Privacy Policy

The assessment is operated by [LEGAL ENTITY NAME] (“Sassuo”, “we”), registered at [REGISTERED ADDRESS], Kigali, Rwanda. We are the data controller for the information described below.

For anything about your data, contact [PRIVACY EMAIL]. We aim to answer within five working days and will not take longer than one month.

Two kinds of information, and nothing else.

We do not collect payment details, we do not ask for anything about your customers, and we do not use tracking cookies or advertising pixels on this tool.

While you are completing the assessment, your answers are saved in your own browser so a refresh or a dropped connection does not lose your progress. That copy lives on your device, is deleted after fourteen days, and is cleared when you finish. It is not a cookie and it is not sent anywhere until you submit the form.

If you are in the United Kingdom, Ireland or elsewhere in Europe, the UK GDPR and EU GDPR apply and we rely on two lawful bases.

Your consent, which you gave by ticking the box asking us to email your report, and separately by ticking the marketing box if you did. The two are separate on purpose. You can withdraw either at any time and withdrawing does not affect anything we did beforehand.

Our legitimate interests, for keeping the assessment working and free of abuse, and for keeping a record of what you consented to and when. We consider this proportionate because it involves no profiling, no automated decision with a legal effect, and no sharing with advertisers.

If you are in Canada we handle your information in line with PIPEDA. If you are in the United States, see section 9 for your rights under state privacy laws.

We generate your report, send it to you once, and send one follow-up message about forty-eight hours later. If you ticked the marketing box, we may also send occasional emails about using AI in a business like yours, and every one of those carries an unsubscribe link that works.

We look at the answers in aggregate to improve the assessment itself, for example to see which question loses the most people.

Your report is generated by a fixed calculation, not by an AI model, and no part of your submission is used to train any AI system. We do not sell your information, and we do not share it with advertisers.

Four service providers, each doing one job, each bound to process data only on our instructions.

Because we operate from Rwanda and use providers in the United States, your information is transferred outside the country you are in. For transfers out of the UK and the European Economic Area we rely on Standard Contractual Clauses with each provider.

We keep your assessment and contact details for up to twenty-four months from your last interaction with us, then delete them. If you ask us to delete them sooner, we do it and it is permanent, including the link to your report.

We keep a minimal record of the fact that consent was given or withdrawn, and when, for as long as we need it to show we handled your data properly.

Everything travels over an encrypted connection and is encrypted where it is stored. The database is not reachable from a browser and is locked at the row level. Access is limited to people who need it. We store a hash instead of your IP address specifically so that a breach would not expose it.

Your report link is a long unguessable address rather than a login, so you can reopen it from your email without an account. Anyone with that exact link can view that report, so treat it as you would a private document.

Wherever you are, you can ask us to show you what we hold, correct it, delete it, send you a copy in a portable format, stop using it for marketing, or object to how we use it. Email [PRIVACY EMAIL]. We will not charge you and we will not make it difficult.

In the UK you may complain to the Information Commissioner’s Office. In Ireland, the Data Protection Commission. In Canada, the Office of the Privacy Commissioner. In Rwanda, the National Cyber Security Authority. We would rather you came to us first, but you do not have to.

This is a tool for business owners and is not intended for anyone under 18. We do not knowingly collect information from children. If you believe we have, tell us and we will delete it.

If we change this policy we will update the date at the top. If a change materially affects how we use information you already gave us, we will email you about it rather than quietly editing the page.