Privacy
One thing on this site collects anything. This page says what it keeps.
The AI Readiness Diagnostic in the hero asks about seven questions, places the answers on six dimensions, and stores the result. Every other page here reads back to you and sends nothing anywhere.
What follows is the whole of it. Every field in a stored record, every company that touches one, how long it lives, and the address that ends it. It is written against the code rather than from a template, which means you can check it.
Last updated 9 September 2026
What is kept
One record per finished conversation.
A record is written when an interview reaches its read-out. It is written whether or not you leave an address, because the transcripts are the only route we have to a benchmark of our own: the report currently cites published research for where you sit against the industry, and it will keep citing other people's figures until there are enough of these to replace them.
An interview you close halfway is never stored at all. Nothing is written until the read-out is. Here is every field in one record, under the name the code gives it.
- sessionId
- A random identifier minted when the read-out is written. It is not derived from you, your address or anything about your browser, and it is the handle the email box posts back with so that leaving an address does not mean sending the conversation a second time.
- completedAt
- The moment the read-out was written, to the second.
- transcript
- Both sides of the conversation in full: the questions the interviewer asked and the answers you typed. Whatever you put in the box is what is kept, so it is worth treating the box the way you would treat a first email to a firm you have not met yet.
- scorecard
- The six dimensions with a level on each, a one-line reason for that level, and a short verbatim quote from your own answers as the evidence behind it. Also the read-back, the paragraph naming the biggest gap, and the three suggested actions.
- composite, band
- A composite score and the band it falls into. The composite is never rendered and never sent to your browser; it exists so that a morning's conversations can be put in the order they should be answered in. The band is the one you were shown.
- suppressed
- Whether the band was withheld for want of signal. A conversation that did not reach enough of the six gets an honest short report rather than a confident wrong one, and this records that it happened.
- utm
- The utm_ parameters on the link you arrived through, if the link carried any. Campaign attribution and nothing else. Keys that do not look like attribution are dropped before the record is written.
- referer
- The page your browser reported as the one you came from. For a link from another site, browsers now send only that site's origin rather than the full address.
- lead
- Present only if you filled in the email box: the address, the firm name, and when you sent them. Absent on every record where the box was skipped, which is most of them.
Your IP address is not in that list and is not in the record. It is read on each request to keep one browser from looping the endpoint, held in memory for ten minutes, and never written down by us. Vercel logs it separately, which is the row below.
The email box
Two fields, under a report you have already read.
The read-out appears in full before the box does, and the box is skippable. Nothing on this site sits behind an address, and the survey is finished and delivered whether you fill it in or close the tab.
If you do leave one, we use it twice. Once to send the read-out over, and once to follow up. There is no list, no sequence and no third message. The firm name is there so that whoever writes back knows who they are writing to.
Filling it in is your consent, and consent can be taken back. One line to hello@bythepeople.tech ends it, and the address comes off the record with it.
Who else touches it
Two companies, and what each gets.
Both are in the United States, so a conversation started in the EU is processed outside it. Both are engaged on their standard data processing terms, which carry the European Commission's standard contractual clauses for that transfer.
Anthropic
Receives the conversationUnited States
The interviewer and the scorer are both Claude models, called over Anthropic's API. Every turn of the interview sends the conversation so far, because the models hold no memory between calls, and the scoring call sends the finished transcript once more to be placed against the six dimensions. Two models are involved: one asks the questions and one writes the read-out. This is API access under Anthropic's commercial terms, on which inputs and outputs are not used to train models.
Vercel
HostingPlatform logsUnited States
The site and the survey's endpoints run on Vercel, so every request passes through their infrastructure and their platform logs. Those logs hold ordinary request metadata, including the originating IP address, for a limited period set by the platform. Today they also hold the record itself: there is no separate database on this project yet, so a completed session is written into the function log as one line and that line is the copy that survives. Anyone at Vercel with access to our logs could read it, and it is removed when the platform rolls those logs off.
That is the current list and it is short because the tool is new. If a database or a sales tool is added behind it, this page gains a row on the day that happens rather than at the next review.
Not on this site
No analytics, no trackers, no cookies.
Each of these is checkable from your own browser in about a minute, which is the reason they are worth stating rather than implying.
- No analytics. There is no Google Analytics, no Vercel Analytics, no Plausible and nothing equivalent. Page views are not counted anywhere.
- No advertising or social pixels. Nothing from Meta, LinkedIn, Google Ads or anyone else runs on these pages.
- No cookies and no local storage. The site sets neither, on any route. There is no consent banner to dismiss because there is nothing to consent to.
- No fonts fetched while you read. The four typefaces are compiled into the site at build time, so your browser never asks Google for one.
- No selling, renting or sharing of any of it, to anyone, for any purpose.
- The whole third-party runtime of this site is Next.js, React, Zod and Anthropic's SDK. That is the entire dependency list and it is in package.json.
How long, and why
Twelve months at the outside.
Twelve months from the conversation is the ceiling, and today the real figure is well under it: with no database on the project yet, a record lives in the hosting platform's logs and those roll off long before a year is out. When a database is put behind it, the expiry is set on the record itself so that it removes itself rather than waiting for anyone to remember. If you leave an address, the clock restarts from that moment, because a conversation we have actually had is worth the year from when we had it.
Two lawful bases cover two different halves. The transcript and the scoring are kept on legitimate interests: running a tool we give away, and building the benchmark that eventually replaces the borrowed figures in the read-out. The email address and the firm name are kept on consent, which is what the line under the box is asking for.
We apply the GDPR to everyone who uses the survey, wherever they are, rather than sorting visitors by where their browser appears to be. The firm works out of Tirana and New York.
What you can ask for
Ask, and it is done that week.
One address handles all of it. Write to hello@bythepeople.tech, say roughly when you took the survey if you can place it, and we will find it from the address you left. There is no account to log into and no form to fill in.
A copy
Everything held against you, in the shape it is stored in rather than a summary of it.
Deletion
The record, the transcript and the address, gone. This is the common one and it is not a negotiation.
Correction
A firm name typed wrong, or an address that turns out not to be yours.
Objection
Legitimate interests is a basis you are entitled to object to. Objecting to us keeping the transcript means the transcript is deleted.
Withdrawal
Consent for the address, taken back. We stop writing, and the address comes off the record.
A complaint
If we handle any of this badly you can take it to a data protection authority, and the one where you live is the right one to take it to.
If you skipped the email box there is nothing linking your conversation to you, which is good for you and does mean we may not be able to find it on request. Tell us roughly when you took it and what you said, and we will look.
One address, for all of it.
Questions about this page, a copy of what we hold, or a deletion. It is the same inbox the rest of the site sends you to, and it is read by the people who built the thing this page is about.
Subject line: Privacy