Privacy notice

The short version

We ask for as little as we can. Your answers are yours. We store data in Australia. We only ever publish anonymised aggregates, and never before a cut holds enough comparable firms. We don't sell data, we don't add you to lists you didn't ask for, and nobody contacts you unless you press "I need some help".

What we collect, and why

• Your email address — to send you your report. It is the only identifier we hold for you.
• Five facts about your business — country, industry, revenue band, employee band and your role — so your results can be compared with firms like yours. Never your company name.
• Your answers — which sentence you picked for each practice, and any free-text answer you chose to write. Free text is shown back to you in your report and read by us; it is never shown to anyone else and never used in benchmarks.
• A help request — only if you press "I need some help" on your report. Nothing is recorded there unless you do.
• Ordinary web logs (IP address, browser, pages visited) kept briefly for security and to keep the site working.
• Advertising and analytics tags, on the public pages only. The home page, the theme pages and the articles carry the Google Ads tag, Google Analytics and the Meta pixel, so we can see which pages bring people in and show our own pages again to people who visited. They collect the page you visited, a cookie identifier and your browser type. They never load on a check or on your report, and nothing we hold about you as a respondent is sent to them. If you are in the United Kingdom or the European Union the tags stay off until you agree. When a completed check is counted as an advertising conversion, our server sends the count, not your answers.

Where your data is stored

Your data is stored in Australia, on infrastructure operated for us by Supabase (database, Sydney region) and Vercel (website), with encryption at rest and in transit. One exception: the email that delivers your report is sent through Resend from its Tokyo region (Resend has no Australian region); that email holds your address and your private report link, never your answers, and Resend keeps its delivery log for a limited time. Australian privacy law applies to how we handle it.

If you are in the United Kingdom or the European Union: your data is transferred to and stored in Australia. Australia does not hold a UK or EU adequacy decision, so we rely on the UK International Data Transfer Agreement / EU Standard Contractual Clauses as the transfer mechanism, and we have carried out a transfer risk assessment. You keep the rights described below regardless of where the data sits.

If you are in Canada: your data is stored outside Canada, in Australia, and may be subject to Australian law. We apply the same safeguards to Canadian residents' data as to anyone else's. (Quebec residents: a privacy impact assessment for this transfer is on file.)

If you are in the United States: we hold your data in Australia under the safeguards above; you have the rights described below.

Benchmarks

Benchmarks are built only from anonymised, aggregated answers, and a comparison is shown only once enough comparable firms are in that cut, with the number always shown. Aggregates cannot be traced back to a business or a person. Your individual results are private to you.

What we don't do

We don't sell or rent data. We don't add you to a mailing list unless you tick a box asking for one. We don't call you. Pressing "I need some help" is the only way a conversation starts, and if we refer you to an adviser we say what we are paid.

If the business ever changes hands (added 9 Sep 2026, Andrew's ruling): the consent you gave travels with your data. A new owner is bound by this notice as it stood when you consented until you are told otherwise and given the chance to delete. Individual answers are never sold, now or then.

How long we keep it

Your email and answers for as long as your report link is live and you have not asked us to delete them. Web logs for [90] days. Anonymised aggregates are kept indefinitely; they no longer identify anyone.

Your rights

Ask us and we will send you everything we hold about you, correct it, or delete it — wherever you are. Deleting removes your email, answers and free text; the anonymised aggregates your answers contributed to cannot be unpicked and are not personal data. Email contact@onestepright.com; a person replies.

Who we are

onestepright is a business of Revoir Pty Ltd (ABN 37 611 713 930), Sydney, Australia. contact@onestepright.com. [UK representative: to be appointed if UK volumes warrant it.]

Changes

If this notice changes in a way that matters, the version and date at the top change and, if you have a live report, we tell you by email.