Privacy Policy

1. Introduction

Visual Decisions Inc. ("we," "our," or "us") operates the Manufacturing Value Platform and its related properties: the Manufacturing Value Platform (mfgvalueplatform.com), the Smart Manufacturing Survey Platform (mfg-surveys.com), the Smart Manufacturing Use Case Platform (mfgusecases.com), and ValueMaps (valuemaps.com) — together, the "Platform." These properties share a common account system and database and are operated by Visual Decisions Inc. as a single service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information across all of them.

By using the Platform, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Platform.

2. Information We Collect

Account Information. When you sign in via Google or Microsoft OAuth, we receive your name, email address, and profile picture from those providers. If you create an account with email and password, we store your email, name, and a bcrypt-hashed password. We never receive or store OAuth passwords.

Company & Profile Information. To provide department-relevant assessments and analysis, we collect your department, role level, and company affiliation (company name, industry segment, plant size, and location). This information is provided voluntarily during onboarding.

Assessment & Platform Content. We collect the content you create on the Platform, including survey responses (maturity scores 1–5 and importance ratings 1–5 for each process area), use cases you view or save, initiatives, and value-analysis inputs. Your individual survey responses are used to generate your personalized results and are rolled up into aggregated company views, but never shown to your company in individually identifiable form — see "Anonymity & Aggregation" below.

Payment Information. If you subscribe to a paid plan, payment is processed by Stripe. We do not store your full card details — only a Stripe customer ID and subscription ID.

Usage Data. We collect anonymous usage analytics about how the Platform is used — pages visited, features and use cases viewed, search queries, browser type, operating system, device type, referrer, and country-level location. Our internal usage analytics does not store your IP address, email address, or precise location. (Third-party analytics services described in Section 4 operate under their own controls and are consent-gated where required.)

Cookies. We use cookies to maintain your session and an anonymous session identifier for analytics. In regions where consent is required, analytics cookies are set only after you accept them.

3. How We Use Your Information

• To provide and maintain the Platform
• To authenticate your identity and manage your account
• To generate personalized assessment results, recommendations, and value analysis
• To create curated use-case lists that address your identified gaps
• To process payments and manage subscriptions
• To produce anonymized, aggregated industry benchmarks (no individual responses are ever shared)
• To understand how the Platform is used and improve it
• To communicate with you about your account, assessments, or subscription
• To enforce our Terms of Service

4. How We Share Your Information

We do not sell your personal information.

Across our own properties. The Platform's properties share one database. Completing an assessment may, for example, create a curated list of relevant use cases associated with your account on mfgusecases.com.

With service providers (sub-processors):

• Stripe — payment processing. Governed by Stripe's Privacy Policy.
• Google / Microsoft — authentication. Governed by their respective privacy policies.
• Resend — transactional email (verification, invitations, notifications).
• Anthropic — powers optional, opt-in AI-generated summaries and narratives. Only aggregate scores (process-area names and numeric ratings) without personally identifying information are sent, and this content is not used to train their models.
• Vercel — hosting; processes request data to serve the Platform.
• Google Analytics — site-traffic analytics; anonymized where required by law and consent-gated in the EEA and UK.
• PostHog — product analytics to understand feature usage; consent-gated where required.
• Amazon Web Services (AWS) — database hosting (US region) storing your account and platform data.
• Prisma Data Platform — database query infrastructure that routes our application queries.
• Sentry — error monitoring; reports are scrubbed of personal data before being sent.
• Legal requirements — we may disclose information if required by law or to protect our rights.

5. Anonymity & Aggregation

A core platform commitment: your company never sees your individual survey responses. Every customer-facing breakdown by department, role, plant, or any other dimension is aggregated and gated by a k-anonymity threshold.

By default, any group with fewer than 5 respondents is hidden from aggregated views — those respondents are folded into a generic "Other" bucket. If "Other" itself doesn't reach the threshold, the singletons are absorbed into the smallest qualifying group, which is then renamed "Other" so no group of identifiable size is ever shown by name. The same protection applies to combinations of dimensions (for example, "VPs at the Detroit Plant" is treated with the same rule as "VPs" or "Detroit Plant" alone).

Company administrators may configure the minimum group size N (3, 5, or 10) — they can make the protection stronger but never weaker than the 3-respondent floor. Your individual responses are never available to your company regardless of N.

6. Controller / Processor Model

For B2B engagements where your employer manages your Platform access, your employer is the data controller of your responses (they determine what is collected and why). Visual Decisions Inc. is the data processor (we provide the technical platform). A Data Processing Agreement (DPA) is available on request from enterprise customers.

For individuals using the Platform without an employer relationship, Visual Decisions Inc. is the controller for your account and assessment data.

7. Data Retention & Erasure

We retain your account and assessment information for as long as your account is active. Usage and analytics data is retained for up to 24 months.

You may permanently delete your account and its associated data. Self-serve deletion is available from your Account page on mfg-surveys.com, and we are extending self-serve deletion across all properties; you may also request deletion at any time by contacting us at the address in Section 13. Deletion is immediate and irreversible — it removes your authentication identity, survey responses, AI-generated summaries, saved lists, company memberships, and assignments, and aggregated company views automatically recompute to exclude your contributions. A small number of incidental records (such as feedback submissions or group-ownership history) are unlinked from you rather than deleted — the content survives but is no longer associated with you. If you authored public blog content, contact us to coordinate authorship transition before deletion.

For security and compliance, we also maintain a tamper-evident security audit log that records account and administrative actions (such as sign-ins and permission changes), together with the identifier of the acting user. Because its purpose is to provide a reliable security record, this log is stored separately from analytics, is retained for 12 months, and is exempt from account-deletion requests on the basis of our legitimate interest in security and our legal and compliance obligations.

8. International Transfers

Our Platform is operated from the United States. If you access the Platform from outside the United States, your information may be transferred to and processed in the United States, where data-protection laws may differ from those in your country.

For users in the European Economic Area (EEA) or United Kingdom, we rely on legitimate interests and, where required, consent as our legal basis for processing personal data.

9. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your personal data — self-serve where available (see Section 7)
• Object to or restrict processing of your data
• Data portability (EEA/UK users)
• Withdraw consent at any time where processing is based on consent

To exercise any right not covered by self-serve options, contact us at the address in Section 13.

10. Security

We use industry-standard measures to protect your information, including HTTPS encryption, encryption at rest, secure database hosting, OAuth-based authentication, bcrypt password hashing, enforced multi-factor authentication on administrative access, and a tamper-evident audit trail. For a fuller description of our security program, see our Trust & Security page. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. Children's Privacy

The Platform is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated date. Continued use of the Platform after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, or to exercise your rights, contact us at: