Agency addendum · not the marketing privacy page
Participant data for a Scale cohort.
The public privacy policy is general. This addendum is what HR, privacy, and counsel should file with a $14,500 order. If they conflict on roster ownership or deletion, this addendum controls for that order.
What is collected
| Category | Examples | Required? |
|---|---|---|
| Identifiers | Employer Worker ID the agency types (not SSN, not a legal name). Admin login email for the buyer only | Worker names never stored |
| Assessment content | Item responses, six-domain scores, completion time, session id | Yes, to deliver the SKU |
| Technical | IP and user-agent at Cloudflare edge; invite-link tokens | Operations / abuse |
| Not collected | SSN, medical data, biometrics, camera, microphone, precise geo, USAJOBS passwords | — |
Ownership and roles
The agency is the controller of the roster and of the cohort export it downloads. ALA is the processor for delivering Federal Fit. Participants consent by opening the invite and starting the session after the on-screen purpose label (exploration / mobility / development — not a qualification determination).
Who can see it
- Named agency admins on the order.
- ALA operators (founder and designated staff) on a need-to-know basis for support.
- Cloudflare, Stripe, Mailgun as subprocessors listed on the security statement.
- Not sold. Not used to train a public model from this cohort. Not posted to USAJOBS.
Retention, deletion, holds, records
- Operating retention: scores and roster for 36 months from kickoff unless the agency asks sooner.
- Deletion: within 30 days of a written agency request, except a documented legal hold.
- Verification: ALA emails confirmation of deletion to the named admin.
- FOIA / records: the agency is the records authority for its download. ALA will not produce another agency’s roster to a third party without legal process.
- Breach: 72-hour notice to the named contact as in the security statement.
Reuse for algorithm development
Default for Scale: no. De-identified method research, if any, requires a separate written agency opt-in. This SKU is delivery of profiles and a cohort map, not a research grant.