Privacy policy

Last updated 26 August 2026.

This policy covers The Scoring Company platform: the marketplace, the assessment builder and the assessments people fill in. It is written to be read, not to be impressive. If anything here is unclear, write to scoring@thescoringcompany.com and we will answer it.

Two different relationships

Most of the confusion about assessment data comes from not separating these, so we will start with them.

• Your account. When you register, we decide what to collect and why. We are responsible for that data.
• Answers you give to someone else's assessment. The publisher who wrote that assessment decided to ask those questions, and they receive the answers. We hold and process them on that publisher's behalf. Every assessment shows you who the publisher is, and their own data-processing note, before you start — that note is written by them, not by us.

If you want answers you gave to a publisher's assessment removed, you can ask us and we will act on it, but the publisher is the right first place to ask.

What we collect

• Account details — your name, email address, password (stored only as a hash), and your company and billing details if you add them.
• Assessments you build — the questions, weights, report text and images you create.
• Submissions — the answers given to an assessment, the scores calculated from them, and any files uploaded as part of an answer. A submission can be anonymous: if you are not signed in, no account is attached to it.
• Purchases — what was bought, when, for how much, and the resulting credits. We never see or store your card number; card details go directly to Stripe.
• Sign-in records — the time you signed in, your IP address, your browser's user-agent string and operating system. We use this to investigate account misuse.
• Your cookie choice — what you chose and when, with a shortened IP address: we drop the last part of it, so it does not identify you precisely.

We do not buy personal data from anyone, and we do not build advertising profiles.

Cookies

There are two kinds on this site, and you control the second.

• Necessary. Your sign-in session, the security token that stops other sites submitting forms as you, and the cookie that remembers your cookie choice. The site cannot work without these, so they are not optional.
• Analytics. Google Analytics, which tells us which pages get used. These load only if you turn them on. If you reject them the Google tag is never added to the page at all — not loaded and then ignored.

You can change your mind at any time from the cookie settings link, which is also in the footer of every page.

Who else sees your data

• The publisher of an assessment you complete — they see your answers, your scores and any files you attached. That is the point of filling it in.
• Stripe — payments and payouts. Stripe handles card details directly and has its own privacy policy.
• Google Analytics — only if you accepted analytics cookies.
• Our email provider — to send you your result, your receipts and account emails.

We do not sell personal data.

Aggregated statistics

We calculate averages and percentiles across the submissions to an assessment, so a respondent can be told how their score compares. These appear only once enough people have responded for the comparison not to point at any one of them; below that threshold we show your own score and no comparison. The publisher sets that threshold for their own assessment.

How uploaded files are stored

Files uploaded as answers are kept on private storage, not in a public web folder, and are renamed to random identifiers so they cannot be guessed at. They are served only to people entitled to see that submission.

How long we keep things

Account data is kept while your account exists. Submissions are kept while the assessment they belong to exists, because they are the publisher's records.

When an account or an assessment is deleted it is immediately withdrawn from view and queued for permanent removal, which an administrator confirms. We do it this way because permanent removal cannot be undone, and because a deletion request often needs to be accompanied by a copy of the data for the person asking. We aim to complete queued removals within 30 days.

Submissions you made to another publisher's assessment are not deleted along with your account — they are detached from it instead, because they are that publisher's business record rather than yours.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. You can withdraw your cookie consent at any time, and you can object to a particular use. Much of it you can do yourself: your account page edits your details, and deleting your account from that page starts the removal described above.

For anything else, write to scoring@thescoringcompany.com. We aim to respond within 30 days. If you are in the EU or UK and you are not satisfied with our answer, you have the right to complain to your national data protection authority.

Security

Passwords are stored only as hashes and cannot be read back, including by us. Passwords a publisher sets on an assessment are stored the same way. Payment webhooks are cryptographically verified before we act on them. Uploads are restricted by file type and size and stored outside the public web root.

No system is perfectly secure and we are not going to claim otherwise. If you believe you have found a vulnerability, please tell us at scoring@thescoringcompany.com before disclosing it publicly.

Changes to this policy

If we change it materially we will say so here and update the date at the top. The current version is always the one you are reading.

Terms and conditions →
Refund policy →
Contact and support →