Privacy Policy

1. Introduction

Welcome to Get Causality ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Fuzzy Cognitive Mapping (FCM) analysis platform.

Who we are (data controller): Get Causality, LLC, a Delaware limited liability company with its registered office at 1209 Orange Street, Wilmington, DE 19801, USA, and principal place of business in Brighton, Massachusetts, USA. For privacy questions, contact [email protected]; our Data Protection Officer can be reached at [email protected].

2. Information we collect

2.1 Information you provide

• Account information: name, email address, password (encrypted)
• Research data: FCM models, survey data, analysis results you upload or create
• Payment information: credit-card details (processed securely by Stripe)
• Profile information: organization name, research interests, preferences
• Waitlist details: if you join the waitlist, your name, email address, organization, the plan tier you are interested in and your note about how you would use the platform

2.2 Automatically-collected information

• Usage data: pages visited, features used, time spent on platform
• Device information: IP address, browser type, operating system
• Performance data: error logs, load times, performance metrics (via Sentry; PII scrubbed before transmission)

3. How we use your information

• Provide services: process FCM analyses, store models, generate visualizations
• Improve platform: analyze usage patterns, identify bugs, enhance features
• Communication: account updates, feature announcements, security alerts
• Support: respond to inquiries, troubleshoot issues
• Security: detect and prevent fraud, abuse, security threats
• Legal compliance: comply with applicable laws and regulations

4. Data security (GDPR Art. 32)

We implement technical and organizational measures appropriate to the risk:

• Encryption at rest: all PII (email, name, IP, user agent) encrypted with AES-256-GCM authenticated encryption before database storage
• Encryption in transit: all data encrypted with TLS 1.2+
• Pseudonymization: survey response identifiers are pseudonymized; email lookups use HMAC-SHA256 hashes
• Password protection: passwords hashed with bcrypt; plaintext never stored
• Access controls: role-based, least-privilege; 2FA (TOTP) and passkey/WebAuthn support
• Session security: JWT tokens with HttpOnly + SameSite=Strict cookies; CSRF protection via HMAC-signed double-submit cookies; automated session cleanup after 90 days idle
• Audit logging: immutable, append-only security event logs with encrypted IP/UA fields; 2-year retention with tamper detection
• Rate limiting: per-endpoint limits (e.g. login: 10 attempts / 5 min)
• Content Security Policy: strict CSP headers, no inline scripts
• Data minimization: client-side PII filtering strips identifiable columns from survey data before any processing
• Regular assessments: periodic security scans and dependency audits

5. Special categories of personal data (GDPR Art. 9)

5.1 What constitutes special-category data

FCM surveys may collect demographic information that qualifies under Art. 9(1):

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Health data
• Data concerning sex life or sexual orientation

5.1.1 Cognitive profiling data

When a survey has FCM auto-generation enabled, individual cognitive models are derived from each respondent's answers. These models capture how a respondent perceives causal relationships between concepts, and can reveal views, opinions or beliefs the respondent holds. Article 9(1) does not list profiling as a category of its own; a model is special-category data specifically where it reveals a category Article 9(1) does list, such as political opinions or health. Because we cannot reliably tell in advance which individual models do that, we treat every one of them as special-category data under Article 9, the same protection given to information about health or beliefs. Surveys that generate individual cognitive profiles require explicit respondent consent before participation. No automated decisions are made from these profiles; they are used solely for aggregated scientific research.

Researchers may configure a FCM data retention period, after which PII (email, IP, etc.) is automatically stripped from responses while preserving the anonymized research data. Once de-identified, cognitive profiles are no longer linked to any individual.

5.2 Lawful basis for processing

Where special-category data is processed, we rely on Art. 9(2)(j): processing necessary for scientific or historical research purposes, with appropriate safeguards under Art. 89(1). Where applicable, we also rely on the explicit consent of data subjects obtained by the researcher (data controller) per Art. 9(2)(a).

5.3 Data controller vs. data processor

Get Causality acts as a data processor for survey response data. The researcher or organization that creates and distributes a survey is the data controller and bears primary responsibility for:

• Obtaining informed consent from survey respondents
• Securing IRB or ethics-board approval where required
• Complying with institutional data-governance policies
• Determining the lawful basis for collecting special-category data
• Ensuring respondents are informed of their rights

5.4 Safeguards for special-category data

• Client-side PII stripping: identifiable columns removed before data leaves the respondent's browser
• Encryption at rest: AES-256-GCM with per-record IVs
• No cross-survey linking: respondent data isolated per survey
• Data minimization: only data necessary for FCM analysis is retained
• Configurable retention: per-survey retention; expired data auto-purged
• Access restriction: response data accessible only to survey creator and authorized collaborators
• Browser-side analysis: for supported analyses, all computation happens in the researcher's browser. Survey data — including special-category demographics — never leaves the device.

5.5 Rights of survey respondents

Survey respondents can exercise the following rights through our Data Rights Portal, each self-service and verified by email:

• Access and portability (Art. 15, Art. 20): a structured export of the personal data we hold for your email address. Very large record sets are paginated: we include the 5,000 most recent survey responses and tell you when there are more, and up to 1,000 records from each other category.
• Rectification (Art. 16): correcting the contact details we hold about you, meaning your name and email on contact lists, invitation links, and the identity attached to your responses. The answers you gave in a survey are a record of what you said at the time, so they are not edited; if an answer is wrong, erasure or consent withdrawal removes the response instead.
• Erasure (Art. 17): removal of your identifying data from your survey responses.
• Restriction of processing (Art. 18): your responses stay stored but researchers can no longer include them in analyses, response lists, exports, or published results. This takes effect as soon as you confirm it from a link we email you, and lifting it requires confirming an emailed link as well, so nobody else can restrict or resume processing on your behalf.
  Three limits we want you to know about, because we would rather state them than let you assume otherwise.
  First, analysis on this platform runs inside the researcher's own web browser. If a researcher had already loaded a set of responses into a browser tab before your restriction was applied, that copy stays in their tab until they reload the page. We cannot reach into a page that has already been sent. Every fresh load excludes your responses.
  Second, a restriction cannot reach copies that have already left the platform, such as a spreadsheet a researcher exported last week. What we do instead is required of us by Article 19: when you restrict processing, we notify every researcher your data was disclosed to, tell them in writing to stop processing any copy they hold outside the platform, and give them the reference numbers they need to find it. We do the same when you correct your data, and again if you later lift the restriction.
  Third, a restriction covers the survey responses we hold for your email address when you confirm it. A response you submit later is not restricted automatically: to cover it, submit a new request after you have answered and confirm it from the link we email you. If we hold no responses for your address when you confirm, the confirmation says so and no responses are restricted.
• Objection (Art. 21): filing an objection on grounds relating to your particular situation. Article 21 requires us to weigh those grounds against whether we have compelling legitimate grounds to continue, so a person reviews each objection and we respond within one month rather than deciding it automatically.
• Withdrawal of consent (Art. 7(3)): in full, or for individual special-category (Art. 9) categories.
• Limiting use of sensitive personal information (CPRA § 1798.121), and appealing any request we refuse.

You may also contact the survey creator directly, or reach Get Causality at [email protected]. We assist data controllers in fulfilling subject requests per Art. 28(3)(e).

6. Your research data

6.1 Data usage

• Your research data is used solely to provide services to you
• We do not share your data with third parties without your explicit consent
• We do not use your research data for our own research

6.2 Data retention

Our canonical retention schedule is published at our retention schedule reference. Key periods:

• Active account data: retained as long as your account is active
• Waitlist entries: deleted 2 years after you join if you have not been given access. An entry that became an account is kept as the record of how that account got its beta access.
• Deleted account data: 30-day grace period (deletion cancellable via email link), then permanently cascade-deleted
• Backup data: Deleted data can remain for up to 30 days in two encrypted backup layers: Neon point-in-time recovery keeps 30 days of history, and each weekly database snapshot in Cloudflare R2 is deleted 28 days after it is taken. Backups are used only to restore the service. If we restore from a backup, we repeat every deletion made since that backup before the restored data is used.
• Survey responses: retained per the researcher's configured survey retention period (platform default 730 days for surveys created on or after 2026-09-14; earlier surveys with no period set are retained until the survey or the account is deleted); cognitive profiles (extracted_concepts) anonymized at the researcher's configured FCM-retention period
• Audit logs: retained for 2 years (24 months) from the event date for security and regulatory purposes. This retention applies even after account deletion, in accordance with GDPR Art. 6(1)(f) (legitimate interest in security) and Art. 32 (security of processing).
• Payment metadata: your subscription record and Stripe customer ID are deleted with the rest of the account cascade, 30 days after a deletion request. Tax and accounting records are held by Stripe under Stripe's own retention policy, not by us
• Breach records: retained indefinitely as required by GDPR Art. 33(5) and equivalent regulations
• You can request data export or deletion at any time

6.3 AI / LLM disclosure

Some Get Causality features use a small in-browser language model, served via WebLLM/WebGPU, to assist with FCM construction. We disclose the following:

• Which model runs: the app selects one automatically based on the graphics memory your browser reports, preferring the highest-quality model that fits. The candidates are Llama 3.2 3B, Gemma 2 2B, Qwen 2.5 1.5B, Llama 3.2 1B and Qwen 2.5 0.5B (all Instruct, 4-bit quantised). Two further models — Phi 3.5 Mini and Qwen 2.5 7B — are reachable only if you enable an experimental WebGPU flag in your browser. These are open-weight models published by Meta, Alibaba, Google and Microsoft respectively; we neither train nor host them.
• Where the model files come from: the model weights are downloaded directly by your browser from Hugging Face, a third-party host, the first time you use the feature, and are then cached locally. That request necessarily reveals your IP address and general request metadata to Hugging Face, in the same way visiting any website does. No survey data, text input, or account information is included in it. If you do not use the in-browser model features, no such request is made.
• Where it runs: entirely in your browser. Your text inputs are not sent to our servers, to OpenAI, to Anthropic, to Hugging Face, or to any other third-party LLM provider as part of this feature.
• What it produces: suggested concept names and causal-edge candidates. Outputs are advisory — every concept and edge must be reviewed by you before being used in research outputs.
• Limitations: these models are small and have light safety training, and adversarial prompts can coax them into off-task or unsafe outputs. Each week we run automated adversarial tests of this feature's prompt designs against Llama 3.2 3B, the first-choice model, using a different build from the one your browser runs. The other candidate models, including those used on devices with less graphics memory, are not adversarially tested. Treat any unexpected concept names with skepticism. Our threat-model review for this feature is documented at docs/runbooks/LLM_THREAT_MODEL.md in the source repository.
• Optional local LLM: users may opt to use a local Ollama (opens in new tab) backend on their own machine for higher-quality extraction, bridged via our browser extension. This is also local — no third party — and only used when the user explicitly configures it. See the extension's own privacy policy at Get-Causality.com/extension/privacy for details on the bridge's data handling.
• No automated decisions about you: the LLM features do not make decisions about survey respondents. They only assist the researcher in modelling the structure of their own input text.

7. Third-party services

The current sub-processor list is maintained at /subprocessors. We provide 30 days advance notice of material changes.

• Vercel: application hosting (frontend CDN + serverless API functions). Vercel is the compute host, so personal data is present in plaintext in function memory while a request is handled, and Vercel Edge derives coarse geolocation from your IP. Nothing is persisted at Vercel. Vercel also provides Vercel Analytics and Speed Insights, cookieless usage and performance measurement, loaded only on the dashboard and AI-sandbox pages, only after you grant analytics consent, and never if Do Not Track or Global Privacy Control is on; it sees your IP address and page/performance data as an ordinary part of serving the request, with no identifier stored.
• Neon: PostgreSQL database hosting (PII encrypted at the application layer with AES-256-GCM before reaching Neon)
• Cloudflare: edge protection — Web Application Firewall (WAF), DDoS mitigation, bot management (Turnstile), TLS termination. No persistent storage of user data. Separately, Cloudflare R2 (object storage, a different Cloudflare product) holds our encrypted weekly database backups for up to 28 days; see Backup data below.
• Google: Google OAuth sign-in only, where your email address and display name are read at the authorization callback. No survey content or respondent data is shared. Until 2026-09-16 Google also performed bot detection on public form submissions via reCAPTCHA Enterprise, which sent assessment tokens and exposed your IP to Google; that was removed and replaced by Cloudflare Turnstile, so a survey submission now reaches Google not at all.
• GitHub (Microsoft): GitHub OAuth sign-in as an optional account authentication method. We read your verified primary email address and GitHub username at the authorization callback; no respondent or survey data is shared. Separately, our weekly database backup job runs on GitHub Actions: the database export exists unencrypted only briefly on that runner's disk, and that plaintext copy is deleted before the encrypted version is uploaded to Cloudflare R2.
• Stripe: payment processing for paid plans. When a Stripe customer record is created we send your email address and internal user ID; Stripe collects your billing address and tax ID directly at checkout. We never store card details.
• Resend: transactional email delivery
• PostHog: two distinct uses — (1) anonymous usage analytics, only loaded with explicit consent; (2) server-side security telemetry under legitimate interest (Art. 6(1)(f)) for fraud and intrusion detection — tagged with category=security, never including email, IP, or response contents.
• Sentry: error monitoring and performance tracking, including session replay on a sample of sessions (10% of ordinary sessions, all sessions that hit an error). Replay is configured to mask all on-screen text and block all media before anything leaves your browser, so recordings carry page structure and interaction timing, not the words or images you saw. PII is scrubbed via a beforeSend hook before transmission. Frontend Sentry is consent-gated (loads only with analytics consent and respects Do Not Track); backend Sentry runs for production reliability.

Some pages, including public and respondent survey pages, load JavaScript libraries, stylesheets or fonts directly from content-delivery networks (jsDelivr, cdnjs, unpkg.com, and Plotly's CDN). Requesting a file from one of these networks reveals your IP address and standard request metadata to it, the same way visiting any website does; no survey content, responses or account data are sent to them.

8. Cookies and tracking

We use two categories of cookies, each requiring separate consent:

• Functional (required): auth tokens, CSRF, session, dark mode
• Analytics (optional): PostHog anonymous usage analytics; only loaded after explicit consent

We do not use marketing or advertising cookies. See the Cookie Policy section 4 for details.

Manage your cookie preferences at any time. See the Cookie Policy for details.

9. Your rights (GDPR & CCPA / CPRA)

• Access: request a copy of your personal data
• Rectification / Correction: correct inaccurate or incomplete data
• Erasure / Deletion: request deletion of your personal data
• Portability: export your data in a machine-readable format
• Objection: object to processing
• Restriction: restrict how we process your data
• Withdraw consent: where processing is based on consent, you may withdraw at any time (Art. 7(3)), in full or for specific special-category (Art. 9) topics only. Manage this via the Data Rights Portal.
• Complaint: lodge a complaint with your local data-protection supervisory authority (Art. 77).
• Non-discrimination: we will not retaliate against you for exercising any of these rights.

Exercise these rights at [email protected]. We respond within 14 days for routine requests (regulatory deadlines: 45 days under CCPA / CPRA; one month under GDPR / UK GDPR, extendable as the applicable law permits).

9a. California residents — CCPA / CPRA rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following additional rights:

• Right to know the categories and specific pieces of personal information we have collected about you in the past 12 months, the sources, the purposes, and the categories of third parties with whom we have shared it.
• Right to delete personal information we have collected from you, subject to exceptions (e.g., to complete a transaction, detect security incidents, comply with legal obligations).
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. We do not sell or share your personal information as those terms are defined under Cal. Civ. Code § 1798.140. To confirm our non-sale practices or to direct us never to sell or share your information in the future, use the link below.
• Right to limit the use and disclosure of sensitive personal information. The platform may process "sensitive personal information" under CPRA when survey respondents provide special-category data through researcher-administered surveys. You may direct us to limit the use of such information to that necessary to provide the service. Manage this via the Data Rights Portal or contact [email protected].
• Right to non-discrimination for exercising any of these rights.

Do Not Sell or Share My Personal Information

Authorized agents may submit requests on your behalf with verifiable written permission. Contact [email protected] for the authorized-agent process.

Lawful basis for processing (GDPR Art. 6)

• Account data (name, email): contractual necessity — Art. 6(1)(b).
• Analytics data: consent — Art. 6(1)(a).
• Security data (encrypted IP, audit logs): legitimate interest — Art. 6(1)(f).
• Survey research data (special categories): scientific research — Art. 9(2)(j).
• Improve platform (usage patterns, bug identification, feature development): legitimate interest, Art. 6(1)(f), in keeping the service secure and working.
• Communication: account updates and security alerts are contractual necessity, Art. 6(1)(b), because they are part of operating the account you hold; feature announcements are legitimate interest, Art. 6(1)(f), in telling existing users about changes to the service they use.
• Support (responding to inquiries, troubleshooting): contractual necessity, Art. 6(1)(b), as part of providing the service.
• Legal compliance: legal obligation, Art. 6(1)(c).
• Waitlist: steps you ask us to take before a contract, Art. 6(1)(b): handling your request for beta access and your founding rate, and emailing you about it. We send the waitlist no marketing unless you separately opt in.

10. Children's privacy

Our platform is not intended for users under 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us immediately.

Researchers may not use the platform to survey anyone under 18. Our Terms of Service (section 4.2) make each researcher responsible for ensuring that every respondent is 18 or older.

11. International data transfers

Your data may be processed in the United States and other countries. We rely on the following transfer mechanisms, in order of priority:

• From the EEA to the U.S.: EU-U.S. Data Privacy Framework where the relevant sub-processor is certified; otherwise, Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914, in the module matching our role for the data: Module 2 (controller-to-processor) for account and platform data, where we are the controller; Module 3 (processor-to-processor) for survey response and respondent data, where the researcher is the controller and we are a processor.
• From the UK to the U.S.: UK Extension to the EU-U.S. Data Privacy Framework under the UK Data Protection (Adequacy) (United States of America) Regulations 2024 where applicable; otherwise, the UK International Data Transfer Addendum (IDTA) issued by the Information Commissioner.
• From Switzerland to the U.S.: Swiss-U.S. Data Privacy Framework where applicable; otherwise, the SCCs adapted for Switzerland per FDPIC guidance (Switzerland as the Member State; FDPIC as the supervisory authority; Swiss FADP as the applicable law).

A current Transfer Impact Assessment is available on request at [email protected].

12. Changes to this policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or platform notification before they take effect. This notice is a statement of our practices, not a contract, so continuing to use the platform does not itself signify your acceptance of a change; where a change requires your consent under applicable law, such as a new use of special-category data, we will ask for it separately.

13. Academic and research use

14. Beta-testing specifics

• We may collect additional feedback and usage data to improve the platform
• Platform features and data handling may change
• We will notify beta testers of significant changes
• Beta testers can request data deletion at any time

15. Contact us

• Email: [email protected]
• Support: [email protected]
• Address: Get Causality, United States

16. Data Protection Officer

For GDPR-related inquiries, contact our DPO at [email protected].

Cookie settings

Manage your cookie preferences at any time:

Manage cookie preferences

View sub-processor list →