Who are we
shouldi.tools is a suite of structured decision diagnostic tools operated under the trading name Should I? Decision Tools, based in the United Kingdom.
For the purposes of UK data protection law, Should I? Decision Tools is the data controller in respect of the personal data described in this policy.
Email: hello@shouldi.tools
What this policy covers
This policy explains what personal data we collect when you use shouldi.tools and its diagnostic tools, why we collect it, who we share it with, how long we keep it, and what rights you have in relation to it.
It is written in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are located outside the United Kingdom, additional or different rules may apply in your jurisdiction. This policy addresses UK law. Users in other countries are encouraged to seek advice on their local rights.
What data we collect
When you purchase a diagnostic
When you make a purchase through our payment provider, we receive confirmation that a transaction has been completed. Payment card details are processed entirely by Stripe and are not seen or stored by us.
When you complete a diagnostic
Our diagnostic tools are delivered through an online form. When you complete and submit a form, we collect:
• Your name (as you choose to provide it)
• Your email address
• Your answers to the diagnostic questions (multiple-choice responses)
Your answers relate to your career situation, employment circumstances, financial position, and intentions regarding retraining or career change. This is personal data. We treat it as such.
Technical data
When you visit our website, standard technical data may be collected automatically, including your IP address, browser type, device type, and pages visited. This is used for website security and performance.
How we use your personal data
We use your personal data for the following purposes:
To deliver the diagnostic service you purchased (legal basis: contract)
Your answers are used to calculate a structured assessment of your situation. A personalised written report is generated and made available to you at a unique, private URL. Your name is used to personalise the report. Your email address is used to communicate with you about the service, including a reminder before your report expires.
To improve our diagnostic tools (legal basis: legitimate interests)
We may analyse patterns across submissions in anonymised, aggregated form to understand how the tools are performing and to improve the quality of future assessments. This analysis uses data from which no individual can be identified. It does not involve accessing or reviewing individual reports.
To maintain website security and performance (legal basis: legitimate interests)
Technical data is used to protect the website from abuse and to ensure it functions correctly.
Automated processing
The diagnostic assessment is produced by a purpose-built system, not an off-the-shelf AI tool. The process involves several distinct stages, each handled by a specific part of the technical infrastructure.
How your data moves through the system
The following describes the complete journey from submission to report.
• Your answers are submitted through a Tally form. Tally transmits the submission to our processing infrastructure via a secure webhook.
• Our processing function, hosted on Vercel, receives the submission and runs a purpose-built scoring system. This system assigns a value to each answer, calculates weighted section scores, determines a verdict band, and evaluates a structured set of commentary flags in a defined sequence. This logic is deterministic: the same answers always produce the same scores and flags. No AI is involved at this stage.
• The scored outputs — section scores, verdict, active flags, and answer values — are passed to Claude, an AI system operated by Anthropic. Claude uses these structured inputs to generate the written content of your report. Claude does not perform the assessment. It translates the structured results into personalised written form.
• The completed report is stored in our database, hosted on Supabase in the EU West (Frankfurt) region.
• When you access your report URL, the Vercel function retrieves the report from Supabase, inserts your name, and serves the completed page to your browser.
A note on how your name is used
When you complete the diagnostic, you choose the name you'd like to appear in your report. That name is stored securely within EU infrastructure and is never transmitted to Anthropic's systems. Throughout the report generation process, a placeholder is used in its place. Your name is inserted into your completed report only at the moment it is served to your browser.
This was a deliberate design choice. The AI system that produces your report has no means of identifying you.
The assessment reflects the structural conditions described in your answers. It is not a prediction, a guarantee, or a professional opinion, and it does not constitute financial, career, or legal advice.
Requesting a human explanation
If you'd like to understand how your assessment was produced — including the scoring logic applied to your answers — you're welcome to email us at hello@shouldi.tools and we'll explain it.
Who we share your data with
We use a small number of third-party service providers to operate the service. Each is described below, including what data they receive and where they are based.
Tally (form provider)
Your answers, name, and email address are submitted through a Tally form. Tally transmits this data to our processing infrastructure via a secure webhook. Tally is operated by Tally Solutions BV, based in Belgium.
Stripe (payment processing)
Payments are processed by Stripe, Inc. Stripe receives your payment details. We receive only confirmation that a transaction has been completed. Stripe is a US-based company operating under standard contractual clauses for international data transfers. Further information is available in Stripe's privacy policy at stripe.com/gb/privacy.
Vercel (processing infrastructure)
Our processing function, which scores your answers and generates your report, runs on Vercel infrastructure. We have configured this function to run in a European Union region. Vercel, Inc. is a US-based company. We have entered into a Data Processing Agreement with Vercel. Further information is available at vercel.com/legal/privacy-policy.
Anthropic / Claude API (report generation)
The written content of your report is generated by Claude, an AI system operated by Anthropic, PBC, a US-based company. We do not send your name or email address to Anthropic. We send only your scored answers, calculated section scores, the assessment verdict, and any relevant commentary flags. Your name never leaves European Union infrastructure.
We have entered into a Data Processing Agreement with Anthropic. Transfers to Anthropic are made under standard contractual clauses. Further information is available at anthropic.com/privacy.
Supabase (data storage)
Your report and your name are stored in a database operated by Supabase, Inc. We have configured our Supabase project to use the EU West (Frankfurt) region. Your personal data does not leave European Union infrastructure. Further information is available at supabase.com/privacy.
Zoho (email)
Transactional emails, including your report expiry reminder, are sent via Zoho Mail, operated by Zoho Corporation. We use Zoho's EU-based mail infrastructure. Your name and email address are used for this purpose only.
We do not sell or rent personal data to any third party. We do not use your data for advertising purposes.
International data transfers
Some of our service providers are based in the United States. Where personal data is transferred outside the United Kingdom, we rely on appropriate safeguards, including standard contractual clauses approved under UK law, to ensure your data receives an adequate level of protection.
Your name is never transmitted to Anthropic's systems. It is stored within EU infrastructure and inserted into your completed report at the point it is served to your browser. What is transmitted to US-based infrastructure is your scored answers, section scores, verdict, and active flags only — data that cannot be used to identify you.
How long we keep your data
Your diagnostic report is stored for 12 months from the date it was generated. After 12 months, the report is automatically and permanently deleted. The expiry date is shown on your report page. If you wish to keep your report, you should save or download it before that date.
Your email address is retained for as long as your report exists and is deleted when your report is deleted.
Purchase records may be retained for longer where required for accounting or legal purposes.
You may request deletion of your report at any time. A deletion link is included at the bottom of every report page.
Your rights
Under UK data protection law, you have the following rights in relation to your personal data:
• The right to access the personal data we hold about you
• The right to have inaccurate data corrected
• The right to have your data deleted (see the deletion link on your report page, or contact us at hello@shouldi.tools)
• The right to restrict processing in certain circumstances
• The right to object to processing based on legitimate interests
• The right to data portability in certain circumstances
• If you would like to understand how your assessment was produced, see Section 5
To exercise any of these rights, contact us at hello@shouldi.tools. We will respond within one calendar month.
How to make a complaint
If you have a concern about how we have handled your personal data, please contact us in the first instance at hello@shouldi.tools. We will acknowledge your complaint within five working days and aim to respond in full within one calendar month.
Please include as much detail as possible about the nature of your concern so we can respond accurately and promptly.
If you are not satisfied with our response, or if you do not receive a response within one calendar month, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters.
ICO contact details: ico.org.uk | 0303 123 1113 | Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
If you are located in a European Union country, you may also have the right to complain to your local data protection authority rather than, or in addition to, the ICO.
. Cookies
Our website may use cookies for analytics and performance purposes. Further details are provided in our Cookie Policy at shouldi.tools/cookie-policy.
Data security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. These include encrypted data transmission, access controls on our database, and EU-region data storage for all personal data.
No system is completely secure. If you have concerns about the security of your data, contact us at hello@shouldi.tools.
. Changes to this policy
We may update this policy from time to time to reflect changes to the product, our service providers, or legal requirements. The most recent version will always be published at shouldi.tools/privacy-policy. Where changes are material, we will take reasonable steps to notify active users.
13. Governing law
This policy is governed by and construed in accordance with the laws of England and Wales. Any disputes relating to this policy or to our handling of your personal data are subject to the exclusive jurisdiction of the courts of England and Wales, without prejudice to your right to lodge a complaint with the ICO or your local data protection authority as described in Section 9.
14. Contact
Contact: hello@shouldi.tools
© Should I? | Operated from the United Kingdom