In short: we collect only what we need to deliver our assessments, platform and services and to take payment. Card payments are handled by our payment processor (such as Stripe); we never see or store your full card number. We do not sell personal information. Employers see employee survey results only in aggregate. To access or delete your data, email [email protected].
1. Who we are and what this policy covers
This Privacy Policy explains how Connective Leadership LLC, doing business as the Connective Leadership Institute ("CLI", "we", "us", "our"), New York, NY, United States, collects, uses, shares and protects personal information when you visit connectiveleadership.com and its subdomains, take an assessment, use our platform, dashboards, apps or Resource Center, make a purchase, or otherwise interact with us (the "Services"). We are the controller of the personal information described here, except where we process data on behalf of an organization customer, in which case that organization is the controller and we act as its processor under our agreement with it.
This policy should be read together with our Terms of Service. Organizations that need a data processing agreement (for example under the GDPR) can request ours at [email protected].
2. Information we collect
Information you give us
- Contact and account data — name, email address, phone number, organization, job title, password (stored only as a secure hash) and two-factor authentication settings.
- Assessment and survey data — your responses to the Achieving Styles inventories and other surveys, and the scores, reports and profiles generated from them.
- Billing data — billing name, billing address, tax identifiers for organizations, and purchase and invoice history.
- Communications — messages you send us, demo requests, support requests and feedback.
- Certified Associate data — certification records, training attendance and the client projects you administer.
Information collected automatically
- Device and log data — IP address, browser and device type, operating system, pages viewed, referring page, date and time of access, and error logs.
- Security data — sign-in events, failed sign-in attempts and two-factor verification records, used to protect accounts and detect fraud.
Information from others
- Your organization — if your employer or a Certified Associate enrolls you, they may give us your name, email, role and group so we can send you an assessment invitation.
- Payment processors — confirmation of payment, and limited card details such as brand, last four digits, expiry date and billing country.
- HRIS integrations — where an organization connects its human-resources system, the fields it chooses to share under its agreement with us.
2A. The CLI app
When you use the CLI app we collect your name and e-mail address; the details you or your organization give us (city, job title, department); the survey answers, comments and app feedback you send; and your job applications and assessment requests. We use this to run the app and manage your account. Through the app we do not collect your location, contacts, files, audio, device identifiers, crash reports or diagnostics, and we do not use anything from the app for advertising or marketing. A profile photo you add stays on your device and is never uploaded. The app uses HTTPS only. You can delete your account in the app (My Profile, then Delete my account) or on our website, and you can ask us to delete your data without closing your account at [email protected]. The “Explore with sample data” mode sends nothing to us.
3. Payment information
Online payments are processed by third-party payment processors such as Stripe, Inc. When you pay, your card number, security code and bank details are sent directly to the processor over an encrypted connection and are handled under the Payment Card Industry Data Security Standard (PCI DSS). We do not receive or store full card numbers or security codes. We receive only what we need to record the transaction, issue receipts, handle refunds and prevent fraud. Stripe's use of your information is described in its privacy policy at stripe.com/privacy. Stripe may also use device and transaction data for fraud prevention.
4. How we use information
- To provide the Services: deliver assessments, generate reports and dashboards, operate accounts and give support.
- To process payments, send receipts and invoices, manage subscriptions, handle refunds and billing disputes, and prevent fraud.
- To keep the Services secure, including two-factor authentication, abuse detection and troubleshooting.
- To send transactional messages, such as assessment invitations, account notices, renewal reminders and changes to our terms.
- To produce de-identified, aggregate statistics for research, norms and benchmarking. Aggregate data cannot reasonably be used to identify you.
- To improve and develop the Services.
- To comply with legal, tax and accounting obligations and to enforce our agreements.
5. Legal bases for processing
Where laws such as the EU or UK General Data Protection Regulation apply, we rely on: performance of a contract (to provide the Services and process payments); legitimate interests (security, fraud prevention, improving the Services and aggregate research, balanced against your rights); legal obligation (tax, accounting and regulatory requirements); and consent (for example, optional marketing emails), which you can withdraw at any time.
6. Confidentiality of assessment and survey responses
- Individual Achieving Styles reports are shared only with the participant and with people the participant, or the agreement under which the participant was invited, authorizes — for example, a Certified Associate administering the assessment.
- When an organization purchases employee surveys, we report results to the employer only in aggregate. We do not identify individual respondents, free-text comments are de-identified, and we do not report results for any group with fewer than five respondents.
- Assessment results are not medical, psychological or clinical diagnoses and should never be the sole basis for decisions about a person.
- Before an assessment starts, the invitation and the consent screen tell the participant whether their individual report will be shared with the organization or associate that invited them. Without that notice, individual reports go only to the participant.
7. How we share information
We share personal information only as follows:
- Service providers that process data on our behalf under contracts requiring confidentiality and security: payment processing (such as Stripe), cloud hosting and databases, email delivery, customer support, and AI-model providers used for in-product interpretation.
- Your organization or Certified Associate, as described in Section 6.
- Legal and safety — when required by law, subpoena or court order, or to protect the rights, property or safety of CLI, our users or others, including to investigate fraud or a payment dispute.
- Business transfers — to a successor in a merger, acquisition or sale of assets, subject to this policy.
- With your consent or at your direction.
8. No sale of personal information
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use individual assessment responses for advertising.
9. Cookies and similar technologies
We use cookies and similar technologies that are necessary to run the Services: to keep you signed in, remember preferences, secure forms (for example, Google reCAPTCHA) and protect against attacks through our content-delivery and security provider (Cloudflare). Payment pages may use cookies set by our payment processor for fraud prevention. You can control cookies in your browser settings; blocking necessary cookies may stop parts of the Services from working.
Analytics and social-media tools. On some public pages we may also use analytics and social-media tools that are not strictly necessary: Google Analytics, provided by Google LLC, to count visits and see which pages are used; and Facebook / Meta tools, provided by Meta Platforms, Inc., to let you share a page. These tools set their own cookies and receive your IP address, browser information and the pages you visit. We do not use them on assessment pages, in reports, dashboards or account areas, and we never send them assessment answers or results. Where the law requires your consent, they load only after you agree in our cookie notice, and you can change your choice at any time from the link in the page footer. Google Analytics cookies last up to 2 years; Meta cookies up to 90 days. You can also opt out of Google Analytics with Google's browser add-on (tools.google.com/dlpage/gaoptout).
10. AI-assisted features
Some features, such as the AI Mentor and AI-assisted report interpretation, send the minimum data needed to answer your request to an AI-model provider. We use providers that contractually do not use our customers' data to train their general models. AI-generated content can contain errors and should be reviewed by a person.
11. Security
We protect personal information with administrative, technical and physical safeguards, including encryption in transit (TLS), hashed passwords, two-factor authentication, role-based access controls and access logging. No method of transmission or storage is completely secure, but we work to protect your information and will notify affected users and authorities of a data breach as required by law.
12. Retention
We keep personal information for as long as your account is active or as needed to provide the Services. Billing and transaction records are kept as long as tax and accounting laws require (generally seven years). Assessment data is kept for the term of the relevant agreement. After that it is deleted or de-identified, and the De-identified Data may be kept for norms and research as described in our Terms. We keep secure archive copies to protect against data loss. When we accept a request to delete your information, we delete or irreversibly de-identify it in our live systems and in our archives, except records we must keep by law.
13. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy in a portable format;
- correct inaccurate information;
- delete your information;
- restrict or object to certain processing;
- withdraw consent where we rely on it; and
- complain to your local data-protection authority.
To make a request, email [email protected] from the email address on your account. We will verify your identity and respond within 30 days (or sooner where the law requires). If your data was provided by your organization, we may refer your request to that organization as controller and help it respond. We will not discriminate against you for exercising your rights.
14. U.S. state privacy rights
Residents of California and other U.S. states with comprehensive privacy laws have the rights described in Section 13, including the right to know what categories of personal information we collect (listed in Section 2), the purposes (Section 4) and the categories of recipients (Section 7). We do not sell or share personal information as those laws define it, and we do not use sensitive personal information for purposes that would require an opt-out. You may use an authorized agent to make a request on your behalf.
15. International transfers
We are based in the United States, and our service providers may process data in the United States and other countries. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.
16. Children
The Services are intended for adults and are not directed to children under 18. We do not knowingly collect personal information from children under 18. If you believe a child has given us personal information, contact us and we will delete it.
17. Marketing emails
We send marketing emails only where permitted by law. Every marketing email includes an unsubscribe link, and you can also opt out by emailing us. Transactional messages about your account, purchases and subscriptions are still sent after you opt out of marketing.
18. Changes to this policy
We may update this Privacy Policy from time to time. We will post the new version on this page with a new "Last updated" date, and for material changes we will notify account holders by email before the changes take effect.
19. Contact us
For privacy questions or requests:
New York, NY, United States
20. How we record consent
When you start an assessment, we record the date, the version of these documents you saw and the consent you gave, so we can show what you agreed to.