Assessment data and privacy
Last reviewed: 20 October 2026. This notice describes data handled by the AI Governance Self-Assessment at assess.wlassalle.com, operated by Will Lassalle.
Assessment and saved results
Your answers and position are saved in this browser’s local storage so you can resume. Completing the assessment, discarding saved progress on the home page or clearing this site’s browser storage removes that progress from this device. Progress also expires on your next visit after 30 days without an answer change.
Starting an assessment records a start timestamp. Viewing results stores overall and domain scores, maturity level, a timestamp, and any optional industry and company size. Viewing or reopening a results link can create another submission; submissions are not verified unique people or organizations. Synthetic records are excluded from aggregate reporting. No name or email is required to view results.
Results links encode answers and may include industry and company size. Encoding is not encryption. Anyone with a link can read those answers. Links can remain in browser history and appear in a shared social preview. Avoid sharing confidential information. Scores are a self-reported baseline, not a certification.
Optional emailed report and follow-up
If you request an emailed report, your name, email, scores, domain recommendations, results link and any linked submission identifier are stored in the assessment database. Repeated requests update the contact record and may retain previous score history. Will can follow up about your results.
Replit hosts the application and database. Resend processes your requested report and owner-notification emails. If configured, a private Discord channel receives an owner notification. Owner email and Discord notifications point to the authenticated dashboard without including contact details, scores or answer-bearing links. Your requested report still contains your results. Application diagnostics omit contact details and result payloads; providers may retain delivery and connection metadata. Requesting a report does not subscribe you to the separate newsletter.
Retention periods
The following policy is approved. Server-side deletion remains disabled pending the first reviewed cleanup; these periods do not mean that existing records have already been deleted. Browser progress expiry operates separately.
| Data | Retention |
|---|---|
| Incomplete browser progress | 30 days without an answer change; cleared on your next visit. Completion or discard clears it earlier. |
| Unlinked assessment starts and score submissions | 90 days from creation or submission. |
| Optional contact details and linked results | 12 months from capture or the last meaningful two-way conversation. Older history snapshots have their own 12-month limit. |
| Owner-controlled notification copies and routine logs | 30-day policy target. |
| Sanitized security events | 90-day policy target, with documented preservation exceptions. |
| Genuinely anonymized monthly activity totals | 24 months; no contact details, answers or individual score histories. |
| Provider and backup copies | Actual expiry windows are not yet verified. We do not promise a fixed deletion date for these copies. |
Routine reminders, email opens, page visits and admin edits do not extend contact retention. Specific preservation obligations may require a documented exception and periodic review. Newsletter consent and delivery records are governed separately.
Access and deletion requests
To request access, correction or deletion, contact will@wlassalle.com. Do not send sensitive answers in the initial request. We verify requests proportionately and target active-system completion within 30 days of a validated deletion request, subject to applicable obligations.
Clearing browser storage does not remove server records or copies in email, notifications, logs or backups. Deleting our database records cannot revoke a shared results URL or erase PDFs, emails or links already held by you or other recipients. Backup restoration must reapply prior deletions before records return to active use.
This notice does not promise anonymous processing or private access controls for shared results links.