Privacy Policy

Effective September 03, 2026.

This Privacy Policy explains how Workforce Catalyst LLC (**“Workforce Catalyst,” “we,” “us,”** or **“our”**) collects, uses, discloses, and retains personal information through the Workforce Catalyst website and Services. Workforce Catalyst provides business software to organizations. For account, billing, website, support, and business-contact information, Workforce Catalyst generally determines the purposes of processing. For employee, survey, workplace, meeting, assessment, scorecard, Issue Coach, and similar information submitted by a customer organization (**“Customer Personal Data”**), Workforce Catalyst generally processes the information for the customer as a service provider or processor. The customer organization determines why the information is processed and is responsible for its own employee notices, lawful basis, and privacy obligations. ## 1. Scope This Policy applies to the Workforce Catalyst website, platform, accounts, contact and lead forms, subscriptions, surveys, assessments, workplace tools, AI features, support, and related Services. It does not govern a customer's independent practices or third-party websites and services. The Services are available only for business and professional use in the United States. ## 2. Information We Collect Depending on how the Services are used, we collect the following categories. ### 2.1 Account and Identity Information Names, business email addresses, passwords in hashed form, account status, email-verification status, login timestamps, failed-login information, password-reset records, session information, organization memberships, roles, and permissions. ### 2.2 Organization and Professional Information Organization name, industry, employee and manager counts, location counts, professional role, organization settings, onboarding responses, plan selection, and authorized-user information. ### 2.3 Employee Roster Information Information submitted by a customer about employees or workers who may not have accounts, such as name, business email address, employee number, job title, assigned manager, team, department, and active status. ### 2.4 Workplace Content Information entered into Issue Coach, one-on-one records, team meetings, tasks, roadmaps, scorecards, goals, worksheets, accountability records, generated documents, notes, and uploaded files. This may include performance information and allegations or descriptions involving conduct, safety, discrimination, harassment, retaliation, accommodations, leave, or other workplace matters when a customer chooses to enter them. Customers should minimize personal details and must not submit prohibited regulated or highly sensitive information described in the Terms and Acceptable Use Policy. ### 2.5 Surveys and Assessments Survey questions, anonymous answers, optional free-text comments, invitation and completion status, assessment answers, deterministic scores, scoring bands, perception gaps, leadership-awareness scores, recommendations, and roadmap assignments. Anonymous survey responses are stored separately from employee identity and invitation records. Response content does not contain the employee's name, email, employee ID, invitation ID, token, IP address, or user agent. Results are withheld until at least five responses are included. Invitation records may identify who was invited and whether the invitation was completed, but they are not linked to response content. Free-text comments may identify a person if the respondent includes identifying details. We instruct users not to identify themselves or others unnecessarily. ### 2.6 AI Information For Issue Coach AI guidance, the AI provider may receive a job title and the case description, evidence, previous actions, business impact, and desired outcome submitted by the user. For assessment explanations, the AI provider may receive scores, scoring bands, and rule-based recommendation text. Workforce Catalyst stores generated output and related operational records. The underlying source information remains stored in the relevant feature. We do not use identifiable Customer Content to train third-party generative-AI models or Workforce Catalyst models without explicit written permission. Our commercial AI provider states that commercial API inputs and outputs are not used for model training by default. Provider retention and security practices are governed by our commercial account, configuration, and provider terms. ### 2.7 Billing and Transaction Information Plan, billing interval, subscription status, trial and renewal dates, Stripe customer and subscription identifiers, employee-count quantities, payment status, invoice and transaction metadata, and billing-contact information. Payment-card and bank details are collected directly by Stripe and are not stored by Workforce Catalyst. ### 2.8 Communications and Support Name, email address, contact category, subject, message, support requests, responses, attachments, and other information submitted through contact, support, sales, billing, or feedback channels. ### 2.9 Website Analytics, Search Performance, Device, Security, and Technical Information On public website pages where Google Analytics is enabled, we may collect or derive page URLs and titles, referring pages, dates and times of visits, pages viewed, interactions and events, approximate geographic area, browser and device type, operating system, screen resolution, language, and a pseudonymous client identifier. Google may receive an IP address during transmission to provide and secure Analytics and to derive general geographic information; Google states that Google Analytics 4 does not log or store individual IP addresses. We use Google Search Console to monitor how public Workforce Catalyst pages appear and perform in Google Search. Search Console may provide aggregated search queries, impressions, clicks, referring links, indexing status, and technical information about public pages. Search Console verification does not add a visitor-tracking cookie to Workforce Catalyst pages. We also collect IP address, user agent, request identifier, authentication and session activity, security and audit events, route or page requested, error details, and other logs needed to operate and protect the Services. We do not intentionally send names, email addresses, employee records, survey answers, assessment content, Issue Coach content, meeting notes, uploaded files, or other Customer Personal Data to Google Analytics. We do not currently use advertising pixels, session replay, browser fingerprinting, remarketing, or cross-site behavioral tracking. ### 2.10 Consent and Legal Records Policy type and version, content hash, accepted timestamp, IP address, user agent, acceptance context, attestation text, organization, and representation of authority. ## 3. Sources of Information We obtain information: - directly from account holders, customers, employees, survey respondents, prospects, and support contacts; - from a customer's authorized users and employee roster; - automatically from browsers, devices, website analytics, search-performance reports, and security logs; - from payment, hosting, email, storage, AI, analytics, search, and error-monitoring providers; and - from integrations or other parties a customer directs us to use. ## 4. How We Use Information We use personal information to: - create and secure accounts and organizations; - authenticate users and enforce permissions; - provide surveys, assessments, reports, roadmaps, workplace tools, files, AI features, and other Services; - send invitations, security notices, service messages, billing notices, and support communications; - process subscriptions, quantities, renewals, cancellations, and payments; - provide consulting or Guided Partnership services; - respond to requests and provide support; - understand use of our public website, measure traffic and engagement, evaluate marketing performance, and improve website content and navigation; - monitor public-page indexing, search visibility, search queries, impressions, clicks, and technical issues through Google Search Console; - monitor availability, debug errors, prevent fraud and misuse, and protect customers and the Services; - maintain audit, consent, billing, tax, and legal records; - comply with law, legal process, and enforce our agreements; - develop and improve the Services using feedback and appropriately aggregated or de-identified information; and - create benchmarking or research that cannot reasonably identify a person, customer, or organization. We do not use Workforce Catalyst to make autonomous employment decisions. Assessment scoring is deterministic, and AI-generated text does not alter the underlying scores or rules. ## 5. How We Disclose Information We may disclose information as follows. ### 5.1 Customer-Authorized Access Information is available to authorized users in the relevant customer organization according to configured roles, permissions, assignments, and feature rules. Customers control many access decisions. Workforce Catalyst personnel may access information when reasonably necessary for support, security, consulting, legal compliance, or service operations, subject to confidentiality and access controls. ### 5.2 Service Providers and Subprocessors We use providers for hosting and database services, payment processing, transactional email, AI generation, file storage, website analytics, search-performance monitoring, error monitoring, and related operations. Google provides Google Analytics and Google Search Console. These providers receive information needed to perform their services and process it under their applicable terms and privacy commitments. Provider categories that process Customer Personal Data on our behalf are described in the Data Processing Addendum. ### 5.3 Legal, Safety, and Enforcement We may disclose information when we reasonably believe it is necessary to comply with law or valid legal process; protect rights, safety, or security; investigate fraud, illegal activity, or Terms violations; respond to an emergency; or establish, exercise, or defend legal claims. ### 5.4 Business Transactions Information may be disclosed in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to appropriate confidentiality protections and applicable law. ### 5.5 Aggregated or De-identified Information We may disclose information that has been aggregated or de-identified so that it cannot reasonably identify a person, customer, or organization. We will not attempt to re-identify it. ## 6. No Sale, Targeted Advertising, or Significant-Decision Profiling Workforce Catalyst does not sell personal information for money. We do not share personal information for cross-context behavioral advertising, use personal information for targeted advertising, or use personal information to profile individuals in furtherance of decisions that produce legal or similarly significant effects. We do not knowingly sell or share personal information of anyone under 16. If our practices change, we will update this Policy and provide legally required choices before the change applies. ## 7. AI Data Practices AI features process only the information needed for the requested output. Customer is responsible for deciding what to enter. Do not include unnecessary names, medical details, protected-class information, government identifiers, financial credentials, or other prohibited information in AI inputs. AI outputs and operational logs may be retained with the related customer account until deleted under the account or organization deletion process or as otherwise described below. AI outputs may be reviewed by authorized Workforce Catalyst personnel when necessary for support, security, quality, consulting requested by Customer, or legal compliance. We do not conduct routine human review of every AI interaction. ## 8. Retention and Deletion We retain information for as long as reasonably necessary to provide and secure the Services, maintain the customer relationship, comply with law, resolve disputes, and enforce agreements. Retention depends on the type of information and context. - Active account and Customer Content is generally retained while the account or organization remains active. - Resolved support information may be deleted or de-identified under operational retention schedules. - Policy-acceptance, audit, billing, tax, security, fraud-prevention, and legal records may be retained after account closure when reasonably necessary. - Stripe retains payment and transaction records under its own legal and operational requirements. - AI outputs are retained with the related feature unless deleted through the organization purge process or another applicable deletion process. - Google Analytics data is retained according to the retention settings configured for our Analytics property and Google's applicable terms. Search Console information is retained according to Google's applicable settings and terms. When an authorized owner requests organization deletion, the organization is deactivated and enters a 30-day recovery period. During that period it may be restored. After the recovery period, permanent deletion begins following eligibility and safety verification. The purge process deletes or irreversibly anonymizes tenant content and stored files, subject to technical completion and permitted legal retention. Individual account deletion may anonymize identity fields when a record must remain to preserve audit integrity. Backup copies are protected and isolated from ordinary use and expire according to provider backup schedules. Information may remain in backups until overwritten but will not be restored to active use except for disaster recovery, legal necessity, or security purposes. ## 9. Security We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including access controls, role-based permissions, tenant isolation, password hashing, session protections, anti-forgery controls, security headers, audit logging, upload restrictions, and provider-managed transport and infrastructure protections. Security controls evolve over time. No method of transmission or storage is completely secure. Customers are responsible for their account security, user access, device security, and appropriate use of exports. ## 10. Privacy Rights and Choices Depending on where you live and which law applies, you may have rights to: - confirm whether we process your personal information; - access or obtain a copy of personal information; - correct inaccurate information; - delete information, subject to exceptions; - obtain portable information; - opt out of sale, sharing, targeted advertising, or certain profiling; - limit certain uses of sensitive information; - appeal a denied privacy request; and - receive equal service and pricing when exercising privacy rights. Workforce Catalyst does not engage in sale, cross-context behavioral-advertising sharing, targeted advertising, or significant-decision profiling, so there is currently no separate opt-out mechanism for those practices. You may block or delete Google Analytics cookies through your browser settings. Google also provides a Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout. Blocking analytics cookies should not prevent use of the Services, although it may reduce the accuracy of our website measurements. To make a request, use available account deletion or export functions or email dyami.pike@theworkforcecatalyst.com. Identify the account, organization, and right you wish to exercise. We may request information reasonably necessary to verify identity and authority. We will use verification information only for that purpose and will respond within the period required by applicable law. When Workforce Catalyst processes Customer Personal Data for an employer or customer, the customer generally controls the information and privacy request. We may refer the request to that customer and assist it as required. Employees should first contact their employer for requests involving employer-submitted records. An authorized agent may submit a request where permitted by law, subject to proof of authority and identity verification. We will not discriminate for exercising a privacy right. ## 11. California Notice This section applies only if the California Consumer Privacy Act, as amended (**“CCPA”**), applies to Workforce Catalyst and the relevant information. The categories collected are described above and may include identifiers; customer records; commercial and subscription information; internet or electronic-network activity; professional or employment information; inferences represented by scores or recommendations; and sensitive personal information that a customer chooses to include in workplace content. Sources, purposes, retention criteria, and recipient categories are also described above. Workforce Catalyst does not sell or share personal information as those terms are defined by the CCPA and does not use sensitive personal information to infer characteristics outside providing and securing the Services. California residents may request access, deletion, correction, and limitation as applicable and may receive information about categories collected, sources, purposes, and recipients. Workforce Catalyst does not discriminate for exercising CCPA rights. For Customer Personal Data, Workforce Catalyst acts as a service provider or contractor where the CCPA applies and processes that information under the Data Processing Addendum and Customer's instructions. ## 12. Children and Teen Employees Account holders must be at least 18. The Services are not directed to children under 13, and we do not knowingly collect personal information online from children under 13. If we learn that we collected such information, we will delete it as required. An employee under 18 may complete an employer-sponsored survey without creating an account. Customer is responsible for determining whether additional notice or consent is required for teen employees under applicable workplace, privacy, or education laws. ## 13. Data Breach Notice We maintain incident-response procedures and will provide notices to customers, affected individuals, or authorities when required by applicable law. Customers must maintain accurate contact information so we can deliver security notices. ## 14. Changes to This Policy We may update this Policy prospectively. The platform will display the current version and effective date. We will provide reasonable notice and request renewed acknowledgment when a material change requires it. ## 15. Contact Workforce Catalyst LLC · 4919 W Stanford St · Springfield, Missouri 65802 · United States Email: dyami.pike@theworkforcecatalyst.com