Privacy notice

How Aretivum collects, uses, protects and deletes participant information, what it will never do with it, and the controls you have. This notice is versioned; the version you acknowledged is recorded and shown in your account settings.

Version RB-consent-0.2, effective 7 November 2026. Status: provisional.

This is the Research Beta's working privacy notice and consent statement. It will be revised when Aretivum adopts its full privacy specification and puts independent research governance in place. You will be asked to acknowledge any material change before you start another assessment.

Information we collect

Aretivum collects only what the assessment, your account and the operation of the service need.

Account: your email address and a password, which is stored only as a one-way hash. These live in a separate identity store.
Registration: your confirmation that you are 18 or older, the version of this notice you acknowledged, when you acknowledged it, and one-way hashes of the network address and browser used at that moment (kept so an acknowledgment can be shown to have happened; the address itself is not stored).
Assessment responses: the options you choose, the examples and explanations you write, how long each question was shown, and whether you marked a question as not applicable.
Achievement and impact records: titles, descriptions, dates, your role, your ratings on the merit and impact dimensions, and the real-world events you name.
Evidence: descriptions, references and the files you choose to upload (PDF and common image formats).
Context: your age band, country and, if you give it, region. Context never changes a score; it is used for benchmark groups and research only.
Results: the scores, profiles and change-over-time comparisons calculated from the above, together with the version of the questions and the scoring model used.
Feedback you give about the Research Beta.
Operational records: web server logs (including network addresses) kept for 30 days for security and troubleshooting, and an audit trail of consequential actions such as consent, data export, account deletion and any staff access to individual records.

How we use it

To run the assessment, calculate your results and show you your profile, your history and, when enough participants exist, how your results compare with other Aretivum participants.
To operate, secure and improve the service, including finding and fixing defects.
To contact you about your account: email confirmation, password reset, and notices about material changes to this notice or to the Research Beta. Aretivum sends no marketing email.
For research and methodological development, using de-identified data as described below.

Research use and the Research Beta

Aretivum exists to measure development and accomplishment and to learn, over time, how its measures behave. Research uses de-identified data: records are keyed by a random participant identifier, never by your email address, and researchers work with aggregates and de-identified datasets. Benchmarks are published only for groups of at least 50 participants and are always labelled "Compared with Aretivum participants".

Research consent is separate from the terms of using the website. Before any formal scientific study or publication based on participant data, Aretivum will put independent research and ethics governance in place and, where applicable, obtain an ethics review. Until then, participant data are used to operate and improve the Research Beta and for internal methodological development.

Results carry the designation Aretivum Research Beta. Questions, scoring models, benchmarks and the relationships between measures can change as evidence accumulates. Your earlier results are never overwritten: a later scoring model produces a new result next to the original.

How we protect it

All traffic uses TLS; data are encrypted at rest in the database and in file storage.
Your identity (email address, password hash) is kept logically separate from your assessment records, which are stored under a random participant identifier.
Staff see aggregate figures by default. Opening an individual participant's responses requires a recorded reason and is written to the audit trail.
Access follows least privilege: the application and its operators authenticate with managed identities, and no shared passwords or storage keys exist.
Application telemetry is restricted to identifiers, codes and durations; it never contains your answers, narratives, evidence or email address.
No third-party analytics, advertising or tracking scripts run on the site.

You can. Aretivum staff can see your individual records only as described above. The service providers that host Aretivum process data on its behalf (see "Where it is processed").

Aretivum does not sell participant data and never will.
Aretivum does not disclose your scores, responses, inferred weaknesses, developmental characteristics or records to any third party without your explicit authorization. Participant-controlled sharing and credential verification are planned features; they do not exist in the Research Beta, so nothing is shared.
Aretivum does not provide institutional search, bulk screening, ranking or automated decisions based on its scores.
Aretivum will disclose data if required by law, and will tell you when it is permitted to.

Foreseeable risks

Reflecting honestly on your conduct, accomplishments and impact can be uncomfortable. You can stop at any time and resume later, or not at all.
Results are provisional. Treating a Research Beta profile as a verdict about yourself, or using it for a consequential decision, is a misuse of it.
No system is immune to a security breach. The protections above reduce the risk and the consequences; they do not eliminate them.
De-identified data can in principle be re-identified when combined with other information. Aretivum limits context to age band and country, suppresses small groups in benchmarks, and keeps the identity map apart from research data to make this hard.

Your rights and controls

Everything below is available from your account settings without asking anyone.

Access and portability: download a complete copy of your data as a ZIP archive containing a machine-readable JSON file and your uploaded evidence files.
Correction: revise an achievement or impact record at any time; earlier versions are kept as history. A completed assessment is a dated observation and is not edited; take a new assessment instead.
Withdrawal: withdraw from research at any time. You cannot start a new assessment while withdrawn; your existing records stay as described under retention unless you also delete your account. You can re-acknowledge and continue later.
Deletion: delete your account at any time, choosing whether your de-identified records are retained for research or removed entirely.
Questions and complaints: write to scott@aretivum.com.

Withdrawal and account deletion

When you delete your account you choose one of two outcomes. Both remove your email address, your password hash and the link between your identity and your records immediately and permanently, so your records can no longer be connected to you. Both are recorded in the audit trail as a deletion, without any content.

Remove everything: your assessments, responses, records, evidence files, scores and history are deleted. Aggregate benchmarks that were already published are statistics about a group and are not recalculated.
Keep my de-identified records for research: the identity link, your files and every free-text field (titles, descriptions, explanations, written examples, feedback) are removed; the structured, de-identified records (option choices, ratings, evidence classes, scores, age band and country) stay in the research dataset under the random participant identifier.
Deletion is executed immediately when you confirm it with your password. There is no waiting period and it cannot be undone, so download a copy of your data first if you want one.

How long we keep it

Account, assessment, record and result data: for as long as your account exists, so that your history and change over time can be shown.
After deletion: removed as described above. Database backups are kept for 14 days and file-storage recovery copies for 30 days, so deleted data may persist in backups for up to 30 days before they expire.
Web server and security logs: 30 days. Application telemetry, which contains no participant content: 90 days.
Audit records of consent, export and deletion: kept indefinitely. Once the identity link is removed they identify no one.
Data exports are generated when you request them and are not stored on the server.

Where it is processed

Aretivum runs on Microsoft Azure in the Central US region (United States): the database, file storage, the web application and its telemetry are hosted there under Microsoft's data-processing terms. Email confirmations and password-reset messages are sent through Azure Communication Services, which means Microsoft processes your email address to deliver them. Pair Networks hosts the domain's DNS records and receives no participant data.

Cookies

Aretivum sets two essential cookies: one that keeps you logged in (for the session, or for 14 days if you choose to stay logged in) and one that protects forms against forgery. There are no analytics, advertising or tracking cookies, so no cookie banner is needed.

Changes to this notice

This notice is versioned like everything else in Aretivum. The version you acknowledged is recorded with its date and shown in your account settings. When a material change is made you will be asked to read and acknowledge the new version before you start another assessment; records you have already made stay under the version in force when you made them.

Contact

For questions, requests or complaints about your data, write to scott@aretivum.com. Aretivum is operated as a Research Beta by its founder; a dedicated privacy contact will be named when the full privacy specification is adopted.

Document hash (SHA-256): 9f52ceb9ad604ca38d305eac934fd31861dd22effa60fee2bc541c60da04a6ee