Where your data lives, and who touches it
Everything here is also in the Privacy Policy, which is the binding version. This page exists because nobody should have to read a privacy policy to answer five specific questions, and because a company that cannot answer them quickly usually cannot answer them at all.
Who processes your data
| Who | What they do | What they see |
|---|---|---|
| Supabase (US) | Hosts the database and the file store | Everything you submit, encrypted at rest |
| Vercel (US) | Runs the website and the workspace | Requests in transit; no database of its own |
| Anthropic (US) | Assists the ongoing reviews of a live roadmap | A structured snapshot of your roadmap — lever names, costs, dates and KPI figures. Never your uploaded files. Not used to train models. |
| Resend (US) | Sends transactional email | Your address and the message text |
| Stripe (US) | Takes payment | Your card details, which never reach us |
That is the complete list. If it changes, this page and the Privacy Policy change with it.
What leaves our systems, and what never does
Your files never leave. Nothing you upload — no spreadsheet, no PDF, no recorded walkthrough — is ever sent to a third-party model. Not once, for any client. Your assessment is worked through by our team, and nothing reaches you that has not been read and edited here first.
- Only an explicit request sends anything at all. Once your roadmap is running, pressing “ask for a review” sends a structured summary of it — lever names, costs, dates, your KPI figures. That is the only thing in the product that sends data anywhere, and you press it.
- Your day-to-day edits are never sent. Changing a status, moving a date, recording spend — all of that writes to the database and stops there.
- Names and free text stay behind. The summary carries no email addresses, no personal names, no owner assignments and none of the notes you type.
- Your data is not used to train anything. Not by us, and not by any provider under the commercial terms we are on.
- Every recommendation is tagged with its evidence — your KPI, your file, a named source, or our own judgement, labelled as judgement.
How long we keep things
| What | How long | Why that long |
|---|---|---|
| Raw assessment files | 12 months after delivery | Covers three quarterly refreshes. After that the structured data is what the work runs on, and the raw files are the riskiest thing we hold. |
| Documents you attach to a lever | Until you delete them | These are your own records, not our raw material. A database constraint stops the retention job from ever giving one a deletion date. |
| Your workspace and roadmap | While your subscription runs, then on request | Ask us to close a workspace and a person deletes it that day. An automatic window after cancellation is on the list and is not built yet — see below. |
| Contact enquiries | Until you ask us to remove them | Write to privacy@ and they go. |
| Billing records | 7 years | US tax law. We cannot delete these on request. |
The first two rows are enforced by a nightly job, not by intention — it deletes the file itself from storage first and only then its record, so nothing is left in a bucket that nothing is tracking. The rest are done by a person, immediately, and confirmed back to you.
The security answers, plainly
- Tenant isolation is enforced in the database, with row-level security on every table, so a bug in a page cannot leak another client’s data. It is verified by an automated suite that runs as the application’s own restricted role.
- Uploads are checked before they are stored. Only an allowlist of document, spreadsheet, image, audio and video types is accepted, everything is served back as an attachment rather than rendered, and malware scanning runs on the bytes before they reach storage — so there is no window in which an infected file is downloadable.
- Nothing you upload is served from a public URL. Files are delivered as attachments, to signed-in members of your workspace only.
- Card details never reach our servers. They are entered on Stripe’s own page; we hold an identifier and nothing else.
- Sessions are revocable. Changing a password signs out every device immediately, rather than waiting for a token to expire.
- Backups are verified by restoring them — the backup tool restores into a scratch database and counts the rows, because the failure mode is not a missing backup, it is a silently truncated one nobody restored for four months.
Where we are not yet
No SOC 2, no ISO 27001, no penetration test yet. We would rather say that than imply otherwise. What exists is the list above, which is true and checkable today.
United States only. Selling into the EU triggers GDPR obligations we have not yet put in place, so we do not sell there. If you are an EU business and want to talk anyway, say so and we will tell you honestly where that stands.
Closing a workspace is a manual step. Deletion happens the day you ask and is confirmed back to you, but it is a person doing it rather than a scheduled job. Self-service cancellation, a read-only grace period and automatic deletion after it are built but not shipped.
Staff access is limited, not separately audited. Only the people working on your assessment can reach your submission, and every change a client makes is logged — but we do not yet keep an independent audit trail of internal reads. We would rather say so than imply a control we have not built.
Asking for your data, or its deletion
Email privacy@core-lever.com. Export is self-service from the workspace at any time — CSV and PowerPoint, no request needed. Deletion is done by a person, immediately, and confirmed back to you.