Confidentiality & Data Integrity Constitution

Coarse regional context — country and, where available, a broad region code — is read at the CDN edge from request metadata as your contribution is submitted.

Your raw IP address is never written to a log, a database row, or an analytics record. It is mathematically discarded the moment the coarse tag is derived. There is zero raw IP logging anywhere in this platform, at any layer.

Abuse throttling uses a one-way cryptographic hash that cannot be reversed into an address.

If you opt in to receive the macro synthesis report, your email address is written to an isolated table that holds no session identifier, no transcript reference, and no foreign key back to your qualitative contribution.

There is no join, no lookup, and no reconstruction path between an email address and a transcript. The separation is structural, not procedural — it cannot be undone by policy change or human choice.

Before any contribution enters aggregate analysis, a dedicated redaction pass (GPT-5.6 Luna) replaces personal names, employers, client names, team names, and locations with generic placeholders such as [a colleague] or [my company].

The same pass translates profanity, expletives, and any derogatory language targeting protected characteristics into precise, executive-grade qualitative prose.

Critically, sanitization never softens substance. Criticism, frustration, disagreement, and grievance intensity are preserved exactly as expressed. Only identifying detail and explicit phrasing change.

The raw, audio-derived text of your contribution is discarded as soon as the scrubbed version is written — within 24 hours at the outside.

This applies equally to abandoned sessions. If you close the tab partway through, the raw text of what you said is purged on the same retention clock; it is never held indefinitely simply because the conversation was left unfinished.

Only the scrubbed, de-identified version and its coarse analytic tags survive into aggregate research.

This platform is engineered exclusively to capture authentic, real-time human reflection. Synthetic contribution has no place in a qualitative record.

Active filtering rejects automated scripts, bot submission patterns, invisible-field trap triggers, implausibly fast submissions, and speech-recognition artifacts or null audio.

A privacy-preserving 24-hour participation window keeps every response considered and unhurried, and prevents a single actor from distorting a cohort.

Some pulses are run inside a single organisation and are reachable only through a personal invitation link. The invitation exists so the right people are asked — never so their answers can be attributed back to them.

Your invitation carries a single-use token. While the conversation is open, that token is the only thread connecting your invitation to your response. It exists for one reason: to mark your invitation as complete so you are not chased with reminders.

The moment your session finishes, that thread is cut. This is what we call the data guillotine: your group labels — such as department or cohort — are copied onto the anonymous response, and the token is then permanently erased from it in the same atomic step. No completion timestamp is kept either, so the order in which people responded cannot be used to work backwards.

After that step the link is gone for good. Not hidden, not access-controlled — destroyed. Nobody, including the organisation that commissioned the pulse and including us, can determine which invited person wrote which response.

Results can be viewed by group — a department, a location, a cohort. Any group with fewer than three completed contributions is never reported on its own; it is folded into the overall figures instead.

Without this rule, narrowing a filter to a team of one or two would effectively reveal an individual's words. The threshold is enforced in the analytics dashboard and in every synthesised report alike, so it cannot be sidestepped by changing where you look.