Privacy Policy

1. Who We Are

This website is operated by Balaram Krishna (writing as Reid Carter), trading as Fintentive Press, Atlanta, Georgia, USA ("we," "us," or "our"). We are the data controller for personal information collected through storytaxindex.com (the "Site").

For all privacy inquiries, contact us using the details in Section 13.

2. Information We Collect

We collect the following categories of personal information, depending on how you interact with the Site:

• Identifiers. Email address, provided voluntarily when you join the waitlist, reserve a copy, submit a score, or sign up for the STI Tracker. We do not collect your name, postal address, phone number, or government-issued ID.
• Professional or employment information. Role category (e.g., CEO, CTO), organization size, and years in leadership, submitted as calibration inputs during the diagnostic. These are not linked to your identity unless you also provide an email address.
• Behavioral pattern data (anonymized). The anonymous signal block you copy from Microsoft 365 Copilot contains only intensity ratings and pattern flags — no meeting names, attendee names, company names, email content, or dates. We receive only what you choose to paste and submit.
• Internet or network activity. Standard request metadata (IP address, browser type, operating system, referring URL, pages visited, time of access) collected automatically by our hosting provider, Cloudflare. We do not independently log or process this data beyond what Cloudflare retains per its own policy.
• Inferences. We derive a Story Tax Index (STI) score and pillar breakdown from the anonymized behavioral data and calibration inputs you submit. This inference is displayed only to you and stored in your browser.

3. How We Use Your Information

We use the information we collect only for the following purposes:

• To deliver the diagnostic. Processing your signal block and calibration inputs to calculate and return your STI score.
• To communicate with you. Sending your score report, follow-up insights, weekly check-in prompts (if you subscribe to the STI Tracker), and product updates about The Story Tax. You may opt out of any email at any time.
• To improve aggregate benchmarks. Anonymized, de-identified signal block data is used in aggregate to improve cohort medians and pillar benchmarks. No individual is identifiable in this analysis.
• To operate and secure the Site. Maintaining service availability, detecting and preventing fraud and abuse, and complying with legal obligations.

We do not use your information for automated decision-making that produces legal or similarly significant effects without your knowledge or consent.

4. Research Use and Methodology Development

As the STI user base grows, submitted scores contribute to ongoing research aimed at improving the accuracy and usefulness of the diagnostic for everyone. This section explains exactly how that works, what we publish, and how to opt out.

What we use for research. We use de-identified, anonymized records — STI scores, pillar breakdowns, calibration inputs (role category, org size, tenure), and longitudinal check-in patterns — in aggregate to:

• Refine scoring weights and pillar thresholds as cohort data grows.
• Improve cohort benchmark medians by role, sector, and organizational size.
• Identify patterns in behavioral drag recovery — for example, which intervention sequences correlate with meaningful score improvement over 90 days.
• Validate and update the five-pillar framework as real-world usage surfaces new signal patterns.

What we do not use. Research analysis never includes email addresses, account identifiers, or any other information that could re-identify you. Records used in research are stripped of all identifiers before analysis. No individual's score or pattern is attributable to them in any published output.

What we publish. We may publish aggregate findings in the form of cohort reports, benchmark updates, or methodology notes — for example: "Median STI score across tech-sector CXOs improved 11 points over 90 days among users who completed all three Tracker check-ins." These publications describe populations, not individuals. We may also acknowledge the growing user base as a signal of adoption and credibility.

How research improves your score. Refinements to weights and benchmarks derived from research will be applied to the scoring model over time. This means your score may change slightly when you re-run the diagnostic after a model update — which is intentional, and a sign the methodology is improving. We will note material model updates in the site changelog.

Research use of de-identified data is recognized as a lawful purpose under the California Consumer Privacy Act (§1798.145(a)(4)), Virginia's Consumer Data Protection Act, and other applicable US state privacy laws.

5. Your Behavioral Data Stays on Microsoft's Platform

The diagnostic prompt runs entirely inside your Microsoft 365 tenant via Microsoft Copilot. Your calendar, email, and Teams data are read and processed by Microsoft's AI — they never pass through our servers. We receive only the anonymous signal block that you choose to copy and submit. We have no access to your underlying Microsoft data at any time.

6. Service Providers and Data Processors

We share data with the following third-party service providers that process data on our behalf. Each operates under its own privacy policy and, where applicable, a data processing agreement with us:

• Supabase — cloud database and authentication infrastructure. Stores email addresses, STI scores, and Tracker subscription records. Data is stored in US-based data centers.
• Resend — transactional email delivery. Receives your email address and email content (score reports, check-in prompts) solely to deliver messages on our behalf. Resend does not retain email content beyond delivery.
• Cloudflare — content delivery network (CDN), DDoS protection, and hosting via Cloudflare Pages. Processes network-level request data under Cloudflare's privacy policy.
• Microsoft 365 Copilot — processes the diagnostic prompt within your own Microsoft tenant. We are not a subprocessor of Microsoft; your Microsoft data does not flow to us.

We do not sell, rent, or share your personal information with any third party for their own marketing purposes.

7. We Do Not Sell Your Personal Information

8. Data Security

We implement reasonable technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit (TLS 1.2+) for all data transmitted between your browser and our servers.
• Encryption at rest for database records stored in Supabase.
• Access controls limiting personal data access to authorized personnel only.
• Row-level security policies on the Supabase database enforcing per-user data isolation.
• Cloudflare's DDoS protection and Web Application Firewall (WAF) at the network layer.

No method of transmission over the internet or electronic storage is 100% secure. If we become aware of a data breach that affects your personal information, we will notify you and applicable authorities as required by applicable law.

9. Data Retention

• Email addresses (waitlist / reserve): Retained until you unsubscribe or request deletion. We will honor deletion requests within 30 days.
• Email addresses (STI Tracker subscribers): Retained for the duration of your subscription plus 90 days, unless you request earlier deletion.
• STI scores and signal block submissions (linked to email): Retained while your account is active. De-identified after 12 months, or upon request. Linked records are deleted within 30 days of a deletion request.
• De-identified research records: Anonymized score records stripped of all identifiers may be retained indefinitely for research and methodology development purposes (see Section 4). They cannot be re-linked to any individual. If you opt out of research use, these records are excluded from all future analyses.
• Browser localStorage data: Stored locally on your device for up to 120 days. Never transmitted to our servers unless you submit a new score. You may clear it at any time via your browser settings (Settings → Site Data → storytaxindex.com).
• Server logs (Cloudflare): Retained per Cloudflare's data retention policies, which we do not control.

10. Cookies and Tracking

This site does not set first-party cookies. We do not use tracking pixels, fingerprinting, or third-party advertising cookies. We do not integrate with Google Analytics, Meta Pixel, or any behavioral advertising network.

Cloudflare may set a technical cookie (__cf_bm) for bot management purposes. This cookie does not identify you personally and expires within 30 minutes.

Browser localStorage is used — not cookies — to persist your STI score and session state locally on your device. See Section 9 for retention details.

11. Your Privacy Rights

Depending on your state of residence, you may have the following rights with respect to your personal information. To exercise any right, contact us at info@storytaxindex.com. We will respond within the timeframe required by applicable law (no later than 45 days for California residents; 45 days with one 45-day extension if needed for other states).

• Right to Know / Access. You may request a copy of the personal information we hold about you and information about how we use it (California, Virginia, Colorado, Connecticut, Texas, and other states).
• Right to Delete. You may request deletion of your personal information. We will delete it from active systems and direct our service providers to do the same, subject to limited legal exceptions (e.g., fraud prevention, legal compliance).
• Right to Correct. You may request correction of inaccurate personal information we hold about you.
• Right to Opt Out of Sale or Sharing. We do not sell or share personal information for advertising. No action is required to exercise this right.
• Right to Non-Discrimination. We will not discriminate against you for exercising any privacy right — including by denying services, charging different prices, or providing a degraded experience.
• Right to Limit Use of Sensitive Information. The behavioral pattern data (signal block) is anonymized prior to submission. If you believe any sensitive personal information was inadvertently included, contact us and we will delete that submission.
• Right to Opt Out of Research Use. You may opt your de-identified score data out of research and methodology development at any time. See Section 4 for instructions. Opting out does not affect your access to any site feature.

To unsubscribe from emails: use the unsubscribe link in any email we send, or email us directly. We will process opt-outs within 10 business days.

Authorized agents: California residents may designate an authorized agent to submit requests on their behalf. We may require verification of the agent's authority.

We do not discriminate against users who exercise their privacy rights under applicable state law.

12. Children

This Site is intended for senior business professionals. We do not knowingly collect personal information from individuals under the age of 13, consistent with the Children's Online Privacy Protection Act (COPPA). If you are between 13 and 18, please do not submit personal information without parental consent. If you believe a child under 13 has submitted data to this Site, contact us immediately and we will delete it without delay.

13. Contact

To submit a privacy request, report a concern, or ask questions about this policy, contact us at:

We do not have a designated Data Protection Officer. For matters involving EU/EEA residents' data under GDPR, please note that we do not actively target EU/EEA users and do not maintain an EU establishment or representative at this time.

14. Changes to This Policy

We may update this policy from time to time. Material changes — including changes to data categories collected, new third-party processors, or changes to your rights — will be communicated by updating the effective date at the top of this page and, where we have your email address, by direct notification. Continued use of the Site after the effective date of an update constitutes acceptance of the revised policy.

We recommend reviewing this page periodically. Prior versions of this policy are available upon request.