CARE 360 Privacy Policy

In Good Company Collective, LLC Last updated: [DATE] DRAFT — For attorney review before publication.

1. Overview

This Privacy Policy explains how In Good Company Collective, LLC ("IGC," "we," "us") collects, uses, and protects information in connection with CARE 360. It applies to three different kinds of people who interact with the platform, and their experience under this policy is not identical, because their relationship to the platform is not identical:

  • Account holders, who sign up for CARE 360 on behalf of their organization;

  • Leaders, who are being assessed through a 360-feedback process; and

  • Raters, who provide anonymous feedback about a leader.

2. Information We Collect

2.1 From Account Holders

When you create an account, we collect your name, email address, organization name, and billing information (processed by our payment provider, Stripe; we do not store full payment card numbers ourselves).

2.2 About Leaders

An account holder provides a leader's name, title, email address, and department when adding them to a Group. This information is used solely to administer that leader's feedback process.

2.3 From and About Raters

A rater's name and email are provided by the account holder in order to send them a survey invitation. Once a rater submits their responses, their identity is not linked to their responses anywhere a person using the platform can see it. IGC's database retains a technical association between a rater record and their submitted responses in order to compute accurate group averages and to enforce the rule that each survey can be submitted once; this association is not exposed through the product interface to any account holder, leader, or other user under any circumstance described in Section 2.4 below.

2.4 IGC's Own Access

See Section 5.3 of our Terms of Service, which governs when IGC personnel may access the substantive content of Feedback Data. In summary: not in the ordinary course of providing the Service, only with the account holder's explicit permission for troubleshooting, or where legally required.

2.5 Automatically Collected Information

We collect standard technical information such as IP address, browser type, and usage timestamps for security and operational purposes, consistent with typical web application logging.

3. How We Use Information

We use collected information to:

  • Operate and maintain the CARE 360 platform;

  • Send survey invitations, reminders, and completion notices;

  • Generate feedback reports, including through a third-party AI service (see Section 6);

  • Process payments and manage subscriptions;

  • Communicate with account holders about their account, including product updates and support;

  • Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use Feedback Data to train any AI model beyond the immediate generation of the report it was submitted for.

4. How Long We Keep Information

Feedback Data is retained for the duration of an active account and for a limited period after cancellation, as described in Section 5.4 of our Terms of Service, to allow for account reactivation and data export requests. After that period, it is permanently deleted from active systems.

[NOTE FOR ATTORNEY / ABBIE: this section should reflect the account's actual database backup and retention posture once finalized. As of this draft, CARE 360 does not have automated backups in place; that should be resolved operationally before this policy is published, since a retention policy is only meaningful if backup and deletion practices actually match it.]

5. Third-Party Service Providers

CARE 360 relies on the following categories of third-party providers to operate. Each processes a limited slice of information necessary to perform its function, and each is bound by its own data protection terms:

Provider Function Data Involved Supabase Database and authentication All account and Feedback Data Resend Transactional email delivery Email addresses, names Anthropic AI-generated report narrative Aggregated scores and comments submitted for a report Stripe Payment processing Billing information Railway Application hosting All data in transit and at rest on the platform

[CONFIRM: exact list of subprocessors before publishing; update if infrastructure changes.]

6. AI Processing

When a report is generated, the relevant scores and written comments for that report are sent to Anthropic's API to generate the narrative sections of the report. This is done under Anthropic's commercial API terms, which do not permit Anthropic to use API data to train its models. No rater-identifying information is included in this process, consistent with Section 2.3 above.

7. Your Rights

Depending on your location, you may have rights to access, correct, or delete personal information we hold about you, or to receive a copy of it in a portable format. Account holders can exercise these rights for their organization's data directly within the platform or by contacting [info@ingoodcocollective.com]. Individual leaders or raters with questions about their own information should contact the account holder who invited them, since IGC's relationship for a given Feedback Data set is with the account holder's organization, not directly with individual raters.

[CONFIRM: whether any current or anticipated customers are based in jurisdictions with specific statutory rights regimes, e.g., GDPR (EU/UK) or CCPA (California), since this section will need jurisdiction-specific detail if so.]

8. Security

We use industry-standard measures to protect information, including encrypted connections, database-level access controls, and account isolation between organizations using the platform. No system is perfectly secure, and we cannot guarantee absolute security.

9. Children's Privacy

CARE 360 is a workplace tool intended for use by adults in an employment context. It is not directed at, and we do not knowingly collect information from, individuals under 18.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notice at least 14 days before taking effect.

11. Contact

Questions about this policy can be directed to [info@ingoodcocollective.com].

This document is a working draft prepared for attorney review and is not a final legal document. Do not publish or rely on this version until reviewed by qualified legal counsel.