the payment partner processes them as merchant of record.
• First-party usage events (page entered, check started/completed, button clicks) tied to a random identifier stored in your browser — no cross-site tracking, no advertising cookies. Site traffic is additionally measured with Plausible, a cookieless analytics tool.

Aggregate statistics

We publish research from Readiness Check data — e.g., “X% of assessed businesses lack a tested incident response plan.” These statistics are always anonymized and aggregated (minimum sample sizes, no company-identifying details). Individual assessments never leave our systems.

Email

Transactional email (reports, receipts, downloads) is sent to complete what you asked for. Marketing email is only sent with your consent and every message has one-click unsubscribe.

Retention and deletion

We keep records as long as they're needed for the purposes above, and purchase records as required for tax and accounting. Want your data deleted? Email support@surable.ai from the address in question. Here is exactly what happens, because a vague promise is worth less than a specific one:

• Your lead record, any message you sent us through the contact form, and any follow-up email we had queued for you are deleted.
• Your email address is removed from the readiness assessments you ran. The answers stay, with nothing linking them to you, because the aggregate statistics we publish are computed from them and we can't retroactively change a number we've already cited.
• Your address is stripped out of the stored payment-provider records we keep for debugging.
• If you bought something, the purchase record itself stays. Tax and accounting rules require it, and we'll say so when we confirm.

We re-check every table afterwards and will tell you what was removed. If you only want the emails to stop, the unsubscribe link in any message does that in one click without losing your report.

Processors we use

Hosting and database infrastructure; a merchant-of-record payment provider; a transactional email provider; cookieless web analytics (Plausible); and, for optional report narratives, an AI provider (Anthropic) that receives assessment scores and gap summaries — never your email or company name. Each processes data only to provide their service to us.

Your rights

Depending on where you live (including under state privacy laws such as the Texas Data Privacy and Security Act), you may have rights to access, correct, or delete your data. Email us and we'll honor them.

Contact

Privacy questions: support@surable.ai.