Privacy Policy

1. Who is responsible for your data

Board Insight Studio is a product of Museum Crafters LLC (“we,” “us,” “our”), based in Charleston, South Carolina. We are the controller of the personal information collected through our website and services.

2. What we collect

Information you provide

• Account and contact information: name, email address, organization, and role (such as Board Chair, Treasurer, CEO).
• Assessment responses: your answers to the 120 Big Five assessment items.
• Payment information: processed by Stripe. We receive a confirmation of payment and basic billing information, but we do not store your credit card number.
• Communications: emails you send us, feedback, and support requests.

Information collected automatically

• Usage data: pages visited, time spent, referring site, and similar technical information.
• Device and browser information: browser type, operating system, and IP address (used to ensure security and basic analytics).

Our website uses minimal cookies necessary for the service to function. We do not use advertising or tracking cookies, and we do not use third-party analytics services that track individual users across the web.

3. How we use your information

We use the information we collect to:

• Administer your assessment, generate your personalized report, and produce the collective Board Dynamics Report for your organization’s designated leadership.
• Communicate with you about your assessment, invitations, reminders, and results.
• Process payments and manage your account.
• Improve the assessment, the reports, and the website, using aggregated, de-identified data only.
• Comply with legal obligations and protect the security and integrity of the service.

Use of anonymized, aggregated data for research and publication

Board Insight Studio may use anonymized and aggregated assessment data for research, academic publication, book chapters, conference presentations, and professional articles about nonprofit board governance and personality dynamics. When we use data in this way, we follow three rules:

• Data is always aggregated across many participants and organizations. We never publish or present an individual’s results, or an identifiable organization’s board profile.
• We require a minimum sample size (typically 30 or more responses) before any finding is published, so no individual can be reverse-identified from a small dataset.
• Organization names, participant names, email addresses, and any other identifying information are removed before the data enters any research dataset.

This work is conducted in collaboration with Dr. George Watts and Laurie Blazek, the framework co-developers, and is intended to advance understanding of nonprofit governance. If you would like your assessment data excluded from aggregated research, email us before taking the assessment or within 30 days of completion, and we will flag your record as research-excluded.

4. Who can see your individual results

This is the most important question for a personality assessment product, and we want to be direct:

• You see your full individual report.
• No other board member or staff member sees your individual results.
• The Board Chair and CEO (or other designated leadership of the purchasing organization) see only the aggregated Board Dynamics Report. They see each member’s name, top two trait labels, and Leadership Signature nickname. They do not see the numeric scores or the detailed narrative content of your individual report.
• The BIS facilitator conducting your leadership debrief session sees the same aggregated view that the Board Chair and CEO see, so the facilitator can interpret the results.

We do not sell, rent, or share individual assessment results with any third party. We do not use your results for targeted advertising. Anonymized, aggregated data may be used for research and publication as described in the section above.

5. Service providers we use

We rely on a small number of trusted third parties to operate the service:

• Stripe processes payments. Stripe has its own privacy policy and uses standard payment-card-industry security.
• Netlify hosts our website and the assessment application. Netlify provides infrastructure hosting and does not access assessment content.
• Namecheap provides our domain registration and business email.
• Formspree (or an equivalent form-handling service) delivers completed assessment results to Board Insight Studio for report generation.

Each of these providers is contractually obligated to protect the data we share with them and to use it only for the purposes of providing their service.

6. How long we keep your data

We keep your assessment responses and report data for as long as your account or engagement is active, and for a reasonable period afterward to support the Board Chair and CEO’s reference to the report and any follow-up discussions. Our default retention period is 24 months from the date of assessment completion.

You may request deletion of your individual data at any time by emailing us (see below). Deletion of an individual’s data may remove that member from the collective Board Dynamics Report.

7. Your rights

Regardless of where you live, you may:

• Request a copy of the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Opt out of aggregated research use of your anonymized data (see Section 3)
• Unsubscribe from BIS marketing emails. We send very few, and each includes an unsubscribe link.

If you are in a jurisdiction with additional privacy rights (such as the European Union under GDPR, or California under CCPA), you have additional rights under those laws. Contact us using the details below and we will respond promptly.

8. Data security

We use commercially reasonable safeguards to protect your information, including encrypted connections (HTTPS) throughout our site, secure cloud hosting, and limited internal access to assessment data. No system is perfectly secure, but we take data protection seriously and will notify you promptly if we become aware of a breach affecting your personal information.

9. Children’s privacy

BIS is designed for adult nonprofit board members, executives, and senior staff. The service is not intended for and is not offered to children under the age of 18. We do not knowingly collect personal information from anyone under 18.

10. International users

BIS is operated from the United States. If you access the service from outside the U.S., your information will be transferred to, stored in, and processed in the United States. By using the service, you consent to this transfer.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we’ll update the “Last updated” date at the top of this page. For material changes affecting how we use your data, we’ll provide reasonable notice to account holders by email before the changes take effect.

12. How to reach us

For any privacy question, concern, or request, email:

karen.coltrane@boardinsightstudio.com

We aim to respond to all privacy requests within 10 business days.