How Standard Practice handles your information.

Standard Practice runs the AI Workplace Exposure Assessment at aiworkplaceexposure.com and the company website at standardpracticeus.com. This policy says what information we collect through them, what we do with it, who else sees it, and what you can ask of us. It is written to be read.

The short version: we collect what the assessment needs to produce your report, we never learn which employee gave which survey answer, we do not sell or advertise with anyone’s information, and everything stays in the United States.

1. 01What we collect, and from whom

   Different parts of the service collect different things.

   • The assessment. The business details you enter (company name, website, industry, size, the states where people work, how the team works), your answers to the interview, and the name and email address you give us to receive your report or to set up the employee pulse. From these we generate your estimate, your report and your PDF, which we also store.
   • The employee pulse. Each employee’s answers to eight questions, and nothing else: no name, no email address, no IP address, no device details and no time of day (only the date). There is no way for us or for the employer to tell which employee answered what. Results are shown only as totals, only after the pulse has closed, and only if at least the minimum number of responses set for the pulse (never fewer than three) was reached.
   • Policy documents. If you buy a written policy, the details you give us to prepare it (the person who will own the policy and their title, the tools you approve, the states you operate in, headcount) and the documents we deliver.
   • Policy acknowledgements. If your employer rolls out a policy through us, each employee who signs it gives their name, and we record it with the date and the version of the policy they signed. This is not anonymous: a signature is the point, and your employer sees the register. It is kept separately from the employee pulse and nothing links the two.
   • Payments. Stripe collects your card details on its own pages. We receive the outcome of the payment, the amount, Stripe’s reference numbers and the email address used, and we keep a record of the order. We never see or store your full card number.
   • The company website. What you type into the contact, partner and Employer Brief forms: your name, email address, company, headcount, states and message.
   • Technical records. Our hosting provider keeps standard server logs (IP address, browser type, pages requested, times) for a short period for security and troubleshooting. We set cookies ourselves for three purposes only: if you arrive through a referral partner’s link, a cookie holding that partner’s code for 90 days; if you sign in to your account, a cookie that keeps you signed in for up to 30 days or until you sign out; and the cookies our own staff use to sign in to the administration area, which visitors never receive.
   • Referral partners. Firms such as accountants and brokers may share a link to the assessment. If you start an assessment within 90 days of following one, we record which partner referred it and pay that partner a share of anything you buy. The partner sees only counts and amounts: never your company’s name, your answers, your report or your contact details. Partners who sign up give us their firm’s name, a contact name and email, and their website.
   • Visit statistics. On the assessment’s public and owner pages and on the company website we use Google Analytics to count visits and see which pages are used. It sets its own cookies and receives the page address, your browser and device type, and an approximate location; Google does not keep your IP address. The private part of your report link is removed before anything is sent, Google’s advertising features are switched off, and Google Analytics is never loaded on the employee pulse, an employee’s policy page, the sign-in and account pages or our administration area. You can block it with your browser’s settings or Google’s opt-out add-on.
   • Accounts. If you sign in to keep your assessments and documents in one place, by an emailed link or with Google, we keep your email address, your name if you give it, the assessments you have a role in and what that role is (owner, editor or viewer), who invited you, and when you signed in. With Google we receive your name, your email address and Google’s confirmation that the address is yours, never your Google password. There is no password to store: each sign-in link works once, for 15 minutes, and we keep only a one-way fingerprint of it, never the link itself. The people who share an assessment with you see your name, email address and role on its People page.

2. 02What we use it for

   We use your information to run the service and for nothing unrelated to it.

   • To produce and deliver your estimate, your Reality Gap Report, your dashboard and any policy documents you buy.
   • To send the emails the service needs: your report link, receipts, notices that a pulse has closed, delivery of documents, and replies to your messages. If you sign up for the Employer Brief we send you that; ask us to stop at any time and we will.
   • To draft your business profile. We send the text of your public website and the business details you entered to Anthropic’s AI service, which returns a draft that you correct. For policy documents we send the details you gave us so that wording can be drafted for a partner to review. We do not send any employee’s survey answers to an AI service, and no AI service sets any score.
   • To improve the service, using totals and de-identified data that cannot identify your company or any person.
   • To keep the service secure, to prevent misuse, and to meet legal and accounting obligations.
   • To sign you in, to show you the assessments and documents you have a role in, and to let their owners see and change who has access. Signing in does not add you to any marketing or follow-up email.

3. 03Who else sees it

   We do not sell personal information and we do not share it with advertisers. The companies that help us run the service see only what their job requires.

   • Fly.io hosts the application on servers in Ashburn, Virginia.
   • Amazon Web Services hosts the database in Ohio.
   • Postmark delivers our email.
   • Stripe processes payments and holds the card details.
   • Anthropic provides the AI service described above and receives your website text and business details, not your employees’ answers.
   • Google provides Google Analytics, which receives the visit statistics described above and nothing from the employee pulse.
   • We may also disclose information when the law requires it, to protect the rights and safety of employees, customers or the public, or as part of a sale or reorganisation of the business, in which case this policy continues to apply.

4. 04If you answered an employee pulse

   Your employer sent you a link. Your answers are stored without anything that identifies you, and they are never shown to your employer or to us as individual answers, only as totals across everyone who responded, only after the pulse has closed, and only if at least three people (or the higher minimum set for that pulse) responded, so that no one can be singled out. Totals are not shown while the pulse is open, so no one can work out a single answer by watching them change. We do not record your IP address or your device, and we keep only the date you answered, not the time. If you have a concern about how the pulse was presented to you, email us at the address below; we will not tell your employer that you did.

5. 05How long we keep it

   We keep information until you ask us to delete it, except where a different period is given below.

   • Assessments and reports: until you ask us to delete them. Employee pulse answers are deleted three years after the pulse closes, or sooner on request; the totals already in your report stay with it.
   • Messages sent through the company website: until you ask us to delete them.
   • Orders and payment records: as long as accounting and tax law require. These are kept even if the assessment they belong to is deleted.
   • Policy acknowledgements: for as long as the policy they belong to is kept, because they are the record that it was acknowledged; your employer can ask us to delete an entry that was made in error.
   • Server logs: a short period, measured in weeks.
   • Accounts: until you ask us to delete yours. Sign-in links expire after 15 minutes and sessions after 30 days, and expired ones are removed. Removing someone from an assessment, or deleting the assessment, removes their role on it.

6. 06Your choices and rights

   You can ask us, at admin@aiworkplaceexposure.com, for a copy of the information we hold about you or your company, to correct it, or to delete it. Deleting an assessment deletes its report and its pulse answers. A PDF you downloaded, or that we emailed to you, stays wherever it was saved. If you paid for something through it, we keep the assessment with the order record as described above, and still delete the employee answers. We confirm requests through the email address on the assessment or message and answer within 45 days.

   Depending on where you live you may have further rights under state privacy law, including the right not to be treated differently for exercising them. Write to the same address; we honour those rights for everyone, wherever they live.

7. 07Security

   Every page is served over HTTPS. Reports, surveys and policy pages are reached through long, unguessable links rather than passwords; anyone who has your link can open your report, so keep it private and tell us if you think it has been shared. If you sign in to your account there is still no password: each sign-in link works once, for 15 minutes, a session ends when you sign out on that browser or everywhere, and what each person you invite can do is limited by the role you give them. Until an assessment is added to an account, anyone with its private link can open it; after that, only the people its owners have invited can, once signed in. Our staff reach the administration area only by signing in with an approved Google account or through a single-use sign-in link sent to an approved address. No system is perfectly secure; if we learn of a breach affecting your information we will tell you.

8. 08Where your information lives

   The service is operated from Georgia and hosted in Virginia and Ohio. If you use it from outside the United States, your information is transferred to and processed in the United States.

9. 09Children

   The service is for businesses and the people who run and work in them. It is not directed to anyone under 18 and we do not knowingly collect information from them.

10. 10Changes to this policy

    When we change this policy we post the new version here with a new date. If a change matters to people who have an open report or an open order, we email the address on file.

11. 11How to reach us

    Email admin@aiworkplaceexposure.com. Messages reach a person at Standard Practice, Georgia, USA.