Privacy Policy

1. Scope

This Privacy Policy explains how Six Pillars Model collects, uses, discloses, stores, and protects personal information when you visit sixpillarsmodel.com, create an account, create or join an organization workspace, communicate with us, or use Six Pillars Model and Ask 6PM services.

By creating an account or organization workspace, you acknowledge that you have read this policy. Separate choices apply to optional communications, analytics where required, and Shared Learning.

2. Information We Collect

We collect only information reasonably needed to operate, secure, support, and improve the services you choose to use.

• Account information, including your name, email address, password hash, verification status, role, organization membership, and account preferences.
• Organization information, including organization name, verified domain, administrator, members, invitations, workspace settings, and consent records.
• Service content, including assessment responses, conversations, uploaded files, feedback, improvement plans, and other information you submit.
• Communication information, including inquiries, newsletter preferences, messages, and records of service emails.
• Technical and security information, including page paths, referring domain, device or browser information, approximate location where provided by an analytics service, security-event records, and pseudonymous or hashed network identifiers.
• Policy records, including the policy version and content hash you acknowledged, your user and organization identifiers where applicable, and the date and time of acknowledgement.

3. How We Use Information

We use personal information only for reasonable, identified purposes.

• Create, verify, secure, and administer accounts and organization workspaces.
• Provide assessments, Ask 6PM responses, improvement tools, articles, downloads, and other requested services.
• Send verification, password-reset, invitation, service, inquiry, and optional newsletter communications.
• Prevent fraud, spam, abuse, unauthorized access, and other security threats.
• Maintain audit records, troubleshoot problems, measure service performance, and improve usability.
• Comply with legal obligations, enforce agreements, and protect the rights and safety of users, Six Pillars Model, and others.

4. Consent And Your Choices

We seek consent in a form appropriate to the information and purpose. Required processing is limited to what is necessary to provide and secure the requested service. You may decline optional processing without losing access to the private core service.

You may withdraw consent to optional processing at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal does not invalidate processing that occurred before it took effect.

• Newsletter and marketing messages are optional and include an unsubscribe method.
• Shared Learning is optional, disabled by default, and governed by a separate consent.
• If optional analytics requires consent, it must be presented separately from account or organization creation.

5. Organizations And Workspace Privacy

Organization Administrators can manage membership and may access information within their organization workspace according to their role. Members should submit only information they are authorized to share.

Organization information is separated by workspace. Users are not shown the names, administrators, members, conversations, assessments, or other confidential information of organizations they are not authorized to access. Similarity checks used to prevent duplicate organizations are private administrative controls.

6. Ask 6PM, Artificial Intelligence, And Shared Learning

Information submitted to Ask 6PM may be processed to generate a response and support the private organization workspace. If an external artificial-intelligence provider is configured, only the information needed for that request should be sent to the provider under applicable service terms and safeguards. Do not submit highly sensitive personal information unless it is necessary and you are authorized to do so.

Private organization data and raw conversations are not used to train a third-party foundation model. Shared Learning is a separate optional program. It is off by default and requires organization opt-in plus acceptance by every active contributing user. Only human-approved, sanitized aggregate patterns supported by at least five eligible organizations may influence cross-organization results. Raw conversations, plans, evidence, personal information, and organization-identifying details are excluded.

• Withdrawing Shared Learning consent stops future contribution and withdraws unpublished candidates.
• Published aggregate patterns must be withdrawn if eligible support falls below the minimum threshold.
• Declining Shared Learning does not prevent use of the private core service.

7. Service Providers And Disclosure

We may use service providers to host the website and database, deliver email, protect forms, measure website use, or provide configured AI features. Depending on enabled settings, these providers may include the hosting and email provider, Cloudflare Turnstile, Google Analytics, and Google AI services such as Gemini. Providers receive only information reasonably needed to perform their services and may process information outside Canada, where it may be subject to foreign laws.

• We do not sell personal information.
• We may disclose information when required or authorized by law, to investigate security incidents, to protect legal rights or safety, or as part of a business transaction subject to appropriate safeguards.
• We may share information with professional advisers who are required to protect its confidentiality.

8. Cookies, Sessions, And Analytics

The website uses essential session technology to keep accounts signed in and protect requests. Cloudflare Turnstile may process browser and network signals when enabled to distinguish people from automated abuse. Google Analytics may collect website-use, device, and approximate-location information when a valid measurement ID is enabled. Six Pillars Model does not intentionally send names, email addresses, assessment answers, or raw organization content to Google Analytics.

• Browser settings may allow you to limit or delete cookies, but blocking essential session storage can prevent account features from working.
• Analytics consent controls will be presented separately where required by applicable law.

9. Retention

We retain personal information only as long as reasonably needed for the identified purposes, account or organization administration, security, dispute resolution, and legal obligations. When information is no longer required, it is securely deleted or anonymized.

• Account and organization content is generally retained while the related account or workspace remains active.
• Security, audit, email, and transaction records may be retained for a reasonable period after the related activity.
• Policy-acceptance records may be retained as evidence of compliance even after an account is closed, where permitted or required.
• De-identified aggregate information that can no longer reasonably identify an individual may be retained for analysis.

10. Security And Privacy Incidents

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information. These include password hashing, access controls, role checks, encryption in transit, rate limiting, audit records, and protected production configuration. No system can guarantee absolute security.

If a privacy incident creates a real risk of significant harm, Six Pillars Model will investigate, document, notify affected individuals and regulators when required, and take reasonable steps to reduce the risk of further harm.

11. Access, Correction, Export, And Deletion

You may ask whether Six Pillars Model holds your personal information and request access to or correction of that information, subject to legal exceptions. You may also request an account-data export or deletion. We may need to verify your identity and authority before acting on a request.

Send a written request to accounts@sixpillarsmodel.com. We will respond within the time required by applicable law and explain any lawful limitation or refusal. Organization-controlled information may also require coordination with the applicable Organization Administrator.

12. Children

The services are intended for business users and are not directed to children. Do not create an account or submit personal information if you are under 18 without the involvement and authorization of a parent or legal guardian.

13. Policy Changes

We may update this policy when services, practices, providers, or legal requirements change. The page will show the current version and effective date. Material changes will require renewed acknowledgement or consent when appropriate. Previous acceptance records are retained with the version and content hash that applied at the time.

14. Contact And Complaints

Privacy Officer, Six Pillars Model

Email: accounts@sixpillarsmodel.com

Please contact us first so we can review and respond to a privacy question or complaint. You may also contact the Office of the Information and Privacy Commissioner of Alberta or another privacy regulator with jurisdiction.