Privacy Policy

Countered ("Countered", "we", "us") provides a workplace execution-readiness and stress-impact assessment platform to organisations (each, a "Client"). This policy explains what personal data we collect, why, and what your rights are. Questions: barry@countered.io.

What we collect

• Account data: name, email address, and password (stored as a salted hash, never in plain text) for admin users of a Client.
• Survey response data: responses to the Execution Readiness Survey (completed by leadership) and the Stress Behaviour Index (completed by employees via a one-time, verified email link). The Stress Behaviour Index collects one identifying field, department, plus behavioural and psychological-safety responses.
• Technical data: standard server logs (IP address, browser user agent, timestamps) kept for security and abuse prevention.

We do not use tracking or advertising cookies on this platform. The only cookies set are strictly necessary session cookies that keep signed-in users logged in.

How we use it

To operate the assessment: process survey responses, compute scores, and generate dashboards and reports for the Client that commissioned the survey. To secure accounts, including multi-factor authentication. To send transactional email, such as survey invitations and account notifications. We do not sell personal data, and we do not use it for advertising or profiling.

Our role: processor vs. controller

For survey response data, the Client that invited you is the data controller, and Countered acts as a data processor on their behalf. For admin account data, Countered is the controller. If you have a question about a specific survey response, your employer is best placed to answer it; you're also welcome to contact us and we'll route the request.

Legal basis

Where GDPR or UK GDPR applies, we process data on the basis of performance of a contract with the Client and our legitimate interest in delivering the commissioned service. Some Stress Behaviour Index questions touch on wellbeing and may be considered special category data; the Client is responsible for informing its employees and obtaining any consent required before sending survey invitations.

Who we share data with

We share data only with the sub-processors that run our infrastructure: Supabase (database and authentication hosting), Vercel (application hosting), and Resend (transactional email delivery). Each is contractually limited to processing data only as needed to provide their service to us. We do not sell or rent personal data to anyone.

Data retention

We retain data for the duration of our relationship with the Client, plus a reasonable period afterwards for legitimate business or legal purposes. Data is deleted or anonymised on request, subject to any retention we're legally required to keep.

Your rights

Depending on where you're located, you may have rights to access, correct, delete, or export your data, and to object to certain processing. To exercise these rights, email barry@countered.io. If your request relates to survey response data, we may direct you to your employer as the controller of that data.

International transfers

Our sub-processors may store or process data outside your country. Where this happens, we rely on the safeguards those providers make available, such as standard contractual clauses.

Children

Countered is a workplace tool. It isn't directed at, or intended for use by, children.

Changes to this policy

We'll update the effective date above if this policy changes materially, and where appropriate, notify Clients directly.

Contact

Questions about this policy: barry@countered.io.