Home / Privacy
Privacy
Who we are. CONGRUENT AI LTD, registered in England and Wales, company number 17300191, registered office 5th Floor, 167–169 Great Portland Street, London W1W 5PF. We are registered with the Information Commissioner's Office, registration C1967410. Contact: hello@congruentindex.com.
What this notice covers. When a company buys a Congruent report, we run its survey and interviews on that company's behalf: for that data the company is in control and we act for it, under our data processing agreement, and the people taking part get our participant notice with every invitation. This page covers the personal data we decide about ourselves.
If you buy from us. We keep the details you give us on the order form and for invoicing — your name, role, company, company number, work email address, billing address and any PO number — to make and carry out the contract with your company, to invoice and to keep the records the law requires. We do this because it is in our legitimate interests to contract with your company, and because the law requires some of these records. Card payments are handled by Stripe; your card details never reach us. Invoices and accounting records are kept for as long as the law requires.
When a company signs our order form, online on this site or through DocuSign, we keep the record of the signature — the signed order form, Website Terms and data processing agreement, and the record of signing, which shows the name, role, company and work email address of each person who signed, their confirmation that they were authorised to sign, a fingerprint (hash) of the documents they signed, the IP address recorded and the time of each signature — for six years after the order, and then delete it.
If you are interviewed. Before an interview we ask whether you agree to it being recorded and to anything you say being quoted. We keep the record of what you agreed, so that we can show it was asked and answered, for six years after the interview, the period in which a claim about it could be brought (Limitation Act 1980, section 5), and then delete it. We keep this record ourselves, as a controller.
If you book a call. Our booking page is run on Google Workspace. When you book, Google and we receive your name, email address, company, the time you chose and anything you write in the booking form, and the call is held on Google Meet. We use this only to hold the call and follow it up, because it is in our legitimate interests to answer your enquiry. If you do not go on to buy from us, we delete it twelve months after the call. If you are booking one of the two interviews in a company's report, your booking is part of that report and is deleted sixty days after the readout.
Our aggregate statistics. From a client's report we derive a few company-level scores — the alignment indices, the profile bands including the company's region, the five factors with its largest gaps (by reference only), how many of its stated priorities appear in its leaders' top three and, if the company gives it, its margin band — and keep them in our results register to produce statistics across companies. We keep a row for every report, however it was bought: on this site, through a signed order or through a partner programme. We do this ourselves, on our legitimate interests in publishing aggregate statistics, not on the client's instruction. The scores are derived only from groups large enough to be reported and carry no individual's answers, name, email address or reference. No company is ever named, nothing is published until at least five companies sit behind it, the number of companies is shown with every figure, and each company counted had at least three of its leaders and five people in the layer below reply. Twelve months after the readout we delete the link between the company and its statistics reference. A company can opt out on its order form, at onboarding or by email, at any time.
If you visit this site
Information collected automatically
- Usage and device data — only if you accept cookies. Two tools do this, and neither runs until you choose Accept on the cookie banner. HubSpot, our CRM, records pages viewed, approximate location derived from your IP address, and browser and device type, and links an enquiry to the visits that preceded it. PostHog, hosted in the EU, records how the site is used — including session replay, described under Cookies below.
- Aggregate analytics via Vercel Web Analytics, which is privacy-friendly, does not use tracking cookies and does not identify you. This one runs whether or not you accept.
Cookies and similar technologies
We ask before we set anything that is not strictly necessary. Until you choose Accept on the banner, none of the cookies below is set and neither analytics tool runs. If you choose Reject, we also clear any of these cookies your browser is already carrying. You can change your mind at any time using the Cookie choices link in the footer, or by clearing this site's data in your browser settings; either brings the banner back.
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
__hstc | HubSpot | The main visitor-tracking cookie — records the domain, a visitor token, timestamps and the session number | 6 months |
hubspotutk | HubSpot | Identifies your browser so an enquiry you send can be matched to the visits that preceded it, and so duplicate contact records can be merged | 6 months |
__hssc | HubSpot | Tracks the current session and the number of pages viewed in it | 30 minutes |
__hssrc | HubSpot | Records whether you have restarted your browser | End of the browsing session |
ph_<project key>_posthog | PostHog | Distinguishes one visitor from another and links the events in a single visit, so we can see how the site is used | 365 days |
A cookie is set before you choose, and it is not ours. The contact page loads
HubSpot's booking and form scripts through a content-delivery network operated by Cloudflare.
Cloudflare sets __cf_bm on its own domains — one for each HubSpot service the page
reaches — to tell human visitors from automated ones. It expires after about 30 minutes, cannot
be read by this website or by any script running on it, and is not used to build a profile of
you or to follow you across other sites. It is set because the page loads, not because you
accepted, and rules in the UK treat security cookies of this kind as strictly necessary, so they
do not require consent. It is a separate matter from the Cloudflare entry in the table further
down this page, which covers our own domain and email routing.
Session replay. PostHog also stores analytics data in your browser's local storage alongside its cookie, and — because session replay is switched on — records your interactions with these pages: mouse movement, clicks, scrolling, and the pages you move between. We use it to find where the site is confusing. Recording only ever starts after you accept, the recordings are hosted in the EU, and we do not use them to identify you personally. Rejecting the banner, or clearing this site's data, stops it.
How long your choice lasts. Whichever button you press, we record the choice and the date it was made in your browser's local storage, and we act on it for twelve months. After that we ask again, because consent given a long time ago is not good evidence of what you want today. You do not have to wait for us to ask: the Cookie choices link in the footer of every page brings the banner back whenever you want it, and clearing this site's data has the same effect. Nothing about the choice is sent to us or stored on our servers — it stays in the browser you made it in, so a different browser or device will ask you again.
Vercel's analytics is cookieless and needs no consent. Blocking cookies in your browser settings will not stop you using the site, booking a call or sending us an enquiry.
Our booking calendars. On /book and /interview, Google's appointment calendar is shown inside our page, so you can book without leaving the site. The calendar is Google's, on Google's own domain, under Google's terms; when it loads, Google may set its own cookies to run the booking.
Paying online. On our payment page, Stripe's payment form loads from Stripe (js.stripe.com) so that your card details go straight to Stripe and never reach us. Stripe sets cookies to prevent fraud; they are strictly necessary for paying and so do not need consent.
Who else handles it, your rights and complaints
Who else handles it. The providers we use for our clients' surveys, what each handles, where and under what transfer safeguard are listed on our sub-processor register: congruentindex.com/sub-processors. Where a provider is outside the UK, a UK transfer safeguard applies. We do not sell personal data, and nothing you give us is used to train an AI model.
Your rights. You can ask us for a copy of your personal data, and ask us to correct it, delete it, restrict how we use it or move it, and you can object to any use we base on our legitimate interests. Email hello@congruentindex.com. If your request is about a client's survey, we pass it to that company and help it answer.
Complaints. If you are unhappy with how we have handled your personal data, tell us at hello@congruentindex.com. We acknowledge every complaint within 30 days, look into it, and tell you what we have found and done without undue delay. If you are still not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes. We will post any change to this notice here, with its date. Last updated: 17 October 2026.