Privacy Policy

• Account details — the email address and password (stored hashed by our authentication provider) you sign up with, your role in your organization, and when you agreed to our Terms and which version.
• Organization details — the company name, industry, headquarters city and employee count you give during setup.
• Roster data — the information in the files your organization uploads that our service uses: employee IDs, names, titles, departments, locations, manager relationships, hire and termination dates and, if the file includes it, compensation. Compensation is used only for internal scoring and is never displayed. We do not ask for, and do not use, anything else in a file. The original file and the preview rows stored with it are deleted as soon as the roster has been processed; we keep the employee records we built from it.
• Survey data — if you use surveys: the email addresses you enter, used to send each person a link and to count how many different people your plan has surveyed in the last 30 days (we keep a one-way fingerprint of the link, not the link itself), and the answers, which are stored with no link to the person or their email address and with the date only.
• Billing details — handled by Stripe. We receive your plan, billing status and invoices, not full card numbers.
• Contact form — the name, business, email, phone, employee count, turnover concern and notes you submit.
• Technical logs — standard server logs (IP address, request, time) kept by our hosting provider for security and reliability.

To provide the service (compute your EmployerScore and, if purchased, team-level turnover risk), run billing, send transactional email (confirmations, invitations, survey links, and alerts you have turned on), keep the service secure, and answer your questions. We don’t sell or share personal information for advertising, and we don’t use roster data for advertising.

To map the columns of an uploaded roster, we send the file’s column headings, and up to five sample rows of the columns our built-in matcher could not place, to Anthropic’s API. We do not send the whole file. Under Anthropic’s commercial terms, content sent through its API is not used to train its models.

Only the service providers listed at /subprocessors, each bound by contract to protect it, and where the law requires it. If Ceribria is acquired, data may transfer to the acquirer under the same commitments.

When a company uploads its roster, that company decides what is collected and why; Ceribria processes it only on the company’s instructions, and will sign a Data Processing Agreement on request (email sales@ceribria.com). People whose information is in a roster should direct requests (access, correction, deletion) to their employer; we will help the employer respond.

An organization’s Transparency Report is private unless its owner or admin publishes it. A published report is public, and search engines may index it. It shows the company name, industry and headquarters location, the company domain its publisher confirmed, the EmployerScore and its dimensions, and when it was last calculated. It never shows employee names, pay figures or team names.

People who look up a report need no account, and we ask them for no personal information. The pages set no tracking cookies; like every page on our site they appear in our hosting provider’s standard server logs.

We keep roster and score data while your subscription is active, and for up to 90 days after it ends so you can come back; then we delete it. You can ask us to delete your organization’s data sooner, at any time, at sales@ceribria.com, and we will do so within 30 days. Encrypted backups age out on our database provider’s regular schedule. Account and billing records we must keep to meet legal or tax obligations are kept for as long as the law requires.

Data is encrypted in transit and at rest by our infrastructure providers, access is limited to signed-in members of your organization, and uploaded rosters are stored in a private bucket. Our team accesses customer data only when needed to run or support the service. No system is perfectly secure; we will notify affected customers of a breach as the law requires.

Depending on where you live (for example under the GDPR or California law) you may have the right to access, correct, delete or export your personal information and to object to certain processing. Email sales@ceribria.com. We currently serve customers in the United States and store data there; if you are in the EU or UK, contact us before uploading employee data so we can put the right transfer terms in place.

We use only the cookies needed to keep you signed in. Your light or dark preference is saved in your browser’s local storage, not sent to us. We do not use advertising or cross-site tracking cookies.

We’ll post changes here and update the date above; for material changes we’ll also email the account owner. Questions: sales@ceribria.com. Ceribria is based in Atlanta, Georgia, USA.