How Standard Practice handles your information.

Standard Practice runs the AI Workplace Exposure Assessment at aiworkplaceexposure.com. This policy is for the Canadian edition at aiworkplaceexposure.com/ca. It says what personal information we collect, why, who else sees it, where it is stored, and what you can ask of us. It is written to be read.

The short version: we collect what the assessment needs to produce your report, we never learn which employee gave which survey answer, we do not sell or advertise with anyone’s information, and your information is stored and processed in the United States.

1. 01What we collect, and from whom

   Different parts of the service collect different things.

   • The assessment. The business details you enter (company name, website, industry, size, the provinces where people work, how the team works), your answers to the interview, and the name and email address you give us to receive your report or to set up the employee pulse. From these we generate your estimate, your report and your PDF, which we also store.
   • The employee pulse. Each employee’s answers to eight questions, and nothing else: no name, no email address, no IP address, no device details and no time of day (only the date). There is no way for us or for the employer to tell which employee answered what. Results are shown only as totals, only after the pulse has closed, and only if at least the minimum number of responses set for the pulse (never fewer than three) was reached.
   • Payments. Stripe collects your card details on its own pages. We receive the outcome of the payment, the amount, Stripe’s reference numbers and the email address used, and we keep a record of the order. We never see or store your full card number.
   • Technical records. Our hosting providers keep standard server logs (IP address, browser type, pages requested, times) for a short period for security and troubleshooting. When you visit the assessment’s home page we look up the country of your IP address in a database held on our own server, to show you the right edition; the result is not stored. We set cookies ourselves for three purposes only: to remember the edition you chose (United States or Canada), to hold a referral partner’s code for 90 days if you arrive through a partner’s link, and to sign in our own staff to the administration area; visitors never receive those.
   • Visit statistics. On the assessment’s public and owner pages we use Google Analytics to count visits and see which pages are used. It sets its own cookies and receives the page address, your browser and device type, and an approximate location; Google does not keep your IP address. The private part of your report link is removed before anything is sent, Google’s advertising features are switched off, and Google Analytics is never loaded on the employee pulse or our administration area. You can block it with your browser’s settings or Google’s opt-out add-on.

2. 02Why we collect it, and what we use it for

   We collect and use your information only for these purposes, and we ask for nothing the service does not need.

   • To produce and deliver your estimate, your Reality Gap Report, your dashboard and any policy documents you buy.
   • To send the emails the service needs: your report link, receipts, notices that a pulse has closed, delivery of documents, and replies to your messages.
   • After a free estimate, to send you up to three short follow-up emails about your results over the following weeks. Each one says who we are, gives our mailing address and has a link that stops the rest at once.
   • To draft your business profile. We send the text of your public website and the business details you entered to Anthropic’s AI service, which returns a draft that you correct. We do not send any employee’s survey answers to an AI service, and no AI service sets any score.
   • To improve the service, using totals and de-identified data that cannot identify your company or any person.
   • To keep the service secure, to prevent misuse, and to meet legal and accounting obligations.

3. 03Your consent

   By entering your information and using the service you consent to us collecting, using and disclosing it as this policy describes. You may withdraw your consent at any time by writing to us; we will tell you what withdrawing means for the service (for example, we cannot produce a report without the answers it is built from). Employers who send the employee pulse are responsible for telling their team what it is for; the survey itself explains to each employee how their answers are handled before they answer.

4. 04Who else sees it

   We do not sell personal information and we do not share it with advertisers. The companies that help us run the service process it on our behalf, only for that purpose, and see only what their job requires.

   • Fly.io hosts the application on servers in Ashburn, Virginia.
   • Amazon Web Services hosts the database in Ohio.
   • Postmark delivers our email.
   • Stripe processes payments and holds the card details.
   • Anthropic provides the AI service described above and receives your website text and business details, not your employees’ answers.
   • Google provides Google Analytics, which receives the visit statistics described above and nothing from the employee pulse.
   • We may also disclose information when the law requires it, to protect the rights and safety of employees, customers or the public, or as part of a sale or reorganization of the business, in which case this policy continues to apply.

5. 05Where your information is stored

   Standard Practice is based in Georgia, USA, and everything above is stored and processed in the United States. While it is there it is protected as this policy describes, but it is subject to the laws of the United States and may be accessible to courts, law enforcement and national security authorities there under those laws.

   For residents of Alberta and anyone else who asks: our privacy officer, reachable at admin@aiworkplaceexposure.com, answers questions about how our service providers outside Canada collect, use, disclose and store personal information, and will send you our written policies and practices on using them.

6. 06If you answered an employee pulse

   Your employer sent you a link. Your answers are stored without anything that identifies you, and they are never shown to your employer or to us as individual answers, only as totals across everyone who responded, only after the pulse has closed, and only if at least three people (or the higher minimum set for that pulse) responded, so that no one can be singled out. Totals are not shown while the pulse is open, so no one can work out a single answer by watching them change. We do not record your IP address or your device, and we keep only the date you answered, not the time. If you have a concern about how the pulse was presented to you, email us at the address below; we will not tell your employer that you did.

7. 07How long we keep it

   We keep information until you ask us to delete it, except where a different period is given below.

   • Assessments and reports: until you ask us to delete them. Employee pulse answers are deleted three years after the pulse closes, or sooner on request; the totals already in your report stay with it.
   • Orders and payment records: as long as accounting and tax law require. These are kept even if the assessment they belong to is deleted.
   • Server logs: a short period, measured in weeks.

8. 08Your rights

   You can ask us, at admin@aiworkplaceexposure.com, for access to the personal information we hold about you or your company, to correct it, or to delete it. Deleting an assessment deletes its report and its pulse answers. A PDF you downloaded, or that we emailed to you, stays wherever it was saved. If you paid for something through it, we keep the assessment with the order record as described above, and still delete the employee answers. We confirm requests through the email address on the assessment and answer within 30 days.

   If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada, or in British Columbia or Alberta to that province’s Information and Privacy Commissioner.

9. 09Security, and if something goes wrong

   Every page is served over HTTPS. Reports, surveys and policy pages are reached through long, unguessable links rather than passwords; anyone who has your link can open your report, so keep it private and tell us if you think it has been shared. Our staff reach the administration area only by signing in with an approved Google account or through a single-use sign-in link sent to an approved address. No system is perfectly secure. If a breach of our safeguards creates a real risk of significant harm to you, we will tell you and report it to the Privacy Commissioner of Canada as the law requires.

10. 10Quebec

    The Canadian edition is not yet offered to businesses in Quebec. It will be, in French, once it meets Quebec’s language and privacy laws.

11. 11Children

    The service is for businesses and the people who run and work in them. It is not directed to anyone under 18 and we do not knowingly collect information from them.

12. 12Changes to this policy

    When we change this policy we post the new version here with a new date. If a change matters to people who have an open report or an open order, we email the address on file.

13. 13Our privacy officer

    The person accountable for privacy at Standard Practice can be reached at admin@aiworkplaceexposure.com. Messages reach a person at Standard Practice, Georgia, USA.