Privacy Policy

At TAD Delivery Intelligence (“we,” “our,” or “us”), we are committed to protecting your privacy and ensuring you have a transparent understanding of how we collect, use, and safeguard your data. This Privacy Policy explains our practices for our SaaS diagnostic platform and related services.

What We Collect

When you use TAD Delivery Intelligence, we collect information necessary to deliver our diagnostic services:

• Organization Information: Your company name, organization structure, team names, and team composition.
• Contact Information: Email addresses and phone numbers of team members completing the diagnostic.
• Diagnostic Data: Responses to structured diagnostic questions about delivery performance, team processes, and metrics.
• Payment Information: Billing and payment details processed securely through Stripe. We do not store full credit card numbers.
• Usage Data: Log data including IP address, browser type, pages accessed, and timestamps.
• Optional Data: Jira data or SLE documentation you choose to share for enhanced analysis.

How We Use Your Data

We use the information we collect for the following purposes:

• Delivering Diagnostic Services: Analyzing your responses to generate diagnostic scores, root cause analysis, and actionable recommendations.
• Report Generation: Creating your personalized diagnostic report with executive summaries and action plans.
• Communication: Sending diagnostic results, support messages, and administrative notifications via email using Resend as our email service provider.
• Payment Processing: Processing transactions through Stripe for TAD services.
• Platform Improvement: Analyzing usage patterns and feedback to enhance our diagnostic algorithms and user experience.
• Legal Compliance: Meeting legal or regulatory requirements.

Data Storage & Security

Your data is stored securely on Supabase-hosted infrastructure with the following protections:

• Encryption at Rest: All diagnostic and organizational data is encrypted at the database level.
• Encryption in Transit: Data transmitted to our platform is encrypted via HTTPS/TLS.
• Access Controls: Access to data is restricted to authorized personnel and limited to what is necessary for their role.
• Regular Updates: We maintain current security patches and conduct regular infrastructure reviews.

While we implement industry-standard security measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information with reasonable safeguards.

Third-Party Services

We use trusted third-party services to deliver our platform and services:

We also use Supabase for database hosting, which stores your account, diagnostic and engagement records, and Calendly for scheduling calls you choose to book. These services have their own privacy policies. We require all third parties to maintain appropriate security and confidentiality measures. We do not authorize them to use your data for purposes other than providing services to us.

Cookies

TAD uses minimal cookies to maintain session security and user authentication:

• Admin Session Cookie: An httpOnly, secure session cookie that expires after one week of inactivity. This cookie is essential for maintaining your authenticated session and cannot be accessed by client-side JavaScript.
• Analytics: We use Vercel Web Analytics to measure aggregate site traffic. It does not use third-party cookies. Visitors are identified by a hash derived from the incoming request, which is discarded after 24 hours, and page views are not tied to your IP address or to any individual. It records the page URL, referrer, approximate location (country, region, city), device type, operating system and browser. We also record a small number of named interface events, for example that an inquiry form was opened or submitted, which carry no personal information.
• No Advertising or Cross-Site Tracking: We do not use advertising, marketing or retargeting cookies, we do not build advertising profiles, and we do not share your data with advertising networks.

You can disable cookies in your browser settings, though this may affect your ability to use certain features of the TAD platform.

Data Retention

We retain your data as follows:

• Assessment Data: Diagnostic responses and generated reports are retained for up to 2 years to support rescoring, trend analysis, and improvement tracking.
• Account Data: Contact information is retained as long as your account is active.
• Logs: Server logs are typically retained for 30 days.

You may request deletion of your data at any time by contacting us. We will honor deletion requests within 30 days, except where retention is required by law.

Data Sharing & Selling

We do not sell your data to third parties. Your diagnostic information, organizational data, and responses remain confidential and are used solely to deliver TAD services to you. We will not share your data with third parties except as required by law, to enforce our terms, or to protect the safety and rights of our users and the public.

Your Rights

Depending on your location, you may have certain rights regarding your personal information:

• Access: The right to request what personal data we hold about you.
• Correction: The right to correct inaccurate information.
• Deletion: The right to request deletion of your data.
• Portability: The right to receive your data in a portable format.

To exercise any of these rights, please contact us at transformation@theagilitydoctor.com.

European and UK Data Protection (GDPR)

TAD works with organisations in the European Economic Area and the United Kingdom. Where the EU General Data Protection Regulation or the UK GDPR applies to you, the following applies in addition to the rights described above.

Who is responsible for your data. The Agility Doctor, a limited liability company registered in the United States and operating TAD Delivery Intelligence, is the data controller for the information described in this policy. You can reach us at transformation@theagilitydoctor.com.

Why we are allowed to process your data. We rely on the following lawful bases:

• Performance of a contract: running a diagnostic you requested, producing your report, delivering an advisory engagement, and processing payment for paid tiers.
• Legitimate interests: replying to business enquiries you send us, keeping the platform secure, and understanding aggregate traffic so we can improve the service. We weigh these interests against your rights, and you can object at any time.
• Consent: where you have opted in to receive something specific from us. You can withdraw consent at any time, without affecting processing carried out before you withdrew it.
• Legal obligation: retaining transaction and tax records for the periods required by law.

Your rights. You have the right to access your data, to have inaccurate data corrected, to have your data erased, to restrict how we process it, to object to processing carried out on the basis of legitimate interests, to receive your data in a portable format, and to withdraw consent where processing is based on it. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Our diagnostic scoring is automated, but it produces a report for you and your team to interpret. It is not used to make an automated decision about you.

How to exercise them. Email us at transformation@theagilitydoctor.com. We will respond within one month and free of charge. If your request is unusually complex we may extend that by up to two further months, and we will tell you within the first month if we do.

International transfers. TAD is operated from the United States and our processors store and process data there. Where your data is transferred out of the EEA or the UK, we rely on Standard Contractual Clauses, together with the UK International Data Transfer Addendum where relevant, within our agreements with the processors named in the Third-Party Services section above.

Complaints. If you believe we have handled your data improperly, we would like the chance to put it right, but you also have the right to lodge a complaint with your national data protection supervisory authority in the EEA, or with the Information Commissioner’s Office in the United Kingdom.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date above and posting the revised policy on our website. Your continued use of TAD following these changes constitutes your acceptance of the updated Privacy Policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at transformation@theagilitydoctor.com. We will respond to your inquiry within 14 days.