Privacy

Sandro Maia is responsible for the data described here and decides what happens to it. For anything on this page — including a request to delete your account — write to sandromaia@theproductland.co. A person reads it and replies.

• Your name and email, from signing up or from Google if you use that button.
• A link to your profile picture, only if you sign in with Google. The image itself stays with Google.
• Your password, never in readable form. Sign-in is handled by Supabase Auth and the application never receives what you typed.
• Your assessment answers — a number from 1 to 5 for each statement — and the maturity scores calculated from them.
• Text you write: the name of your product or team, your action plan items, and any feedback you send.
• Which screens you reached and when, so we can tell whether the product is working. No content of your answers is attached to these records.

• Your IP address. It is used for a moment, in memory, to stop the public sharing page from being hammered, and is never written down.
• Anything about you from other sites. There are no advertising cookies and no third-party trackers inside the product.
• Special categories of data. Nothing here asks about health, beliefs, or anything of that kind. Please do not put such information into the free-text fields.

To provide the service you signed up for, and to understand whether it works well enough to keep building. Nothing is sold. Nothing is shared for advertising. There is no profiling and no automated decision that affects you.

• Supabase — the database and the sign-in system. Your data is stored in Ireland (eu-west-1).
• Vercel — hosting. The servers that build every page you load run in Ireland (dub1), alongside the database, so your data is both stored and processed inside the European Union.
• Google — only in two places: if you choose to sign in with Google, and Google Analytics on the public pages. The analytics only load after you accept the banner, they never run inside the product itself, and declining changes nothing about what you can do here.

While your account exists. Ask us to delete it and the account, your assessments, your answers and your action plan go with it. There is no automatic expiry today — if that ever changes, this page changes first.

You can ask for a copy of your data, correct it, have it deleted, take it elsewhere, or object to it being held at all. Write to sandromaia@theproductland.co. The answer comes within 30 days, and usually much sooner.

You can also complain to a data protection authority in your country if you think this is being handled badly.

• Every page and request travels over HTTPS, enforced by the browser rather than requested politely.
• Your workspace is isolated in the database itself, not only in the application. A query for someone else's data returns nothing rather than being asked not to.
• The browser is never allowed to write to the database. Every change goes through the server, which checks who you are and what you may touch first.
• Passwords never reach the application, so they cannot leak from it.

No system is beyond reach. If something does go wrong and it affects you, you will be told — not discover it later.

Creating a share link produces a page that anyone holding the address can open, without an account. The link stops working 90 days after it is created, or the moment you revoke it. Treat it like a document you emailed: forwarding is out of your hands.

If this notice changes, the date at the top changes with it. See also the terms of use.