Privacy
Who sees what, how long we keep it, and what we do not use it for.
This policy explains how Closing Foundry collects, uses, shares and retains data connected with Growth Score. It distinguishes company assessment data, institution-supplied contact data and messages sent through the contact form.
Last updated: 16 August 2026. Status: pending legal review.
1. Who we are
Growth Score is a measurement standard published and operated by Closing Foundry Ltd, registered in England and Wales, company number 14629519. Closing Foundry Ltd is the data controller for the assessment data described in this policy, subject to the controller and processor arrangements set out below.
Privacy contact: [email protected], or by post to Closing Foundry Ltd, 167-169 Great Portland Street, London W1W 5PF. ICO registration: application in progress; the registration number will be published here when issued.
2. What we collect
| Source Data collected Purpose | ||
|---|---|---|
| Company completing the assessment | Answers to the instrument, company name, sector, revenue band, business contact name and email | address To calculate the company's result and send it to the company |
| Institution inviting a cohort | Business contact details for companies it asks us to contact | To send invitations and reminders under the institution's instructions |
| Person using the contact form | Name, organisation, email address and information supplied in the message | To respond to the enquiry. The form sends the message to Closing Foundry through Web3Forms; the message is not stored by this site |
| Site visitor, if analytics is turned on | Pages viewed, referring page, approximate location derived from IP address, device, browser and operating system. Microsoft Clarity also records mouse movement, clicks and scrolling. Text typed into form fields is masked before it leaves the browser | To see how the site is used and where it is unclear. Lawful basis: consent, given through the cookie settings on this site and withdrawable at any time. Nothing is collected unless consent is given |
Growth Score does not require financial records, customer data or access to a data room. The assessment records the company's own account of how it operates.
Lawful bases. The assessment is based on consent given when the company completes it. Closing Foundry relies on legitimate interests when it operates and improves the instrument, where that basis applies. Where an institution supplies contact details for cohort invitations, the controller and processor responsibilities must be documented and followed for that activity.
3. Who sees what
The table below explains what each party can see and what remains unavailable to it.
| Who | What they can see | What they cannot see |
|---|---|---|
| Company completing the assessment | Its own full result, free of charge, for as long as the published retention policy permits | Any other company's result |
| Institution licensing reporting | Aggregate reporting for its own cohort. Per-company results only where the company has given the required consent Results | about companies outside its cohort, or individual results where the company has not consented to that sharing |
| Support provider engaged by a company | Only the information the company chooses to share when it accepts the indicated support route | The company's result, unless the company shares it |
| Person checking | a result reference If the verification service is deployed, the reference's validity, method version, date taken, current status and evidence level | The score, company name and answers, unless a separate share expressly provides them |
Before a result is shared, the company is told what will be shared, with whom and for what purpose.
4. What we do not do with company data
- We do not sell, broker, rent or trade company data.
- We do not share a company's result with an institution unless the company has consented to that sharing.
- Growth Score is not used, and must not be supplied for use, as a credit, lending, affordability, pricing, insurance, eligibility or employment decision.
- The assessment and the result are free to the company. No charge is made at any stage.
- Payment does not alter a score or the indicated constraint. If a support provider pays to appear in a routing directory, that payment can affect which provider is listed within a category already indicated by the result. Closing Foundry and affiliated providers are identified as such.
- No generative model is used in the scoring calculation for method v1.4. The score is calculated from the published rules.
5. How long we keep data and where it is processed
| Data category | Retention and processing position |
|---|---|
| Assessment results | Retained for up to 24 months from submission so a company can retake the assessment and review movement over time, and longer where the company keeps an active account for rescoring or an institutional agreement requires it. Deleted on request, subject to applicable legal or contractual retention duties. Deletion is carried out manually on request; there is no automated purge. Register entries (reference, method version, dates and status) are retained as the permanent record of a result and contain no personal data. |
| Contact details supplied by an institution | Returned or deleted within 60 days after the relevant agreement ends, unless a longer period is required by law or agreed in writing. |
| Hosting of this site | The published site is a set of static files hosted on GitHub Pages (GitHub, Inc.) and served from a global content delivery network. Domain records are managed through Cloudflare. The assessment runs in the browser and sends no answers to this site. Stored assessment data is held on Supabase infrastructure in AWS Europe (Ireland), region eu-west-1, within the EEA. |
| Recipients and sub-processors for this site | Web3Forms sends contact-form messages to Closing Foundry by email. The contact-form data is not stored by this site. GitHub, Inc. hosts and serves the published pages. Google LLC serves the web font, and provides Google Analytics where consent is given. Microsoft Corporation provides Clarity where consent is given. Microsoft and Google are outside the UK and hold analytics data under their own published retention periods. For the assessment instrument itself, which runs separately from this website: Supabase provides the database, authentication, storage and application functions, and is the primary processor of assessment data. Lovable provides the application platform and sends transactional email. Firecrawl fetches publicly available company information for enrichment. None of these receives data from this website. |
| Aggregate and anonymised data | May be retained for instrument development and aggregate reporting. It must not identify a company or an individual. |
6. Your rights
Under UK data protection law, you may ask us for a copy of your personal data, to correct or delete it, to restrict or object to its use, or, where the right applies, to have it transferred elsewhere. Where we rely on consent, you may withdraw that consent at any time.
To exercise a right, contact the privacy address published above. We will respond within the period required by applicable law. If you are not satisfied with our response, you may complain to the Information Commissioner's Office at ico.org.uk.
7. Cookies and third-party requests
Nothing that requires consent is stored on your device, or read from it, before you choose. The cookie settings appear on your first visit and the link is in the footer of every page.
Measurement, consent required, off unless you turn it on. Microsoft Clarity records mouse movement, clicks and scrolling, and sets _clck for one year and _clsk for one day, with further cookies set by Microsoft on clarity.ms. Google Analytics counts visits and pages, and sets _ga and _ga_ZZZ07MC1P4 for two years and _gid for one day. Each can be turned on independently of the other. Neither receives assessment answers, scores or results.
Appearance, no consent required, objection available. fac16sig records that the home page animation has played so that it does not repeat. It is session storage, it is cleared when the tab closes, and nothing leaves the browser. This falls within the appearance exception in Schedule A1 to PECR, so it is on by default. You can object to it in the cookie settings, in which case the animation plays each time.
Necessary, no consent required. cc_consent stores the choice you make and is kept for six months in local storage. Without it we cannot honour a refusal on the next page you open.
Third-party requests without storage. The site loads a web font from Google Fonts, which sends a request to Google's servers. It sets no cookie.
Changing your mind. Use Cookie settings in the footer. Turning something off stops further collection immediately and clears the cookies this site is able to clear. Cookies set by Microsoft or Google on their own domains may persist until they expire. If you want Microsoft or Google to delete what they already hold, contact us and we will pass the request on.
How long consent lasts. We ask again after six months, in line with the Information Commissioner's guidance on storage and access technologies. Your choice, and the date you made it, is shown to you inside the cookie settings panel. We do not keep a copy of it on a server, because this site has none.
8. Changes to this policy
We will record material changes to this policy here with a new effective date. Where an institution has a live agreement, we will notify it in accordance with that agreement.