Privacy Policy

The short version

We collect the minimum needed to run the product: your assessment answers, your email if you ask for a report or buy something, and cookieless usage analytics. We don't run ad trackers, we don't sell data, and your individual answers are never shared with insurers or anyone else.

What we collect

• Readiness Check answers. Stored with a random session identifier (not your name). If you request the emailed report, your email is attached to that assessment so we can send it.
• Email addresses you submit for reports, waitlists, or purchases — with a record of what you signed up for (consent basis).
• Purchase records from our payment partner (email, product, amount). Card details never touch our servers — the payment partner processes them as merchant of record.
• First-party usage events (page entered, check started/completed, button clicks) tied to a random identifier stored in your browser — no cross-site tracking, no advertising cookies. Site traffic is additionally measured with Plausible, a cookieless analytics tool.

Aggregate statistics

We publish research from Readiness Check data — e.g., “X% of assessed businesses lack a tested incident response plan.” These statistics are always anonymized and aggregated (minimum sample sizes, no company-identifying details). Individual assessments never leave our systems.

Email

Transactional email (reports, receipts, downloads) is sent to complete what you asked for. Marketing email is only sent with your consent and every message has one-click unsubscribe.

Retention and deletion

We keep records as long as they're needed for the purposes above, and purchase records as required for tax and accounting. Want your data deleted? Email support@surable.aifrom the address in question and we'll delete your assessments, lead records, and email from our systems (purchase records are retained where legally required).

Processors we use

Hosting and database infrastructure; a merchant-of-record payment provider; a transactional email provider; cookieless web analytics (Plausible); and, for optional report narratives, an AI provider (Anthropic) that receives assessment scores and gap summaries — never your email or company name. Each processes data only to provide their service to us.

Your rights

Depending on where you live (including under state privacy laws such as the Texas Data Privacy and Security Act), you may have rights to access, correct, or delete your data. Email us and we'll honor them.

Contact

Privacy questions: support@surable.ai.