Inspired Intentions. The Drift Index™.

Privacy Policy

Last updated: 8th July 2026. Version 1.0.

This Privacy Policy explains how The Drift Index™ collects, uses, stores and protects your personal data. The Drift Index™ is operated by Hayley Standen, trading as Inspired Intentions, based in the United Kingdom.

This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

Data controller: Hayley Standen, Inspired Intentions.
Contact: hayley@inspiredintentions.co.uk.
If you have any questions about your data or want to exercise any of your rights, that is the address to write to.

2. Who can see your individual responses

Only you can see your individual answers, your Drift Score, and the details of your result. Your data is not visible to the creators of The Drift Index™, to other users, or to any partner. It is not sold. It is not shared for advertising. It is not used to build a profile of you as an identifiable person.

Research use is different. Anonymised, aggregated patterns across many people (for example: "hybrid workers in professional services aged 40 to 49 show a common weakness in Recovery") are used to improve the diagnostic and to inform published research on human performance. Your individual identity is never attached to any research output.

If you take the Drift Index™ as part of a corporate workshop using a team code, your individual result still remains private. The workshop facilitator only sees the aggregated pattern for the team as a whole.

3. What we collect

When you complete a Drift Index™

• Your email address
• Demographic information you provide: age band, sector, role level, and how you work (remote, hybrid, office-based, travelling)
• Your answers to the 20 diagnostic questions
• Your calculated Drift Score and per-lever scores
• The date and time you completed the diagnostic
• Any responses you enter into "this feels hard" boxes
• Whether you consented to receive marketing emails, and when

When you create an account

• Your email address
• A hashed version of your password (we never see or store your plain password)
• Your Terms and Privacy consent timestamp
• Your marketing consent status and timestamp, if given

Automatically collected

• Basic technical data required for the service to function, such as the type of device you are using
• We do not use tracking cookies for advertising purposes on The Drift Index™

4. Why we collect it and our lawful basis

Under UK GDPR we can only use your data if we have a lawful basis. We use two:

Consent (Article 6(1)(a))

• To send you marketing emails, insights, tips, and updates from The Drift Index™, but only if you have separately ticked the marketing consent box.

Contract (Article 6(1)(b))

• To calculate and show you your Drift Index™ result.
• To save your account and history so you can retake the diagnostic and track your progress.
• To provide account features you have signed up for, including any paid features.

Legitimate interests (Article 6(1)(f))

• To improve the Drift Index™ diagnostic and its recommendations, using aggregated and anonymised patterns across all responses. Your individual responses are not shared or sold.
• To detect and prevent abuse of the service.

5. How we use your data

• To give you your personalised Drift Index™ result and recommendations
• To let you save your result, retake the Drift Index™, and see how your score changes over time
• To send you the marketing emails you have consented to, if any
• To produce anonymised aggregate research about how modern work affects human performance. Individual users are never identifiable in any research output.
• To respond to you if you contact us

6. Who we share it with (data processors)

We do not sell your data. We share it only with the small number of service providers required to run The Drift Index™:

• Supabase, which hosts our database and manages your account and password securely.
• Netlify, which hosts the website.
• Kit (formerly ConvertKit), which sends any marketing emails you have consented to receive.
• Stripe, if and when you make a payment. Card details are handled by Stripe directly and never touch our systems.

Each of these providers has its own privacy policy and appropriate data protection commitments. We use them because they meet UK GDPR standards.

7. How long we keep it

• Your account and Drift Index™ history: for as long as you have an account. If you delete your account, we delete your personal data within 30 days (aggregated, anonymised data may be retained for research).
• Marketing consent records: for as long as you are subscribed, plus a small period afterwards for our compliance records.
• Anonymous or unregistered assessment results: retained for up to 24 months for research, unless you ask us to remove them.

8. Your rights

Under UK GDPR you have the right to:

• Access the data we hold about you
• Correct anything that is wrong
• Ask us to delete your data ("right to be forgotten")
• Restrict how we use it
• Object to us using it for certain purposes, including marketing
• Receive a copy of your data in a portable format
• Withdraw your consent to marketing at any time

To exercise any of these rights, email hayley@inspiredintentions.co.uk. We will respond within 30 days.

9. Withdrawing marketing consent

You can withdraw your consent to marketing emails at any time by clicking the unsubscribe link at the bottom of any marketing email we send you. We will stop within 48 hours. You can also email hayley@inspiredintentions.co.uk to withdraw consent directly.

Withdrawing marketing consent does not affect your ability to use The Drift Index™. You will still receive essential transactional messages related to your account, such as password reset emails.

10. Security

We use industry-standard security practices to protect your data. Passwords are hashed. Data is transmitted over encrypted connections. Access to the underlying database is restricted and audited. If a data breach ever affects your personal data, we will notify you and the Information Commissioner's Office within the required timeframes.

11. International transfers

Some of our service providers are based outside the UK. Where this is the case, they operate under UK GDPR-compliant safeguards such as Standard Contractual Clauses or equivalent frameworks.

12. Complaints

If you are unhappy with how we have handled your data, please contact us first at hayley@inspiredintentions.co.uk so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

13. Changes to this policy

If we make significant changes to how we handle your data, we will update this policy and, where required, notify you by email. The "Last updated" date at the top of this page shows when this version came into effect.