LODESTAR is a conversational assessment platform. A consultancy uses it to offer you an assessment; you take it in a conversation; the consultancy receives the result. This policy explains what is collected in that process, what it is used for, who sees it, and how long it is kept. It is written to be read, not skimmed.
Who is responsible
The consultancy that invited you to the assessment is the controller of your data: it decides why the assessment is run and receives what it produces. LODESTAR operates the platform on the consultancy's behalf and processes your data only for the purposes described here.
What is collected
Only what the conversation asks for, at the moment it asks:
- Your first name, to address you.
- Your role, seniority and sector, to frame the questions.
- Your answers to the assessment questions, in your own words, including any follow-up answers.
- Your email address, given at the end so the report can be sent to you. It is not asked for before then, and it is not required to complete the conversation.
- Whether you agreed to a consultant contacting you about your report.
- Publicly available information about the company you name, if you name one, used to frame your report. Nothing is looked up about you personally.
The platform also records the time of each step and a one-way hash of your network address alongside each consent you give. The address itself is not stored.
What it is used for
- To run the conversation and produce your report.
- To send you that report, once, at the address you give.
- To give the consultancy the result: your report, your answers, and its own assessment of whether and how to follow up with you.
- To let you return to your report from the link in the email.
Your answers are analysed by an AI model. The model is given your answers to read and write about; it is not given your email address, and the platform's agreements with its model providers do not permit your answers to be used to train their models. The analysis is not a decision about you; it is a written interpretation for you and the consultancy to consider.
Nothing you say is used for advertising, sold, or shared with anyone other than the consultancy and the providers named below.
Who processes it
- The consultancy that invited you, which receives the result.
- The AI model provider the consultancy has configured, to analyse your answers.
- An email delivery provider, to send your report.
- A database and hosting provider, to run the platform and store your data encrypted.
Each processes your data under contract and only for the purpose stated.
Consent
Consent is asked for separately for each thing it covers, and recorded separately with the version of this policy you saw:
- Processing your answers to produce the assessment, when you give your name.
- Sending you the report, when you give your email address.
- A consultant contacting you about the report, only if you tick the box that asks. It is unticked by default.
Completing an assessment is never treated as consent to marketing. No marketing consent is asked for or recorded by the assessment.
How long it is kept
Your conversation, answers, report and contact details are kept for 24 months from your last activity, so that the consultancy can honour the follow-up you agreed to and you can return to your report. After that they are deleted. The consultancy may set a shorter period.
Your rights
You can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, or withdraw a consent you gave. Deletion removes your conversation, your answers, your report and your contact details together; it is not a flag on a record. To make a request, reply to the email that delivered your report, or contact the consultancy that invited you.
Cookies
The assessment sets one cookie, which identifies your session so that a refreshed page continues your conversation rather than starting over. The consultancy's own staff have a separate sign-in cookie. There are no advertising or third-party analytics cookies.
Security
Data is encrypted in transit and at rest. Each consultancy's data is isolated from every other's in the platform's design. Staff access is by individual accounts, and staff never see model credentials or platform secrets.
Changes
When this policy changes, the date at the top changes, and consents given from then on are recorded against the new version. Consents you already gave are not reinterpreted.