Privacy Policy

The short version

• You give us your answers, your email and a few details about your role and organisation. We use them to score your assessment and email you the result. We keep your answers in our own database. Unless you tick the box saying you don’t want follow-up emails, your details and score also go to HubSpot, our CRM, and we send you a few follow-up emails, each with an unsubscribe link.
• Analytics and HubSpot tracking start only if you click Accept. If you click Reject, everything still works.
• We email your result, and one reminder, about 24 hours later, if you leave an assessment unfinished. Apart from sign-in and account emails, we send you a few follow-up emails about your result unless you tick the box saying you don’t want them. That box is not ticked for you. Every follow-up email has an unsubscribe link.
• If you buy a Deep Report, Stripe handles your payment. We keep a record of the purchase for 6 years because tax law requires it.
• We don’t sell your data and we don’t run adverts.
• You can delete your account in the app, and we’ll delete your HubSpot record too, within 30 days.

Questions or requests: hello@pink-matter.co.uk. The full policy is below.

1. Who we are

PINK MATTER LTD (“Pink Matter”, “we”, “our”, “us”) is a limited company registered in Scotland, company number SC870294. Our registered office is at 1 Stoneybank Drive, Musselburgh, Scotland, EH21 6TB. You can reach us at hello@pink-matter.co.uk.

We are the data controller for the personal data described in this policy.

2. Scope

This policy covers two places: the marketing site at learningvelocityindex.com, and the Learning Velocity Index™ app at app.learningvelocityindex.com (the free assessment, your results, your account and the dashboard). It is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). Our company site, pink-matter.co.uk, has its own privacy policy.

3. What data we collect

When you take the assessment or create an account we collect:

• Identity and contact: your email address, and your first and last name.
• About your role and organisation: job role, organisation name, industry, organisation size band, headquarters region and L&D spend band.
• Your answers: every response and confidence rating, plus when you started and how long you took.
• What we calculate: your Learning Velocity Index™ score, band, data-quality index and sub-dimension scores, and your retake history.
• How you found us: the utm_source, utm_medium and utm_campaign values on the link you arrived from, if any.
• Sign-in details: managed for us by Supabase (a one-time sign-in link or session) so you can return to your results.

If you use optional features we also hold: the names and email addresses of colleagues you invite to rate your organisation (and the ratings they give); share, badge and verification links you create (which show your band publicly if you share them); and challenge links you send to peers.

If you buy a Deep Report we hold: which assessment it is for; the price paid; the date and time of purchase; the order reference from our payment provider, Stripe; the payment status (paid, refunded or disputed) and any amount refunded; when you ticked the box asking us to supply the report straight away; and when we sent your purchase confirmation email. Stripe collects your card details and billing information directly. We never see or store your full card number.

Automatically: our hosting provider (Cloudflare) processes your IP address and browser details to deliver the site and keep it secure.

We do not use advertising cookies, remarketing or cross-site ad tracking, and we do not sell personal data.

4. Why we use it (our lawful bases)

• Delivering your result: scoring your answers, showing and emailing your result, and running your account. Basis: providing the service you asked for (UK GDPR Article 6(1)(b)) and our legitimate interest in running it (Article 6(1)(f)).
• Analytics cookies (Google Analytics, HubSpot tracking): only with your consent (Article 6(1)(a) and PECR), given through the cookie banner. Rejecting costs you nothing; everything still works.
• Follow-up emails and our CRM: when you complete an assessment, we send your name, email, role, organisation, industry, size band, region, L&D spend band, score, band, data-quality index and a link to your results page to HubSpot, our CRM, and send you a short series of follow-up emails about your result and how to improve it. If you tick “Don't send me those follow-up emails” on the last assessment screen, none of this is sent to HubSpot and we don’t send those emails. Basis: our legitimate interests (UK GDPR Article 6(1)(f)) in following up on the assessment you took, and PECR regulation 22(3). Every follow-up email has an unsubscribe link; use it, or email hello@pink-matter.co.uk, and we stop.
• Reminder email: if you start an assessment and do not finish it, we send one reminder email about 24 hours later. We do not send more. Our basis is legitimate interests. It has an unsubscribe link, as does every marketing email we send. Service emails you need, such as receipts and confirmation that your account was deleted, don’t carry an unsubscribe link.
• Raters you are invited by: see “If you were invited to rate an organisation” below. Basis: legitimate interests.
• Research and aggregate statistics: we turn your scores into a research record that leaves out your name, email address, account ID, IP address, any comments you typed and who rated you, and keeps only broad details (industry, organisation size band, region, role band and year). We combine these records from many people and organisations to test and improve the Learning Velocity Index™ and to produce aggregate statistics. We never publish a figure that draws on fewer than 5 organisations, and we don’t try to work out who anyone is. Basis: our legitimate interests (Article 6(1)(f)) in improving our method and understanding learning across organisations; you can read a summary of our balancing test on request. You can object at any time before your account is deleted by emailing hello@pink-matter.co.uk, and we will not create a research record from your answers.
• Selling you a Deep Report: taking payment through Stripe, giving you access, sending your purchase confirmation and receipt, and handling cancellations, refunds, disputes and complaints. Basis: performing our contract with you (Article 6(1)(b)).
• Accounting and tax records: keeping records of each sale. Basis: legal obligation (Article 6(1)(c)), under company and tax law.
• Preventing fraud and defending disputes: keeping evidence of your consent to immediate supply and of the confirmation we sent, for example if a payment is disputed. Basis: our legitimate interests (Article 6(1)(f)).
• Security and legal obligations: preventing abuse and meeting our legal duties.

You can withdraw consent at any time: use “Cookie preferences” in the footer for cookies, the unsubscribe link in any email, or email hello@pink-matter.co.uk. Withdrawing does not affect processing carried out before you withdrew.

5. If you were invited to rate an organisation

The person who invited you gave us your email address so we could send the invitation. We use it to send the invitation and one reminder after 48 hours, and to record your ratings. Our basis is legitimate interests (running the multi-rater assessment). We keep your ratings until the person who invited you deletes their assessment. Email hello@pink-matter.co.uk to be removed.

6. Who we share it with (our processors)

We use the following providers to run the service. They process data on our instructions:

• HubSpot, Inc. (CRM and email, EU data centre): unless you tick the box saying you don’t want follow-up emails, we send HubSpot your name, email, role, organisation, industry, size band, region, L&D spend band, score, band, data-quality index and a link to your results. HubSpot does not receive your individual answers. If you also accepted cookies, HubSpot’s tracking script links your earlier site visits to that contact record. If you tick the box, your assessment details are not sent to HubSpot.
• Supabase (database and sign-in): stores your account, answers and scores.
• Cloudflare (hosting and security): serves the site and app, and provides cookie-free, aggregate performance statistics (Cloudflare Web Analytics) that do not track you across sites. Our hosting provider also keeps technical logs (IP address, browser, errors) for security and debugging.
• Resend (transactional email; stores data in the United States and sends our emails from Ireland): sends your result, sign-in, reminder and purchase confirmation emails. It processes your email address and the content of those emails on our instructions.
• Stripe (payments; Stripe Payments Europe, Limited, with Stripe Payments UK Ltd providing the regulated payment services): processes Deep Report payments, refunds and disputes. For processing your payment on our behalf, Stripe acts as our processor. For some purposes, such as preventing fraud, meeting its own financial-regulation duties and running its payment network, Stripe acts as a separate controller under its own privacy policy (stripe.com/gb/privacy). We receive from Stripe only the payment outcome, the order reference and limited card details (such as card type and last four digits) shown in Stripe’s records, never your full card number.
• Google Analytics 4 (Google Ireland Ltd): analytics, only if you accept cookies.
• Google Fonts (marketing site only): your browser fetches font files from Google, which may log your IP address.
• Calendly (marketing site only): if you click “Book a call”, Calendly’s booking widget loads from calendly.com and may set its own cookies.

We do not sell, rent or otherwise share your personal data with anyone else, except where the law requires it.

7. International transfers

Some of our providers process data outside the UK, including in the United States. This includes Stripe (payments) and Resend (email), and may include others listed above. Where they do, we rely on the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) where the provider is certified, and otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in the provider’s data processing agreement. Ask us if you would like details for a particular provider.

8. How long we keep it

• Your account and assessment answers: kept while your account is active. If you don’t sign in for 24 months we email you, and 30 days later we delete your account, answers and any colleague ratings. You can also delete your account at any time in the app, under Account. Before deleting, we keep a de-identified research record of your scores (see “Research and aggregate statistics” in section 4), which we may keep indefinitely.
• Ratings from people you invited: kept until you delete the assessment they belong to.
• HubSpot contact record (only exists if you didn’t tick the box saying you don’t want follow-up emails): kept until you ask us to erase it, and for no more than 24 months after your last interaction with us, such as filling in a form, clicking a link in one of our emails or replying to us. When your app account is deleted, whether you delete it or we do because you haven’t signed in for 24 months, we delete your HubSpot record too, within 30 days. You can also ask us to delete it at any time by emailing hello@pink-matter.co.uk, and we’ll do it within 30 days. If you only unsubscribe, we keep a minimal suppression entry so we don’t email you again.
• Research records: kept indefinitely, because they no longer identify you. We check every year that they still can’t reasonably be linked back to anyone; any that could be are further generalised or deleted. Aggregate figures combine many organisations and are not about you.
• Deletion records: when we delete an account or a HubSpot record, we keep a short note that it happened. It has no name or email address in it, just a coded reference and the month. We keep it for 3 years, so we can show the deletion was done and make sure nothing comes back if we ever restore a backup, and then it’s deleted automatically.
• Purchase records (what you bought, price, dates, order reference, payment status, refund details, your immediate-supply consent and confirmation record): kept for 6 years from the end of the financial year in which the purchase was made, to meet HMRC and company record-keeping duties and to deal with any claim. This applies even if you delete your account: we keep the purchase record but remove your access and your assessment answers. After that period we delete it.
• Purchase confirmation emails: Resend keeps a copy of sent emails for a limited period under its standard retention; our own record of when the email was sent is kept with the purchase record.
• Prospects and business contacts (people we have contacted, or who contacted us, about our services): kept for 12 months after our last contact with you, then deleted, unless you become a client.
• Google Analytics data: kept for the retention period set in our Google Analytics account, and not linked to your assessment or account.

9. Cookies and similar technologies

Analytics and tracking only start after you click “Accept” on the cookie banner. If you click “Reject”, no Google Analytics or HubSpot tracking script is loaded. If you accepted and later click “Reject”, or use “Cookie preferences”, we delete these cookies and reload the page. Change your mind any time via “Cookie preferences” in the footer.

Our sites share one Google Analytics property, so links between learningvelocityindex.com, the app and pink-matter.co.uk may carry a _gl parameter that lets Google Analytics recognise you as the same visitor (cookie-consent only). We do not use Google Ads, remarketing or user-level advertising identifiers.

10. Your rights

Under UK data-protection law you have the right to:

• Access the personal data we hold about you (the Account page exports your assessments and scores; to get anything we hold elsewhere, such as in HubSpot, email us).
• Rectify inaccurate or incomplete data.
• Erase your data (the “right to be forgotten”).
• Restrict or object to our processing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent or unsubscribe at any time.
• Complain to the Information Commissioner’s Office (ICO).

Some rights are limited for purchase records: for example, we cannot erase sales records we must keep for tax purposes until the retention period ends. We will tell you if this applies to a request.

To exercise any of these rights, email hello@pink-matter.co.uk. We will respond to requests within one month (longer, with an explanation, if a request is complex).

11. Security

We use encryption in transit (TLS), access controls, and reputable providers with industry-standard security certifications. No transmission over the internet is 100% secure, but we take all reasonable and proportionate steps to protect your data.

12. Children

The assessment is for working professionals aged 18 or over. We do not knowingly collect children’s data. If you believe a child has submitted their data, contact hello@pink-matter.co.uk and we will delete it.

13. Changes to this policy

If we make material changes we will update the effective date above and, where the changes affect how we use your email, tell you by email before they take effect.

14. Contact and complaints

For questions, requests, or complaints about your data:

• Email: hello@pink-matter.co.uk

If you are unhappy with how we use your data, tell us at hello@pink-matter.co.uk. We will acknowledge within 30 days, look into it and tell you the outcome. You can also complain to the Information Commissioner’s Office (ICO):

• Website: ico.org.uk/make-a-complaint/
• Phone: 0303 123 1113