The Everyone Project United States

A. Privacy Policy

At a glance

Sections

• 1. Who we are and how to contact us

• 2. Who this policy is for

• 3. What personal information we collect

• 4. Where we get your information

• 5. How and why we use your information

• 6. Your survey answers, sensitive information and your consent

• 7. Who we disclose information to

• 8. Where your information is held

• 9. How long we keep your information

• 10. How we keep your information safe

• 11. Your rights and choices

• 12. Children and young people

• 13. Automated decision-making

• 14. Changes to this policy

• 15. How to make a complaint

• 16. Definitions

1. Who we are and how to contact us

The Everyone Project ("TEP", "we", "us") is the trading name of Every1data Limited. We operate the TEP tool and we are the entity responsible for the personal information handled through it.

‘We’ means The Everyone Project and the people who work for it. This is our general privacy policy; extra protections may apply to particular features, such as the notice shown in the survey (section 6). Defined terms are in section 16.

Which laws apply to us. The US has no general federal privacy law; each state makes its own. Rather than vary your protection by where you live, we apply one standard everywhere, set at the level of the strictest law that reaches us. California is our main state of deployment. In practice:

• The California Online Privacy Protection Act (Cal. Bus. & Prof. Code §§ 22575–22579) applies to us, because our website collects personal information from Californians. It has no size threshold.

• The Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-516) applies to us. From 1 July 2026 it catches any business that handles the sensitive data of even one Connecticut resident, whatever its size.

• The Washington My Health My Data Act (RCW 19.373) and Nevada's equivalent (NRS 603A.400–603A.550) cover "consumer health data", which they define far more widely than usual. Our Consumer Health Data Privacy Policy, set out after this one, explains what we do with it.

• We are not a "business" under the California Consumer Privacy Act: we fall below the revenue threshold in Cal. Civ. Code § 1798.140(d)(1)(A), and its other two tests turn on buying, selling or sharing information, which we do not do. We give every US resident those rights anyway, as a matter of policy. We have not certified compliance to the California Privacy Protection Agency.

• Other state laws apply once we meet their thresholds. This policy is written to meet each of them, as a minimum. This version of our product is not intended to target Maryland residents.

Where this policy mentions what California law requires, we are describing a standard we have chosen to follow, not asserting that the California Consumer Privacy Act applies.

2. Who this policy is for

This policy applies to three groups. Find the group that applies to you.

A note on who counts as a "consumer". Most state laws give rights only to people acting personally, which would leave out organization users. We do not draw that line — everyone covered by this policy gets the rights in section 11.

3. What personal information we collect

3A. Contributors

From the organization that engaged you:

• Contact information — your name and email address.

• Role information — the project you contributed to and your role (e.g. job title).

From you:

• Your survey answers (self-reported information) — only if you choose to give them. These may cover your demographics, your work and your experience of inclusion. Most of this is "sensitive" under state privacy law, so it gets extra protection (sections 6 and 10).

• Usage information — how you use the tool, so we can operate, secure and improve it.

• Support information — anything you give us when you contact us for help.

3B. Organization users

• Account and contact details (name, work email, role, organization, login); the projects you register; billing records; usage information; and support information. We do not knowingly collect sensitive information about organization users.

3C. Website visitors

• Device and connection data, and cookies. Strictly necessary cookies make the site work; limited analytics cookies help us improve it. We use no cookies for targeted or cross-context behavioral advertising.

3D. How this maps to the California statutory categories

California uses a fixed list of categories (Cal. Civ. Code § 1798.140(v)(1)). The table shows which we collect, why, where from and who receives them, over the last twelve months and from now on.

We collect none of the other three: biometric information (E), education information (J), or inferences used to build a profile of you (K).

We do not sell or share your personal information, and have never done so — so we have no knowledge of selling or sharing anyone’s information, including anyone under 16. "Sell" and "share" mean what Cal. Civ. Code § 1798.140(ad) and (ah) say they mean: wider than selling for money, and including disclosure for cross-context behavioural advertising. Giving information to a service provider who may only act on our instructions is neither.

How we use sensitive personal information. To produce de-identified reporting about the industry workforce. You can ask us to limit that use — see section 11.

4. Where we get your information

• Directly from you — wherever practical to do so: when you complete a survey, create an account, contact us or use the tool.

• From the organization that engaged you — when they register their projects.

• From other authorized users — when they invite you or add you to an account.

• Automatically — through cookies, server logs and usage analytics.

• Limited public sources — for example public project credits where this is lawful.

When we get your details from someone else. Your name, email address and role usually come from the organization that engaged you. We take only contact and role details this way — sensitive information comes from you alone, with your consent (section 6). And we tell you promptly: the invitation and data collection communications flow provides information about who we are, what we hold, where we got it, what we will use it for, who we disclose it to, and how to see, correct or delete it. You can unsubscribe or ask us to delete your details at any time.

We keep records of our dealings with you, including what we have provided and how we answered your questions. Section 13 covers the automated processing we apply.

5. How and why we use your information

We use personal information only for the purpose we collected it for, or a closely related one you would expect, unless you agree otherwise or the law requires it. We use it to:

• invite contributors and run the voluntary survey;

• with your consent, analyze your answers to produce de-identified reporting and benchmarks;

• provide the tool to organization users, manage their access and provide technical or other support to you;

• operate, secure and improve the tool, and answer your enquiry about our services and complaints;

• manage our employment or business relationship with you;

• tell you about our other programs, products or services, unless you have opted out — and for contributors only if you have agreed. Every marketing message carries an unsubscribe link and our postal address, as the CAN-SPAM Act requires; and

• meet our legal and accountability obligations, and establish, exercise or defend legal claims.

Reporting produced by the tool is de-identified, so it contains no personal information (section 10).

We collect no more than we need. Several states limit collection to what is reasonably necessary for the service you asked for, and we apply that everywhere. Every question is optional.

If you have taken part before. We use your existing record to link you to further projects rather than asking you to complete the survey again. We tell you each time, and you can choose project by project not to be associated.

We do not set out to collect information we have not asked for. If we receive it anyway we review it promptly as soon as we are aware and destroy or de-identify it, unless the law requires otherwise.

6. Your survey answers, sensitive information and your consent

Most of what you tell us in the survey counts as "sensitive" under US state privacy law — your racial or ethnic origin, religious or philosophical beliefs, sexual orientation, gender identity and experience of disability. Most states, Connecticut included, let us collect it only with your opt-in consent. California instead gives you a right to limit how we use it. We do both, everywhere. So:

• We collect your answers only with your consent, and the survey tells you what we are asking for and why before you decide.

• Your consent is captured on your own device before your answers are sent to us. You can try the survey first and decide at the end whether to contribute.

• You can skip any question, choose "prefer not to say", or decline altogether — it does not affect anything else.

• When you submit your answers you consent to us using them only to: (a) create reports and analysis on the industry workforce, without identifying you; (b) seek further consent or information from you; (c) maintain and improve our service; and (d) remind you that we hold this information.

• You can change your mind at any time and delete your answers by signing in or contacting us. Withdrawing your consent is as easy as giving it.

• We never sell sensitive information or use it for targeted advertising.

• Your survey answers are protected by client-side field-level encryption — meaning even our authorized database administrators cannot access them — and reporting is anonymized, so you cannot be identified (section 10).

Health and gender identity information. Some of our questions — e.g. about disability may also count as "consumer health data" under applicable laws. The extra protections this bring are also addressed in the Consumer Health Data Privacy Policy after this one.

7. Who we disclose information to

We do not sell or share personal information. We disclose your survey answers to no one but you, unless the law compels us. In all other respects your survey answers are protected from disclosure by encryption and/or anonymisation. We disclose other personal information only where necessary and lawful:

Links to other sites. We do not control the sites we link to and are not responsible for them. Check their own terms and privacy policy before giving them your information.

Third party tracking. We do not let third parties track what you do across other websites when you use our site.

California "Shine the Light". Cal. Civ. Code § 1798.83 lets Californians ask what personal information a business gave third parties for those third parties’ own direct marketing, and who received it. We give none, and will confirm that in writing within 30 days if you ask our Privacy Officer.

8. Where your information is held

Your survey answers, and the role and project information that goes with them, are held at rest in Microsoft’s United States Azure regions. Some account and support information is handled elsewhere — see below.

Some other information is handled outside the United States. Contact, account, support, email and sign-in details are handled by our providers and our own staff outside the US, including in the UK and the EU where we are based. Our network and security provider runs a global edge network; anything passing through it is in transit only.

Sensitive information. Sensitive information within your survey answers is held at rest in the United States and stays protected by field level encryption throughout, including when our systems are accessed for support.

How we protect it. No US law requires us to keep your information in any particular place, but we stay responsible for it wherever it goes: written contracts with every provider on the terms in section 7, restricted and logged access, and encryption in transit and at rest.

9. How long we keep your information

We do not set fixed retention periods, because we cannot tell in advance how long each item will be needed. California allows criteria instead where a period cannot be given (Cal. Civ. Code § 1798.100(a)(3)). Ours, category by category, are:

• Survey answers, including sensitive information — kept while you are still identified as a contributor and have not deleted them. You can delete them yourself at any time.

• Contact and role information — kept while the project is active on the tool and while you may be invited again, unless you unsubscribe or ask us to delete it.

• Account and billing information for organization users — kept for the life of the subscription, then as long as tax and audit rules require.

• Usage and support information — kept while we need it to run and secure the tool, to improve our product and service, then deleted or aggregated.

For all of these we also weigh whether we still need the information for legal claims or obligations, and the risk keeping it poses to you. We review what we hold periodically, then destroy or de-identify it. Our internal retention policy records how we apply these rules.

10. How we keep your information safe

We take the security of your information seriously. All data is managed in accordance with our Data Security Measures and Access Policy. Our measures are kept under review and currently include:

• An information security management system certified to ISO/IEC 27001.

• Encryption of personal information in transit and at rest, with client-side field-level encryption of your survey answers.

• Differential privacy and related privacy-preserving techniques applied to all reporting outputs.

• Role-based access controls, multi-factor authentication and audit logging appropriate to the sensitivity of the information.

• Storage in highly secure Microsoft data centers in the United States.

• Regular security testing, monitoring, staff training and confidentiality undertakings.

• A documented breach-response process. If a breach affects your information we will tell you, and the regulators entitled to know, as your state's breach notification law requires.

11. Your rights and choices

The tool is designed to give you direct control:

• View and download — sign in to see and download your information.

• Correct or update — edit your answers directly.

• Link or unlink — choose, project by project, whether your answers are linked to a project.

• Delete — delete your answers at any time. You can keep your contact details on file so we respect your preferences.

• Stop being invited — unsubscribe at any time.

You also have the rights below, wherever in the US you live.

How to make a request. Contact our Privacy Officer (section 1). We will confirm receipt within ten business days and answer within 45 days, free of charge; if we need longer we will say why and take no more than another 45 days. To protect you we check your details against what we hold, and for survey answers we ask you to act from the signed-in account. We use what you give us only to check who you are. You can use an authorized agent with written proof.

Getting this policy in another format. We aim to meet recognised web accessibility standards. If this policy is hard to use with assistive technology, or you want it another way, ask our Privacy Officer.

Browser signals. Some browsers send a Global Privacy Control signal, telling a site not to sell or share the visitor’s information. We do neither, so there is nothing to switch off, but we treat it as a valid request and will honour it if that changes. Some browsers also send a "Do Not Track" signal; there is no agreed standard for answering it, so we do not. California law requires us to say so (Cal. Bus. & Prof. Code § 22575(b)(5)).

We will periodically remind you that we hold your information and how to update or delete it.

12. Children and young people

We never ask a child under 13 for information about themselves. Where a contributor is under 13, the organization that engaged them invites a parent or guardian instead, and the parent or guardian answers on the child’s behalf. The tool is not designed for or aimed at children using it.

Older children and young people. Contributors can include young people working on a production. The survey asks whether you are 16 or over and uses the answer to decide which later questions to ask. We never sell or share anyone’s information or use it for advertising, at any age, and the wording is age-appropriate. Parents and guardians with a question about their child can contact us (section 1).

13. Automated decision-making

We do not make decisions about you solely by automated means that could reasonably be expected to significantly affect your rights or interests. We use automated processing to:

• categorize information for reporting;

• apply differential privacy and other privacy-preserving techniques before reporting;

• sort and prioritize support requests; and

• detect and limit abusive or suspicious activity, for example rate-limiting or temporary suspensions.

The kinds of personal information used in that automated processing are your survey answers, your role and project information, usage information and support information. Where any of it could meaningfully affect you, a person is involved before a decision is taken.

The tool is not used, and is not designed, to make or help make decisions about anyone’s employment, engagement, casting, work allocation or pay. Our reporting describes workforces, not the people in them.

14. Changes to this policy

We review this policy at least once every twelve months, following the California standard, and may update it sooner. The current version and effective date are at the top. Where a change is material we will tell active users by email or in the tool before it takes effect, and we will not apply it to information we already hold without your consent.

15. How to make a complaint

If you have a question or a complaint about how we handle your personal information, contact our Privacy Officer first, at [email protected], so we can try to put things right.

We try to sort complaints out informally. For a formal complaint, put it in writing by email; we will acknowledge it promptly and answer within 45 days.

If we do not answer, or you are unhappy with our answer, you can complain to your state Attorney General. Californians can also go to the California Privacy Protection Agency at cppa.ca.gov or the Attorney General at oag.ca.gov/privacy, and anyone can report a concern to the Federal Trade Commission at reportfraud.ftc.gov.

16. Definitions

B. Consumer Health Data Privacy Policy

What this policy is — and what it is not

Where this policy applies

This policy applies to residents of any US state whose law regulates consumer health data. Today that means Washington (the My Health My Data Act, RCW 19.373) and Nevada (NRS 603A.400–603A.550). If other states pass similar laws, it applies to their residents too from the day those laws take effect. We give everyone who answers our survey in the US the protections set out here, not only people in states that require them.

1. What we collect that may be consumer health data, and why

Most of what our survey asks — race and ethnicity, religion, sexual orientation, the languages you speak, your education, your caring responsibilities, your year of birth — is not health information under any US law, and this policy does not cover it. The questions that may count as consumer health data are:

• Whether you have a long-term physical or mental health condition or disability; if so, what it affects; and whether it limits your day-to-day activities.

• How you identify, where your answer shows you are transgender or non-binary. Some states treat this as health-related because of its link to gender-affirming care. We do not ask about medical care of any kind.

Every one of these questions is optional. Skip it, answer "prefer not to say", or decline the survey altogether — nothing else changes.

Why we collect it. For one purpose: to produce de-identified statistics and benchmarks about who works in the industry. We use the answers to produce aggregated reports and analysis, and we apply differential privacy before any report is produced to ensure the data is de-identified. We do not use this information to assess, diagnose, treat or predict anything about your health, or to make any decision about you, or for advertising, profiling or marketing.

If our survey changes. Inclusion reporting develops and our questions develop with it. If we add a question that falls within a state definition of consumer health data, or a new law catches something we already ask, this policy will be applied to it. We will not use consumer health data for any purpose this policy does not describe without asking you first.

2. Where we collect it from

Only from you, and only with your consent, which is captured on your own device before your answers reach us. We do not get it from the organization that engaged you, from other users, from public sources or from data brokers. We do not infer it from anything else you do, and we do not buy it. Where a contributor is under 13, a parent or guardian answers on their behalf and we never ask the child directly.

3. What we share

Nothing. We do not sell consumer’s health data and we do not share it with anyone for their own purposes — including the organization that engaged you, which never sees your answers.

4. Who receives it, and how it is protected

Two kinds of service provider hold this information for us, protected by encryption, under written contracts that let them act only on our instructions and forbid them from using it for any purpose of their own:

• Cloud hosting — the infrastructure the tool runs on.

• Data storage — where your answers are held at rest.

We have no affiliates with whom we share consumer health data. You can ask our Privacy Officer for the current list of our service providers and their contact details.

How your answers are protected. Your survey answers are protected by client-side field-level encryption — meaning even our authorized database administrators cannot access them. Encryption is applied on your own device before your answers reach us, and everything we hold is encrypted in transit and at rest.

5. Your rights, and how to use them

You have the right to:

• Confirm and access — ask whether we are collecting, sharing or selling your consumer health data, and get a copy of it together with a list of everyone we have shared it with and how to contact them.

• Withdraw your consent — as easily as you gave it.

• Delete — ask us to delete your consumer health data, including from our archived and backup systems and from any third party holding it for us.

You can see, change or delete your answers yourself at any time by signing in. For anything else, contact our Privacy Officer at [email protected], or write to Every1data Limited, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We will confirm receipt within ten business days and answer within 45 days, free of charge. If we refuse we will tell you why and how to appeal.

6. Other disclosures

• Reviewing and changing your information — sign in to edit or delete your answers, or contact our Privacy Officer.

• Third-party tracking — we do not let third parties collect consumer health data about what you do across other websites.

• Changes to this policy — we review it at least once a year and update it whenever our survey or the law changes. Where a change is material we will tell active users before it takes effect. The current version and effective date are at the top.