Privacy policy

StressCast measures work-related burnout with a short self-assessment. Your answers can reveal sensitive information about your wellbeing, so we treat them as highly sensitive operational data even though StressCast is not a medical product.

We follow data minimisation: before you request a report we collect no personal data, and your answers stay in your browser session.

Before the report step: nothing that identifies you. Calculations run without storing your answers.

When you request the report: your email, language, country, answers, result, consent records (with versions and timestamps) and technical delivery status.

Always: minimal technical logs (request identifiers, error codes, a rate-limit key derived from your network address). We do not log answers or payloads.

To generate and deliver your report — based on your explicit consent. Marketing messages require a separate, optional consent that is unchecked by default. Research use would require yet another separate consent and is not performed.

Optional anonymous usage measurement is loaded only if you allow it, and it never includes answers, score, email or report content.

While StressCast is in its validation phase, a copy of your report request (identifier, answers, result and the PDF) is sent to the StressCast operator so delivery can be reviewed and completed manually. This copy is used only for that purpose, never for employment decisions, marketing or analytics. You are told this before you submit.

Hosting and delivery: Vercel. Database: Supabase. Email: Resend. Bot protection: Cloudflare Turnstile. Rate limiting: Upstash. Model files: Google Drive (never user data). Optional analytics: PostHog (only allow-listed events, after consent). Error monitoring: Sentry (scrubbed of personal data). Payments, only if enabled: Stripe.

Providers act under their own terms and our instructions; transfers outside your country may occur.

Individual payloads (answers and results) are kept for 30 days during validation unless a different legal obligation or documented operational need applies. Minimal audit records may be kept longer and contain no answers.

Depending on where you live (for example under the GDPR, CCPA/CPRA, Brazil’s LGPD or Peru’s Law 29733) you may have rights to access, correct, delete, restrict, port or object to processing of your data.

Use the form on the data-rights page. We verify your identity by email before acting.

Encryption in transit, secrets kept server-side, row-level security in the database, signed and expiring private report links, rate limiting and bot protection.

We will update this policy when practices change and publish the date above. Use the data-rights form for any request.