Join the discussion

FOLKBENCH / LEGAL

Privacy Policy

This Policy explains how Folkbench handles personal information when you visit, sign in, submit information, or participate

Last reviewedEffective

1. Scope and responsible entity

Folkbench determines how personal information is processed for the service, except where a third party independently determines its own processing. This Policy applies to Folkbench public pages, accounts, vendor workspaces, evaluation participation, support, and related operations.

2. Information we collect

  • Account and identity information, such as an identity-provider subject, display name, verified email, profile image, organization membership, role, and session records where sign-in is enabled.
  • Vendor and service submissions, agreement acceptance, public sources, test-target information, and authorized representatives’ contact details.
  • Evaluation control records, compact results, evidence manifest metadata, review decisions, corrections, and audit history. Raw process artifacts are intended for private object storage rather than public pages or large database fields.
  • Security and operational metadata, such as request or run identifiers, timestamps, route, status, latency, error category, release, and limited network information needed to protect and operate the service.
  • First-party product analytics fields enabled by default, including bounded page, interaction, attribution, and performance data. Folkbench does not use these fields for cross-site or cross-platform profiling, and the browser analytics schema excludes search text, email, full URLs, session replay, and automatic click capture.
  • Communications you choose to send, including support, correction, vendor, privacy, or security requests.

3. Sources of information

We receive information from you, your organization, configured identity providers, participating vendors, public provider sources, controlled evaluation systems, and service providers that support Folkbench. We distinguish provider statements from observed, measured, calculated, editorial, and unknown facts.

4. How we use information

  • Provide accounts, workspaces, directory pages, evidence review, corrections, and support.
  • Authenticate users, enforce roles, protect credentials, prevent abuse, and investigate security incidents.
  • Operate controlled evaluations, sanitize evidence, calculate versioned results, and publish approved snapshots.
  • Maintain audits, troubleshoot failures, measure service reliability, and improve Folkbench.
  • Comply with law, enforce agreements, and establish, exercise, or defend legal claims.
  • Process bounded first-party product analytics to understand feature usage, diagnose issues, and improve Folkbench.

5. Legal bases

Where applicable law requires a legal basis, processing may be necessary to perform a contract, take requested pre-contract steps, pursue legitimate interests in operating, securing, and improving Folkbench, comply with legal obligations, or protect vital interests. First-party product analytics is not used for cross-site or cross-platform profiling.

In practical terms, contract or pre-contract grounds cover accounts, requested evaluations, and support; legitimate interests may cover security, directory integrity, service improvement, and first-party analytics where permitted; legal obligations cover required records and requests; and vital interests are limited to emergencies. Any additional consent requirement for a future optional processing activity will be presented before that activity begins.

6. How information is shared

We may share limited information with infrastructure, managed database, private object-storage, identity, analytics, communications, professional-adviser, and security providers as needed for their functions. Google or GitHub may participate when their sign-in option is configured. When external analytics delivery is enabled, PostHog US Cloud receives the same bounded first-party product analytics fields as an analytics processor. Public pages load Google Ads tag AW-18459159949 so Google can process page views and related advertising identifiers to measure ad visits and conversions. Those signals stay outside Folkbench first-party product analytics.

If payments are enabled in the future, Stripe and relevant payment-method providers will process payment information under their own roles and notices. Folkbench does not currently accept live wallet top-ups through this Beta.

We may disclose information when required by valid legal process, to protect rights and safety, or as part of a corporate transaction subject to appropriate safeguards. We do not sell personal information or use raw evaluation evidence as public directory content.

7. Retention

We retain information only for as long as reasonably necessary for the purposes described here, including account operation, evidence integrity, security, disputes, audit, and legal duties. Retention depends on the record type, sensitivity, publication state, and applicable requirements.

Production collection of raw evaluation artifacts will not begin until artifact-specific retention, lifecycle, deletion, legal-hold, and joint database/object-storage recovery rules are approved. Published facts and audit records may remain longer than raw process evidence so changes can be explained.

8. International processing

Folkbench and its service providers may process information in the United States and other locations. Where required, Folkbench will use an applicable transfer mechanism and related safeguards. Provider locations and legal roles may differ by product and user location.

9. Security

We use measures designed to protect information, including transport encryption, server-only secrets, protected sessions, role checks, least-privilege service access, bounded logs, private raw evidence, and audited publication controls. No system is completely secure, and repository foundations or a successful health check are not proof of production security or recoverability.

10. Your choices and rights

Depending on applicable law, you may request information about processing, access, correction, deletion, restriction, portability, or objection, and may appeal certain decisions or complain to a data-protection authority. Where processing relies on consent, you may withdraw it at any time; withdrawal does not affect earlier lawful processing. Some requests may be limited by identity verification, evidence integrity, legal duties, or the rights of others.

To ask about first-party product analytics, object to related processing, or exercise an applicable right, submit a request through the contact page.

11. Children

Folkbench is a business and technical service and is not directed to children. Do not provide personal information through Folkbench if you are not old enough to consent to the relevant processing under applicable law.

12. Updates and contact

We may update this Policy to reflect changes in the service or law. The effective date appears above. Privacy requests may be submitted through the contact page; do not send identity documents, passwords, API keys, or raw private evidence in an initial email.

14. Retention details

  • Session and security records: while needed to keep an account and service safe, with expired session material removed on a bounded schedule.
  • Support, privacy, security, abuse, and correction cases: normally up to 24 months after closure, unless a dispute, legal duty, or security investigation requires longer.
  • First-party analytics events: a maximum target of 13 months, subject to deletion, suppression, and system limits.
  • Published facts and audit history: for as long as reasonably necessary to explain a public record, investigate integrity, and meet legal duties.
  • Raw evaluation artifacts: not collected in production at the effective date; any activation requires the artifact schedule described in the Testing and Data Processing Notice.

15. How to exercise rights

Submit a privacy request through the contact page and identify the account, organization, event, run, or case involved when safe. We may ask for information reasonably needed to verify the requester and may reject or limit a request when necessary to protect another person, a secret, evidence integrity, or a legal record.

Where a law sets a response period, we will respond within that period and explain any lawful extension or reason for refusal. You may ask for review of a refused request and may complain to the data-protection authority with jurisdiction over you.

16. California and other regional rights

If California privacy law applies, you may have rights to know or access categories and specific pieces of personal information, correct inaccurate information, delete information, limit certain sensitive-personal-information uses, and opt out of sale or sharing. Folkbench does not sell personal information. Google may receive page-view signals and advertising identifiers through the public Google Ads tag; where a law requires an opt-out, submit a request through the contact page. Folkbench does not discriminate for exercising a right.

Authorized agents may submit a request when applicable law permits and verification requirements are met. The categories, purposes, sources, and disclosures are described in this Policy; contact the support address for a request rather than sending identity documents in an initial email.

17. Incidents and automated decisions

If a security incident creates a notification duty, Folkbench will investigate, contain, document, and notify affected people, customers, regulators, or law enforcement as required by applicable law or contract. Do not treat a public status page as an incident notice.

Folkbench does not make decisions producing legal or similarly significant effects through solely automated processing. Rankings and publication decisions are bounded editorial or operational outputs with correction and review paths.

18. Controller contact and representatives

The responsible entity is Folkbench. Privacy requests and notices may be sent through the contact page or [email protected]. A data protection officer or regional representative has not been publicly designated for this Beta; if applicable law requires one for a future offering, Folkbench will publish the name and contact details before that processing begins.