Privacy Policy & Cookies Policy

1.1 Information You Provide Us

We collect information you provide directly to us through:

• Registering for a User Account
• Making a purchase or enrolling in any Online Course or coaching program
• Signing up for email updates
• Submitting requests or questions via forms or email
• Requesting customer support
• Providing materials for use in AI Agent Digital Twin Services

The types of data we collect include: name, address, telephone number and email address; log-in credentials; purchase and transaction information; demographic information; educational and work experience; career-related information; user-generated content; and any other information you choose to provide.

1.2 Information Collected for AI Agent Digital Twin Services

If you engage our AI Agent Digital Twin Services, we may collect and process additional categories of information, including:

• Text documents, written materials, presentations, and other content you submit for training or configuring your Digital Twin
• Audio and video recordings of your voice, likeness, and communication style (where provided)
• Professional background information including expertise areas, communication preferences, and decision-making frameworks
• Interaction data from Digital Twin sessions, including questions asked and responses generated
• Feedback and corrections you provide to improve Digital Twin accuracy

Sensitive Personal Information: We treat all materials submitted for Digital Twin creation as sensitive personal information. We do not use such materials for any purpose other than creating, maintaining, and improving your specific Digital Twin solution, unless you have expressly consented otherwise.

1.3 Information We Collect Through Automated Means

When you use our Services, we and our service providers may use cookies and similar technologies to collect information about your use of our website, including pages visited, time spent, IP address, browser software, and operating system. We also use third-party web analytics services such as Google Analytics.

Country at sign-up. When you create an account we record the two-letter country code supplied by our network provider for that request, alongside the IP address from which you accepted our terms. We use these to evidence your agreement and to work out which data-protection regimes apply to us. It is a country-level signal only, we do not derive a precise location from it and we do not use it to profile you.

1.4 Record of Your Agreement

When you create an account we record that you accepted these documents, the date and time, the version of the Terms and of this Privacy Policy shown to you, and whether you separately opted in to marketing. We keep this so that we can demonstrate what you agreed to, and so that you can ask us what that was.

We use your information to:

• Send you information in connection with the Services and respond to your communications
• Manage and process Online Courses and coaching engagements
• Provide AI Agent Digital Twin Services, including training, deploying, and maintaining Digital Twin models based on materials you provide
• Improve and refine Digital Twin accuracy and performance based on your feedback
• Contact you about products, services, surveys, research studies, promotions and events, where you have asked us to
• Customise the content we provide through the Services
• Engage in analysis, research, and reports regarding use of the Services
• Secure the Services and comply with applicable laws and regulations
• Establish, exercise, or defend our legal rights

AI Digital Twin Processing: Information you provide for Digital Twin Services is used solely to build and operate your Digital Twin and to fulfil our contractual obligations to you. We do not use your Digital Twin training data to train general-purpose AI models or to benefit other clients without your express written consent.

Marketing is separate from the Terms. We send promotional email only where you ticked the optional marketing box, or otherwise asked us to. Accepting our Terms of Service does not sign you up to marketing. You can withdraw at any time via the unsubscribe link in any such message, or by contacting us.

Where the UK GDPR or EU GDPR applies to you, we rely on the following legal bases. Where more than one could apply, we identify the primary one.

Where we rely on consent you may withdraw it at any time, which does not affect processing already carried out. Where we rely on legitimate interests you may object, see section 6.

Service Providers: We share your information with contractors and third-party service providers who perform services on our behalf, including the AI platform providers that power our coaching and Digital Twin solutions. They may process your information only on our instructions and only for the purpose we specify. We will publish any change to this set of providers at least 30 days before they begin processing member data, so that organisation customers have time to review and object.

AI Platform Providers: To deliver our AI coaching, Co-Pilot, voice session, and leadership diagnostic services we share personal data with:

• OpenAI, LLC (openai.com), receives your message text, conversation history, profile details (name, role, company), and leadership diagnostic scores to generate coaching responses and text-to-speech audio. Privacy policy
• Anthropic, PBC (anthropic.com), receives your message text, conversation history, profile details, sprint commitments, and extracted text from documents you choose to upload, to generate leadership coaching content and written deliverables. Privacy policy
• ElevenLabs, Inc. (elevenlabs.io), receives coaching session text to generate AI voice audio during Voice Sessions. Privacy policy
• Nanonoble Pte Ltd (MiniMax) (minimaxi.com), receives coaching session text to generate streamed AI voice audio during Voice Sessions. Privacy policy

Training on your content. Under the API terms on which we use them, OpenAI and Anthropic do not use the content we send them to train their models. We name those two specifically because those are the commitments we hold in writing. Our voice providers do not offer us the same commitment on our current plan, and may use the text sent to them to improve their own services. We therefore send them only the session text needed to produce that audio, never Digital Twin training material, never uploaded documents, and never your assessment responses. Every provider is contractually bound to process your data only for the purpose described above, and all data is transmitted over encrypted connections.

Sensitive Document Handling: When you choose to upload a document (such as a company strategy document or internal report) for gap analysis or Co-Pilot generation:

• The document is transmitted to our servers over an encrypted (TLS) connection
• Text is extracted from the document in-memory on our server and is never written to our database or cloud storage
• Only the extracted text (truncated to the relevant portion) is forwarded to the AI provider for that single request
• The extracted text is held temporarily in your browser or app session only and is discarded when the session ends
• You are not required to upload any document; this feature is entirely optional

Employers and Business Partners: We may share information with your employer or other business partners where you have enrolled in an employer-sponsored service. Section 10 sets out exactly what an employer can and cannot see from assessments and 360 feedback.

Protection and Legal Compliance: We may disclose information if required by law or in a good-faith belief that access is necessary to comply with legal process, enforce our Terms, respond to claims, or protect the rights, property, or personal safety of Stuart Andrews Consulting & Coaching LLC, its users, or the public.

Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, user information may be among the transferred assets.

Aggregate/Anonymous Information: We may share aggregated and anonymised information about use of the Services without restriction.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

We keep information no longer than is necessary for the purpose it was collected for. Where a period is enforced automatically by our systems, it is stated here.

Where we must keep information longer, for example for tax, accounting or legal-claim purposes, we keep only what is needed for that purpose.

Depending on your location, you may have the right to:

• Access and receive a copy of certain information we hold about you
• Update information which is out of date or incorrect
• Request deletion of certain information we hold about you (subject to legal obligations)
• Restrict the way that we process and disclose certain of your information
• Object to processing, including direct marketing and where we rely on legitimate interests
• Transfer your information to a third-party provider of services
• Revoke your consent for the processing of your information
• Lodge a complaint with your local supervisory authority

6.1 Doing it yourself, immediately

You do not need to write to us for the two most common requests. Signed in to your account, you can:

• Export your data. Returns a machine-readable file of your own records across conversations, usage, memory, enrolments, coaching sessions, check-ins, deliverables, community posts and diagnostics. Credentials and password data are never included.
• Delete your account. Permanently deletes your account and the associated records across the platform. This cannot be undone.

Digital Twin Rights: You may request deletion of training materials you submitted for Digital Twin creation. Deletion of training materials may result in degraded or discontinued Digital Twin functionality.

For anything else, contact us at [email protected]. We respond within one month.

We take technical, administrative, and physical measures to protect your information, including:

• Encryption of data in transit (TLS) and at rest
• Role-based access controls limiting who can view member data, training materials and Digital Twin configurations
• Audit logging of security-relevant actions, retained for 365 days
• Automated weekly dependency vulnerability scanning
• Regular security assessments of our systems and third-party providers
• Written data protection terms with every provider that processes member data

If there is a breach. We maintain a documented incident response plan. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will tell affected members without undue delay, describing what happened, what data was involved, and what we are doing about it.

Reporting a vulnerability. If you believe you have found a security issue, please tell us at [email protected]. Our machine-readable contact details are published at /.well-known/security.txt. We will not pursue action against good-faith researchers who report privately and allow us reasonable time to fix the issue.

No method of internet transmission or storage is completely secure, and we cannot guarantee absolute security.

We are established in the United States, and our application database and primary infrastructure are hosted there. Uploaded media files are stored on a distributed object-storage service which may hold copies at locations outside the United States. Our AI providers process data in their own regions, which may be outside your country.

Where personal data of individuals in the United Kingdom, the European Economic Area or Switzerland is transferred to us or to our providers, we rely on the following safeguards, rather than on your consent:

• The Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum where the UK GDPR applies; and/or
• The EU-US Data Privacy Framework and its UK extension, where the receiving provider is certified under it.

These safeguards are incorporated into our written agreement with each provider. Organisation customers may request a copy of the relevant terms.

Our AI Agent Digital Twin Services and Capability AI involve automated processing of personal data to generate AI model outputs. You have the right to:

• Request human review of significant decisions made using AI Digital Twin outputs
• Obtain an explanation of how AI Digital Twin models reach particular outputs
• Object to the use of automated processing in circumstances that significantly affect you

We do not use AI Digital Twin outputs as the sole basis for decisions that produce legal or similarly significant effects on individuals, without human oversight.

Where your organisation has commissioned an assessment, we act on that organisation's instructions for the assessment data. What your employer can see is deliberately limited, so that colleagues can answer honestly.

• Individual rater responses are not attributed by name to the subject or the employer in an aggregated report. Scores and written comments are grouped by rater role.
• Any rater role-group with fewer than three responses is withheld entirely, so no single colleague's answer can be identified or inferred from what is shown.
• Organisation-level dashboards apply the same three-response floor when comparing groups. Comparisons grouped by team may show smaller groups, because team membership is already known to the organisation, unless your organisation has enabled aggregated privacy mode, in which case the three-response floor applies there too.
• If you are invited as a rater, we create an account so that you can respond. You may request deletion of that account at any time under section 6.

If you are unsure what your organisation has enabled, ask us and we will tell you what applies to your assessment.

Our Services are intended for working professionals and are not directed at children. We do not knowingly collect personal information from anyone under 16 years of age, and you must confirm that you are 16 or older to create an account.

If you believe a child under 16 has provided us with personal information, please contact us at [email protected] and we will delete it.

We review our privacy practices from time to time and these practices are subject to change. Any change is effective upon posting on our website. You can tell whether this policy has changed by checking the "Last Updated" date at the top. Where a change materially affects how we use your information, we will tell you directly.

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work more efficiently, to provide a better user experience, and to give website owners information about how their site is being used.

We use cookies and similar technologies (including web beacons, pixels, and local storage) for the following purposes.

14.1 Strictly Necessary Cookies

Essential for the website to function. They cannot be switched off. Used for session management and authentication, security and fraud prevention, and load balancing.

14.2 Performance & Analytics Cookies

These let us count visits and measure performance. They are set only if you accept them.

• Google Analytics: Tracks pages visited, time on site, and referral sources. You can opt out via the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.
• Platform Analytics: Our course and coaching platform may set analytics cookies to track enrolment, course progress, and engagement metrics.

14.3 Functional Cookies

Enable enhanced functionality and personalisation, including language and region preferences, previously viewed content and course progress, and Capability AI session continuity.

14.4 Advertising Cookies, we do not use them

We do not run advertising or retargeting cookies on this website. Advertising and personalisation storage are switched off in our tag configuration at all times, including for visitors who accept analytics cookies. We do not build advertising profiles and we do not share your information for cross-context behavioural advertising.

Third parties whose cookies may operate on our site include:

• Google LLC (Analytics, Tag Manager, YouTube), policies.google.com/privacy
• Cloudflare, Inc. (security and bot protection), cloudflare.com/privacypolicy
• Stripe / PayPal (payment processing), cookies necessary to process payments securely
• EzyCourse (platform provider), cookies for platform functionality

16.1 Cookie Consent Banner

When you first visit our website you will be presented with a cookie consent banner. You can accept analytics cookies or decline, only strictly necessary cookies (security, payments) are always active. You can change your preference at any time by clicking Cookie Settings in the footer. Your choice is stored in your browser and remembered for future visits.

16.2 Browser Settings

Most browsers let you refuse cookies or alert you when cookies are being sent. Blocking all cookies may affect the functionality of our website.

16.3 Opt-Out Tools

• Google Analytics: tools.google.com/dlpage/gaoptout
• Network Advertising Initiative: optout.networkadvertising.org
• Digital Advertising Alliance (US): optout.aboutads.info
• Your Online Choices (EU/UK): youronlinechoices.eu

17.1 Australian Users (Privacy Act 1988)

Under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), you may request access to personal information we hold about you, request correction of that information, and complain about a breach of the APPs. Cookies that collect personal information are handled in accordance with this Privacy Policy.

17.2 European Union / EEA and United Kingdom Users

If you are located in the EU, EEA or the UK, we rely on your consent as the legal basis for placing non-essential cookies (Article 6(1)(a) GDPR). You may withdraw your consent at any time. You also have rights of access, rectification, erasure, restriction, portability and objection, set out in section 6, and the right to complain to your local supervisory authority.

17.3 California Users (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information is collected, to request deletion, to correct inaccurate personal information, and to non-discrimination for exercising your privacy rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, so no "Do Not Sell or Share My Personal Information" mechanism is required. You may exercise your other rights using section 6 or by contacting us directly.

For all privacy and cookies enquiries, please contact us at: