Privacy Policy

• Account and profile (required) — Your name, work email, role, seniority, industry and transformation stage. To sign you in, adapt the content and examples you see, and bill the right workspace.
• Exercise and reflection content (required) — Everything you write in assessments, exercises, sprints, org charts and reflections. It is your work product. We store it so you can come back to it and export it. Treated as sensitive by default.
• Chat conversations (required) — Messages you send the assistant and the answers it returns. To answer you and keep your thread readable. Excluded from analytics and from model training unless you opt in.
• Usage analytics (optional) — Pseudonymous page views, feature events and error reports. To find where the product breaks. Optional — off unless you turn it on.

We do not collect precise geolocation, biometric identifiers, health data, or information knowingly from anyone under 16.

Exercise free-text, reflections, sprint notes, chat conversations and powerbase entries can contain confidential strategy and personal opinions about named colleagues. We treat all of it as sensitive personal information by default. That means:

• It is excluded from analytics and telemetry at source, not filtered afterwards.
• It is never used to train or fine-tune models beyond answering you inside your own account, unless you explicitly opt in to assistant improvement.
• It is never disclosed to your organization's administrators unless both your organization has enabled individual visibility and you have switched it on yourself.
• It receives the same deletion guarantees as core account data.

Applied Practice Intelligence does not sell personal information, and does not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act as amended by the CPRA. You can still record a durable opt-out, and limit the use of your sensitive personal information, in the Privacy Center.

Wherever you live, we offer every user the same rights that California (CCPA/CPRA), Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA) and comparable state laws grant: to know what we hold, to get a portable copy, to correct it, to delete it, to opt out of sale, sharing and profiling, and to limit the use of sensitive personal information. Exercising a right never degrades your service or price.

Use the Privacy Center for immediate self-service, or email privacy@appliedpractice.ai. We respond within 45 days and will tell you if we need the permitted extension. An authorized agent may act for you with written permission. If we deny a request you may appeal by replying to our decision; we answer appeals within 45 days.

• Immediately on confirmation: Sign-in access is revoked on every device; Your profile is hidden from your organization's roster; Analytics collection stops and pending analytics events are dropped; Your content is excluded from every report and aggregate.
• Permanently erased after 30 days: Profile, role and industry data; Assessment scores, exercise responses, reflections and sprints; Org charts and powerbase entries you created; Chat conversations, including any assistant context derived from them; Notification and consent preferences.
• Retained longer, for stated legal reasons only: Security and access logs — up to 12 months, for fraud and intrusion investigation; Billing and tax records — as long as tax law requires, with content stripped; This deletion request and its consent log entry — proof we honoured your request.

When you join through an employer, that organization is the controller of program records it configures — the North Star, OKR cascade, module selection and aggregate maturity. Your individual answers remain yours. Administrators see anonymised aggregates by default, and your organization is told at onboarding what it can and cannot see.

We use infrastructure processors for hosting, database, authentication, email delivery and the assistant model. They act only on our instructions under written terms. No third-party advertising or marketing pixels are loaded by Praxis today; if that changes, we will re-request consent before any such cookie is set.

Data is encrypted in transit and at rest, access is row-level scoped so one account can never read another's records, and administrative access is logged. We will notify you in the app and by email before any material change to this notice takes effect, and re-request consent where the law requires it.