Privacy Policy

1.1 Account and Registration Information:

• Name and email address
• Organization name
• Job title or role (optional)
• Password credentials (managed and encrypted by Clerk)
• Billing information (processed by Stripe — we do not store payment card numbers)

1.2 Customer Data entered into the Service:

• Initiative names, descriptions, and configurations
• Activity completions and responses across the 26 initiative activities
• Role definitions, escalation paths, governance structures, and other initiative-specific content
• User-generated text entered into any platform field

Some activities record information about people other than the account holder — for example initiative participants, stakeholders, and sponsors. This may include their name, work email, department and job title; any accommodations they need in order to take part; their preferred working and communication style; assessments of their engagement, influence, or sentiment; and, where the customer uses the Pay for Performance activity, performance ratings and compensation amounts. This information is entered by the customer, not collected by us from the individual. The customer is responsible for ensuring it has a lawful basis and any necessary permissions to enter this information, and for meeting its own obligations to the people described.

1.3 Usage Data (collected automatically):

• Pages visited and features accessed
• Activity completion events and timestamps
• Session duration and frequency of use
• Browser type, operating system, and device type
• IP address and approximate geographic location (country/region)

1.5 Information from Prospective Customers: If you submit an enquiry form on our website without registering for the Service (for example, the consulting practice enquiry form), we collect and retain:

• Name and email address
• Firm or organization name
• Information you choose to provide about your engagements or interests

We use this solely to respond to your enquiry and to evaluate demand for planned offerings. You may request deletion at any time by contacting support@initiativeos.com.

2.1 Providing and Operating the Service:

• Authenticating users and managing account access
• Delivering platform features including initiative management, AI coaching, and analytics
• Processing subscription payments and managing billing
• Maintaining platform security and preventing unauthorized access

2.2 AI Coaching and Platform Intelligence:

• Your Customer Data is used at runtime to generate AI Coaching Output personalized to your initiative. This data is passed to our AI provider (Anthropic, PBC) as part of each coaching request. Under Anthropic's commercial terms, this data is not used to train Anthropic's models and is retained only for a limited period for trust and safety purposes.
• Anonymized, aggregate patterns derived from activity completion data across all platform users may, in the future, be used to enrich coaching quality and develop platform intelligence features (see Section 3). As of the date of this policy, no such cross-customer data is used — AI coaching is generated solely from your own organization's initiative data.
• We do not use your Customer Data to train, fine-tune, or modify any AI or machine learning models. AI coaching is generated at runtime using contextual prompts, not by training on your data.

2.3 Improving the Service:

• Analyzing usage patterns to improve platform features
• Developing new features and activities
• Monitoring platform performance and reliability

2.4 Communications:

• Transactional emails (account confirmation, billing notifications)
• Trial engagement reminders during your free trial (Day 3, 7, 12, and 14)
• Notifications of material changes to this Policy or Terms
• Responding to support requests

2.5 Legal and Compliance:

• Enforcing our Terms of Service
• Complying with applicable laws and regulations
• Responding to lawful legal processes
• Protecting the rights and safety of InitiativeOS and its users

4.1 Service Providers (Sub-Processors):

• Clerk, Inc. — Authentication and user identity management. clerk.com/privacy
• Stripe, Inc. — Payment processing and subscription management. stripe.com/privacy
• Anthropic, PBC — AI model provider. Customer Data is transmitted to Anthropic's API at runtime to generate AI Coaching Output. Under Anthropic's commercial terms, this data is not used to train its models and is retained only for a limited period for trust and safety purposes. anthropic.com/privacy
• Supabase, Inc. — Database hosting. Data stored in the United States.
• Vercel, Inc. — Application hosting. vercel.com/legal/privacy-policy
• Amazon Web Services — Email delivery via AWS SES.
• Functional Software, Inc. (Sentry) — Application error monitoring and performance tracing. Receives error reports, stack traces, and request metadata. On a sample of sessions in which an error occurs, Sentry captures a replay of the affected browser session; text content is masked by default and we have disabled the collection of default personally identifying data such as IP addresses and cookies. sentry.io/privacy
• Macropod Software Pty Ltd (BugHerd) — Website feedback and issue-reporting widget. Loaded only on our public marketing, sign-in, and sign-up pages; it is not loaded inside the authenticated application. bugherd.com/privacy
• Descript, Inc. — Hosts the embedded product demonstration videos on our marketing site. descript.com/privacy
• GoDaddy.com, LLC and Microsoft Corporation — Hosting of our business email accounts, including messages you send to our published contact addresses. godaddy.com/legal
• Proofpoint, Inc. — Inbound email filtering and security for our business email accounts.

6.1 Safeguards we maintain:

• Encrypted data transmission using TLS/HTTPS
• Logical multi-tenant data isolation at the application layer
• Authentication managed through Clerk
• Database access restricted to authenticated application processes
• Payment data handled exclusively by Stripe

8.1 Cookies we use:

• Authentication cookies — set by Clerk to maintain login session. Strictly necessary.
• Preference cookies — to remember settings and preferences.
• Attribution cookie — a short-lived cookie recording how you arrived at our site (for example, a campaign referrer), read once when your organization is created and then deleted.
• Diagnostic storage — set by Sentry to correlate error reports from a single browser session.

We do not use advertising cookies, and we do not operate a general-purpose website analytics product.