Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Connective Leadership LLC, doing business as the Connective Leadership Institute ("CLI", "we", "us", "our"), New York, NY, United States, collects, uses, shares and protects personal information when you visit connectiveleadership.com and its subdomains, take an assessment, use our platform, dashboards, apps or Resource Center, make a purchase, or otherwise interact with us (the "Services"). We are the controller of the personal information described here, except where we process data on behalf of an organization customer, in which case that organization is the controller and we act as its processor under our agreement with it.

This policy should be read together with our Terms of Service.

2. Information we collect

Information you give us

• Contact and account data — name, email address, phone number, organization, job title, password (stored only as a secure hash) and two-factor authentication settings.
• Assessment and survey data — your responses to the Achieving Styles inventories and other surveys, and the scores, reports and profiles generated from them.
• Billing data — billing name, billing address, tax identifiers for organizations, and purchase and invoice history.
• Communications — messages you send us, demo requests, support requests and feedback.
• Certified Associate data — certification records, training attendance and the client projects you administer.

Information collected automatically

• Device and log data — IP address, browser and device type, operating system, pages viewed, referring page, date and time of access, and error logs.
• Security data — sign-in events, failed sign-in attempts and two-factor verification records, used to protect accounts and detect fraud.

Information from others

• Your organization — if your employer or a Certified Associate enrolls you, they may give us your name, email, role and group so we can send you an assessment invitation.
• Payment processors — confirmation of payment, and limited card details such as brand, last four digits, expiry date and billing country.
• HRIS integrations — where an organization connects its human-resources system, the fields it chooses to share under its agreement with us.

3. Payment information

Online payments are processed by third-party payment processors such as Stripe, Inc. When you pay, your card number, security code and bank details are sent directly to the processor over an encrypted connection and are handled under the Payment Card Industry Data Security Standard (PCI DSS). We do not receive or store full card numbers or security codes. We receive only what we need to record the transaction, issue receipts, handle refunds and prevent fraud. Stripe's use of your information is described in its privacy policy at stripe.com/privacy. Stripe may also use device and transaction data for fraud prevention.

4. How we use information

• To provide the Services: deliver assessments, generate reports and dashboards, operate accounts and give support.
• To process payments, send receipts and invoices, manage subscriptions, handle refunds and billing disputes, and prevent fraud.
• To keep the Services secure, including two-factor authentication, abuse detection and troubleshooting.
• To send transactional messages, such as assessment invitations, account notices, renewal reminders and changes to our terms.
• To produce de-identified, aggregate statistics for research, norms and benchmarking. Aggregate data cannot reasonably be used to identify you.
• To improve and develop the Services.
• To comply with legal, tax and accounting obligations and to enforce our agreements.

5. Legal bases for processing

Where laws such as the EU or UK General Data Protection Regulation apply, we rely on: performance of a contract (to provide the Services and process payments); legitimate interests (security, fraud prevention, improving the Services and aggregate research, balanced against your rights); legal obligation (tax, accounting and regulatory requirements); and consent (for example, optional marketing emails), which you can withdraw at any time.

6. Confidentiality of assessment and survey responses

• Individual Achieving Styles reports are shared only with the participant and with people the participant, or the agreement under which the participant was invited, authorizes — for example, a Certified Associate administering the assessment.
• When an organization purchases employee surveys, we report results to the employer only in aggregate. We do not identify individual respondents, free-text comments are de-identified, and we do not report results for any group with fewer than five respondents.
• Assessment results are not medical, psychological or clinical diagnoses and should never be the sole basis for decisions about a person.

7. How we share information

We share personal information only as follows:

• Service providers that process data on our behalf under contracts requiring confidentiality and security: payment processing (such as Stripe), cloud hosting and databases, email delivery, customer support, and AI-model providers used for in-product interpretation.
• Your organization or Certified Associate, as described in Section 6.
• Legal and safety — when required by law, subpoena or court order, or to protect the rights, property or safety of CLI, our users or others, including to investigate fraud or a payment dispute.
• Business transfers — to a successor in a merger, acquisition or sale of assets, subject to this policy.
• With your consent or at your direction.

8. No sale of personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use individual assessment responses for advertising.

9. Cookies and similar technologies

We use cookies and similar technologies that are necessary to run the Services: to keep you signed in, remember preferences, secure forms (for example, Google reCAPTCHA) and protect against attacks through our content-delivery and security provider (Cloudflare). Payment pages may use cookies set by our payment processor for fraud prevention. You can control cookies in your browser settings; blocking necessary cookies may stop parts of the Services from working.

10. AI-assisted features

Some features, such as the AI Mentor and AI-assisted report interpretation, send the minimum data needed to answer your request to an AI-model provider. We use providers that contractually do not use our customers' data to train their general models. AI-generated content can contain errors and should be reviewed by a person.

11. Security

We protect personal information with administrative, technical and physical safeguards, including encryption in transit (TLS), hashed passwords, two-factor authentication, role-based access controls and access logging. No method of transmission or storage is completely secure, but we work to protect your information and will notify affected users and authorities of a data breach as required by law.

12. Retention

We keep personal information for as long as your account is active or as needed to provide the Services. Billing and transaction records are kept as long as tax and accounting laws require (generally seven years). Assessment data is kept for the term of the relevant agreement and may then be deleted or de-identified for aggregate research. You can ask us to delete your data sooner, as described below.

13. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy in a portable format;
• correct inaccurate information;
• delete your information;
• restrict or object to certain processing;
• withdraw consent where we rely on it; and
• complain to your local data-protection authority.

To make a request, email [email protected] from the email address on your account. We will verify your identity and respond within 30 days (or sooner where the law requires). If your data was provided by your organization, we may refer your request to that organization as controller and help it respond. We will not discriminate against you for exercising your rights.

14. U.S. state privacy rights

Residents of California and other U.S. states with comprehensive privacy laws have the rights described in Section 13, including the right to know what categories of personal information we collect (listed in Section 2), the purposes (Section 4) and the categories of recipients (Section 7). We do not sell or share personal information as those laws define it, and we do not use sensitive personal information for purposes that would require an opt-out. You may use an authorized agent to make a request on your behalf.

15. International transfers

We are based in the United States, and our service providers may process data in the United States and other countries. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.

16. Children

The Services are intended for adults and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

17. Marketing emails

We send marketing emails only where permitted by law. Every marketing email includes an unsubscribe link, and you can also opt out by emailing us. Transactional messages about your account, purchases and subscriptions are still sent after you opt out of marketing.

18. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version on this page with a new "Last updated" date, and for material changes we will notify account holders by email before the changes take effect.

19. Contact us

For privacy questions or requests: