Privacy Policy

1. Introduction

Develop & Integrate (“we”, “our”, or “us”) provides Target Operating Model architecture, organisational diagnostic assessments, and executive advisory services to mid-market and enterprise businesses. We respect the privacy of every individual who visits our platform, engages with our diagnostic tools, or submits organisational data for analysis.

This Privacy Policy explains how we collect, store, process, protect, and delete personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Roles: Data Controller vs. Data Processor

• Develop & Integrate as Data Controller: We act as the Data Controller for direct prospective and paying client information – such as contact names, business email addresses, billing records, and scorecard submissions collected through developandintegrate.com.
• Develop & Integrate as Data Processor: When an enterprise client uploads internal organisational records (such as headcount exports, staff rosters, or organisational hierarchy CSV files) to our platform, the client acts as the Data Controller, and Develop & Integrate operates strictly as a Data Processor acting on the client’s explicit instructions to perform structural systems diagnostics.

3. The Data We Collect

• A. Diagnostic Scorecard & Lead Generation Data: When you complete the Founder Bottleneck Scorecard or request Field Guides, we collect: full name; corporate/work email address (consumer webmail domains are screened out); company name; headcount band; diagnostic responses and computed Operational Friction Index metrics.
• B. Commercial & Account Data: When purchasing the Certified Operating Architecture Blueprint, Field Guides, or Executive Strategy Sprint: billing contact name, company registration, and billing address; transaction identifiers and payment status (full credit card and payment details are processed directly and securely by Stripe; we never store raw card numbers); calendar scheduling details (name, email, and scheduled appointments booked via our scheduling integration).
• C. Client-Uploaded Organisational Data (CSV & Intake Form): Headcount Roster Data: employee identifiers/codes, job titles, functional departments, direct manager identifiers, and salary bands/levels. Clients are encouraged to submit pseudonymous employee identifiers rather than employee names. Qualitative Intake Responses: leadership feedback detailing internal decision velocity, cross-department handoffs, governance bottlenecks, and strategic priorities.
• D. Technical & Usage Information: IP addresses, browser typology, operating system, and session timestamps collected automatically via standard, secure server logs to maintain platform integrity and security.

4. Legal Grounds for Processing (UK GDPR Art. 6)

• Scorecard & Lead Data: Calculating Friction Index scores, delivering diagnostic summaries, and relevant research follow-ups. Basis: Legitimate Interests (delivering requested diagnostic insight to commercial decision-makers) / Consent.
• Purchasing & Account Data: Processing transactions, provisioning portal vaults, and invoicing. Basis: Contractual Necessity (Article 6(1)(b)).
• Client Headcount / Org CSVs: Generating spans, management layers, DACI matrices, and diagnostic reports. Basis: Contractual Necessity / Performance of Client Agreement.
• Billing & Audit Records: Statutory accounting and corporate tax reporting. Basis: Legal Obligation (Article 6(1)(c)).

5. Artificial Intelligence (AI) & Diagnostic Processing Policy

• Zero Model Training: Your proprietary organisational data, headcount structures, and intake answers are never used to train, retrain, improve, or fine-tune public or third-party AI models.
• Transient Processing: Data transmitted to the API is processed solely in memory for the duration of the prompt generation cycle and is governed by strict enterprise data confidentiality agreements.
• Human-in-the-Loop Certification: AI draft deliverables are reviewed, calibrated, and signed off asynchronously by Lead Systems Architect Julie Geens (MSc OccPsych) prior to client release.

Our diagnostic engine utilises enterprise-tier Large Language Model APIs, accessed through the Lovable AI Gateway over private, encrypted endpoints, to synthesise structural metrics and generate baseline report drafts.

6. Sub-Processors and Third-Party Infrastructure

• Lovable / Supabase Inc.: Cloud database, application hosting, and file storage infrastructure (hosted in secure European/UK data centre regions).
• Stripe Payments Europe, Ltd.: Payment processing, merchant compliance, and secure checkout.
• Lovable AI Gateway: Enterprise-tier AI model access for report synthesis, running over encrypted TLS connections.
• Cal.com / Calendly: Appointment scheduling for Executive Strategy Debriefs.
• Lovable Email: Transactional email delivery for system notifications, magic-link login tokens, and report readiness alerts.

We do not sell, rent, or trade your personal data. We engage vetted, enterprise-grade cloud service providers (“Sub-Processors”) strictly to host our application, process payments, and support service fulfilment:

Where data is processed outside the United Kingdom or European Economic Area (EEA), transfers are safeguarded under the UK International Data Transfer Agreement (IDTA) or standard European Commission Standard Contractual Clauses (SCCs) with supplementary technical encryption.

7. Data Retention & Deletion Schedule

• Lead & Scorecard Records: Retained for 24 months, then automatically deleted; or deleted upon receipt of an unsubscribe or erasure request.
• Client Headcount Rosters (CSVs): Stored in encrypted portal vaults for the duration of the audit delivery and automatically deleted 12 months following final Blueprint sign-off (or 12 months after purchase if no Blueprint is signed off). Clients may request permanent deletion of raw CSV files at any time via their portal or by email.
• Delivered Blueprints & Audit Reports: Retained in the client’s private portal for 24 months following sign-off, after which report and intake content is automatically deleted.
• Financial & Transaction Records: Retained for 7 years in accordance with UK statutory accounting and HMRC requirements, then automatically deleted.

8. Technical and Organisational Security Measures

• Encryption: All data in transit is encrypted using Transport Layer Security (TLS 1.3). All database records and uploaded files in Supabase storage are encrypted at rest using AES-256 encryption.
• Access Control: Client data vaults are isolated using strict Row-Level Security (RLS) policies. Only authenticated client accounts and authorised systems architects possess administrative decryption rights.
• Pseudonymisation: Headcount analysis functions purely on structural node relationships (employee_id to manager_id). Client accounts are instructed not to include sensitive personal data (e.g., home addresses, national insurance numbers, or personal banking data) in headcount uploads.

9. Your Statutory Rights (UK GDPR)

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal records.
• Right to Erasure (“Right to be Forgotten”): You may request the deletion of your personal data where retention is no longer legally necessary.
• Right to Restriction: You may request that we temporarily pause the processing of your personal data.
• Right to Data Portability: You may request the export of your digital data in a structured, machine-readable format (CSV or JSON).
• Right to Object: You may object to data processing carried out under the grounds of Legitimate Interests or direct business communications.

To exercise any of these rights, contact julie@developandintegrate.com. We respond to all verified requests within 30 days.

If you believe our processing of your personal data infringes UK data protection regulations, you have the right to lodge a formal complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Updates to This Policy

We review and update this Privacy Policy periodically to reflect platform enhancements, infrastructure updates, and regulatory developments. Changes take effect immediately upon posting to developandintegrate.com/privacy.