Privacy Policy
We collect the minimum necessary to operate. No analytics, no advertising, no tracking pixels, no data sale. This policy explains what that means in practice.
The short version. The site runs without cookies, analytics, ads, or trackers. The self-assessment and risk calculator run in your browser — your inputs are not transmitted. We only collect data when you email us or submit an application. We never sell data. We delete when asked.
1. Who we are
The Emotional Integrity Index is operated by The Blue Algorithm LLC ("we," "us," "our"). The data controller for personal information processed in connection with the site and services is The Blue Algorithm LLC.
Contact: hello@thebluealgorithm.com
2. What this policy covers
This policy applies to the EII website, the self-assessment tool, the risk calculator, and correspondence with us in connection with applications, comments, submissions, or general inquiry. It does not cover third-party sites we link to; their policies apply to their sites.
3. What we collect — and what we don't
Browsing the site
When you visit the site, our hosting provider (Netlify) may receive standard server-level information: IP address, user-agent string, request path, and timestamp. This is standard web infrastructure. We do not set analytics cookies, advertising cookies, social media tracking pixels, or any fingerprinting scripts. No third-party analytics service receives your visit.
Self-assessment and risk calculator
The self-assessment and risk calculator run entirely in your browser using JavaScript. Your inputs and results are not transmitted to us, are not stored on any server, and are discarded when you close the page. We do not know what anyone scored.
Email and applications
When you email us — to apply to the Charter Cohort, submit a public comment, report an incident, file an appeal, or any other reason — we receive whatever information you include: your name, email address, message content, and any attachments. We process this information to respond to you and to operate the standards body.
Certification engagements
Where an organization engages us for certification review, we collect the information reasonably necessary to conduct the review, as set out in the engagement letter. This may include product documentation, internal policies, designs, source code extracts, testing evidence, and points of contact. Handling of this material is governed by the engagement letter, including confidentiality terms.
What we do not collect
- We do not use Google Analytics, Meta Pixel, TikTok Pixel, or any similar analytics or advertising service.
- We do not run A/B testing that profiles individual users.
- We do not build a mailing list from site visits.
- We do not collect sensitive categories of data except where specifically required for a complaint or appeal and you choose to provide it.
- We do not use AI systems to process site visitors' inputs (the tools are deterministic rule logic).
4. Why we process data (legal bases)
Where applicable data protection law requires a legal basis, we rely on:
- Legitimate interest — operating the standards body, responding to inquiries, maintaining the integrity of the certification process, pursuing public-interest work on emotional and ethical safety in digital products.
- Contract — where you are a Charter Cohort member or other engaged party, to deliver the services agreed.
- Consent — where you explicitly consent, such as giving permission to publish a submitted case under your name.
- Legal obligation — where required by law, regulation, or court order.
5. Cookies
We do not set tracking, analytics, or advertising cookies. The site may use minimal technical session-state storage (browser localStorage) only to remember non-personal UI preferences such as whether you have opened the mobile menu. No personal data is stored in cookies or local storage.
6. Sharing
We do not sell, rent, or trade personal information. We do not share it with advertisers or data brokers. We share it only:
- With service providers acting on our behalf (e.g., hosting, email) under contract terms that restrict their use of the data to providing the service.
- With reviewers conducting a certification review under applicable confidentiality terms.
- Where required by law, legal process, or to protect the rights, safety, or property of The Blue Algorithm LLC, our users, or the public.
- In connection with a merger, acquisition, or sale of assets, subject to equivalent protection.
7. International transfers
We operate from the United States. If you are outside the U.S., your data will be processed in the U.S. We use standard contractual safeguards where required by applicable law (e.g., Standard Contractual Clauses for transfers from the European Economic Area or the United Kingdom).
8. Retention
We keep correspondence as long as operationally relevant and then delete it. Specifically:
- Unsuccessful applications: deleted within 90 days of decision.
- General inquiries: deleted within 12 months.
- Engagement correspondence for certified products: retained for the duration of certification plus 7 years, to support audit and appeal.
- Records required by law, tax, or regulatory obligation: retained for the period required.
9. Your rights
Depending on where you live, you may have rights under laws including the EU GDPR, UK GDPR, California CCPA/CPRA, and other state and national laws. These typically include:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data, subject to legal retention requirements.
- Objection / restriction — object to or restrict certain processing.
- Portability — receive your data in a portable format.
- Withdraw consent — where processing is based on consent.
- Non-discrimination (CCPA/CPRA) — we will not retaliate for exercising privacy rights.
- Complaint — lodge a complaint with a supervisory authority (e.g., your EU/UK Data Protection Authority, or California Privacy Protection Agency).
To exercise any right, email hello@thebluealgorithm.com. We will verify your identity before acting and respond within the time frame required by applicable law.
10. Children
The site and services are intended for professionals and are not directed to children under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.
11. Security
We use reasonable and appropriate technical and organizational measures to protect personal data, including TLS for site traffic, access controls on internal systems, and data minimization. No system is perfectly secure; if a breach affects your data and the law requires notification, we will notify you.
12. Do Not Track and Global Privacy Control
We honor Global Privacy Control (GPC) signals as an expression of preference against tracking. Because we do not track, fingerprint, or sell data, GPC does not change how we process your data — but we will continue to respect it as standards evolve. We do not respond to the older, ambiguous "Do Not Track" browser signal.
13. Changes
We may update this policy. Material changes will be posted on this page with a new effective date. If changes are significant, we will take reasonable steps to notify affected users (for example, by email to engaged parties).
Last updated: 22 April 2026. Version 1.0.