Privacy & Cookie Policy

1.Information we collect

1.1 Account information

When you create an account, we collect: your full name, the email address you register with, a password (stored only as a salted hash — we never see the plaintext), your membership tier, and the organization you affiliate with (if any). For paid tiers, we also collect the billing name and address.

1.2 Profile and demographic information

You may choose to provide additional information in your profile — for example, your preferred pronouns, your role or title, your sector (education, nonprofit, government, business, philanthropy), your geographic region, and any biography you wish other members to see. These fields are optional unless we mark them otherwise. Some information you provide is considered “sensitive personal information” under U.S. state privacy laws or “special category data” under the GDPR, and we treat it accordingly (see Section 1.5).

1.3 Assessment, course, and platform‑activity data

The Levelation Assessment System collects:

• your responses to questionnaires, including dynamic and adaptive pathways,
• scores and visualizations generated by our scoring engine, derived from your responses and from the frameworks we map against (including, but not limited to, Levelation Foundations, Maslow, Bronfenbrenner, the Spectrum of Prevention, DEI frameworks, Systems Change Models, Leadership Models, and Resilience Models),
• organizational and leadership maps generated for organizational customers, and
• the insights, recommendations, and growth pathways generated by our AI Insights Engine from the above.

The Levelation learning management system collects:

• the courses you enroll in, your progress, your responses to in‑course exercises and quizzes, certifications and continuing‑education credits earned, and cohort participation,
• your interactions with the AI Learning Companion (your questions, the responses generated, and feedback signals such as ratings).

1.4 Information collected automatically

When you use the Platform, we and our hosting and analytics providers automatically collect:

• IP address, and approximate location derived from IP,
• browser type, operating system, device type, screen size, language preference,
• pages and screens visited, time spent, clicks, and search queries inside the Platform,
• referring page or campaign,
• crash and error data, and
• cookie and similar‑technology identifiers (see our Cookie Policy).

1.5 Sensitive personal information / special category data

Depending on which assessments you take and which profile fields you complete, the Platform may collect categories of information that U.S. state privacy laws (CCPA, Colorado, Connecticut, Maryland, and others) classify as “sensitive personal information,” and that the GDPR / UK GDPR classify as “special category data.” These may include:

• racial or ethnic origin, where you choose to provide it,
• mental or emotional wellness indicators captured by resilience and wellness assessments,
• information about disability or accommodation needs,
• religious or philosophical affiliation where relevant to an assessment, and
• sexual orientation or gender identity where you choose to provide it.

1.6 Health information — limited scope

Levelation's assessments are not medical or diagnostic instruments. They are resilience, leadership, and organizational tools mapped to public frameworks. We do not provide medical diagnosis or treatment through the Platform. If, in the future, Levelation administers an assessment in a healthcare‑covered context (for example, in partnership with a HIPAA‑covered entity), the data collected in that context will be treated as Protected Health Information under HIPAA and governed by a separate Notice of Privacy Practices and a Business Associate Agreement.

1.7 Payment information

We use a PCI‑DSS‑compliant payment processor (Whop) to process payments. Your full card number is sent directly to the payment processor and is never transmitted to or stored on our servers. We receive a token, the last four digits of the card, the card brand, the billing ZIP code, and the transaction status. We use this to manage your subscription and to provide receipts and customer support.

1.8 Communications, support, and community

If you email us, post in our community spaces, message another member, or contact support, we receive and retain the contents of those communications. The AI Learning Companion and any other AI‑assisted chat features retain your prompts and responses for the period described in Section 7.

1.9 Information from third parties

If you sign in with a third‑party identity provider (for example, Google or Microsoft), we receive your name, email, and a stable identifier from that provider. We do not receive your password. If you are added to the Platform by your employer or organization, we receive your name, email, and role from that organization.

2.How we use the information

We use personal information to:

• create and administer your account and your membership tier,
• deliver, score, and visualize assessments,
• generate AI‑assisted insights, recommendations, and growth pathways,
• deliver and personalize courses, certifications, and continuing education, and track progress,
• operate community features and event access,
• process payments, manage subscriptions, and issue invoices and receipts,
• communicate with you about service updates, your account, and security,
• send marketing communications only with your separate, opt‑in consent, and let you withdraw that consent at any time,
• secure the Platform, prevent fraud and abuse, and respond to support requests,
• understand aggregate usage and improve the Platform,
• comply with our legal obligations and to establish, exercise, or defend legal claims.

3.Automated decision‑making and profiling

The Levelation Assessment System and AI Insights Engine produce scores, visualizations, and personalized recommendations from your inputs. This is a form of profiling. It does not produce legal or similarly significant effects on you — it does not deny services, set prices, or determine employment, credit, housing, or healthcare outcomes. Recommendations are advisory.

You can:

• review the inputs that drove your results,
• request human review of any specific result by emailing privacy@levelation.org, and
• (where applicable under Colorado, Connecticut, Virginia, EU, or UK law) object to profiling.

We do not use AI to make consequential decisions about you without human involvement.

4.Cookies and similar technologies

Our use of cookies is described in our Cookie Policy (Part B below), which is incorporated into this Privacy Policy by reference.

5.How we share information

We share personal information with the following categories of recipients, each acting under contract and only for the purposes described:

We may also disclose information to comply with the law, respond to lawful requests, protect rights and safety, and in connection with a corporate transaction.

We do not sell or share personal information, and we do not use third-party advertising or engage in cross-context behavioral advertising.

5.1 Employer and organizational sharing

If you joined the Platform through an organization (your employer, the institution that purchased your membership, or a cohort you participate in), aggregated, anonymized results from your assessments may be visible to administrators of that organization for the purpose of organizational and leadership mapping. Your individual responses and individual scores are not shared with your organization's administrators unless you have given separate, explicit consent, except where you are completing an assessment that, by its nature, identifies you to the organization (for example, a 360‑style review where you are the named subject). We will tell you at the start of each assessment whether your individual results will be visible to your organization.

6.International transfers

We are based in the United States. If you access the Platform from the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction with cross‑border transfer restrictions, your information will be transferred to and processed in the United States and other countries where our service providers operate. Where required, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Agreement (or its Addendum to the EU SCCs), and the EU‑US Data Privacy Framework where the recipient is certified. You may request a copy of the safeguards by writing to privacy@levelation.org.

7.How long we keep your information

8.Security

We protect personal information with administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit (TLS) and at rest, role‑based access control, audit logging, multi‑factor authentication for staff, regular vulnerability scanning, and incident response procedures. No system is perfectly secure; if you suspect unauthorized access to your account, contact privacy@levelation.org immediately.

9.Your privacy rights

Depending on where you live, you may have some or all of the rights below. To exercise any of them, email privacy@levelation.org. We will respond within the time required by applicable law, and in any case without undue delay. We may need to verify your identity before acting.

You will not be discriminated against or retaliated against for exercising these rights.

9.1 Sale / sharing and the Global Privacy Control

Sale / sharing. Where we engage in cross‑context behavioral advertising or otherwise share personal information in a manner that constitutes a “sale” or “share” under the CCPA, you may opt out by:

• using the “Do Not Sell or Share My Personal Information” link in the site footer, or
• enabling the Global Privacy Control (GPC) in your browser, which we honor as a valid opt‑out signal under California law.

Do Not Track. We do not respond to legacy “Do Not Track” signals; we honor the Global Privacy Control instead.

9.2 California — categories collected

Under the CCPA, we collect the following categories of personal information about California residents: identifiers; account, billing, and customer‑records information; commercial information (subscriptions, courses purchased); internet activity information (cookies, page views, app usage); approximate geolocation; audio/visual information if you upload such content; professional/employment information from your profile; education information from your profile and course activity; inferences drawn from the above to support recommendations; and the categories of sensitive personal information identified in Section 1.5.

9.3 Authorized agent

You may use an authorized agent to make a request on your behalf, in accordance with applicable state law. We will require written authorization and may require you to verify your identity.

10.Children's privacy

The Platform is intended for users 16 and older. We do not knowingly collect personal information from children under that age. The “Student” tier is intended for post‑secondary and adult learners; if your jurisdiction permits younger users to participate, we will collect verifiable parental consent before doing so. If you believe a child under the applicable minimum age has provided personal information, contact privacy@levelation.org and we will delete it.

11.Marketing communications

We will send you administrative messages about your account and the Platform — those are necessary for the service and you cannot opt out of them and remain a member. Promotional emails (newsletters, course announcements not tied to your enrollment, surveys) are sent only with your separate consent, and every promotional email contains an unsubscribe link.

12.Links to other sites and embedded content

The Platform may link to or embed content from third‑party sites. We are not responsible for the privacy practices of those sites. Review their privacy policies before providing personal information.

13.Changes to this policy

We will update this policy as our products evolve. For material changes — for example, a new category of subprocessor, a new AI vendor, a change to retention, or the launch of HIPAA‑covered services — we will give notice in the Platform or by email before the change takes effect, and where applicable obtain the consent required by law.

14.Contact us

EU/UK representative & DPOAn EU/UK Article 27 representative will be appointed before EU/UK go‑live, and a Data Protection Officer will be listed here if required by GDPR Article 37.

What are cookies?

Cookies are small text files stored on your device when you visit a website. They let the site recognize your device on later page loads, remember your preferences, secure your session, and measure usage. In this policy, “cookies” also includes similar technologies such as local storage, session storage, and pixel tags.

Categories that are not strictly necessary are off by default and load only after you give consent in our cookie banner.

Strictly necessary cookies

Required for the Platform to function. You cannot opt out of these and continue using the Platform.

Payments are handled by Whop on its own hosted checkout, so no payment cookies are set on levelation.org.

Functional cookies

Remember your preferences (such as language, theme, accessibility settings, and “remember my cohort” flags).

You can refuse functional cookies; some preferences will not persist between visits.

Analytics and performance cookies

We use Google Analytics 4 (GA4) to understand how the Platform is used so we can improve content and fix issues.

Third‑party services that set cookies

The third‑party services that may set cookies on the Platform are listed below. Each has its own privacy policy.

Our consent banner and how to control cookies

When you first visit the Platform, we display a consent banner. The banner lets you:

• accept all categories,
• reject all non‑essential categories with a single click that is equally prominent as “accept all,” or
• accept a per‑category selection.

Non‑essential cookies (functional, analytics) are blocked until you give consent. You can change your preferences at any time using the “Cookie settings” link in the Platform footer.

You can also:

• Block or delete cookies in your browser settings (Chrome, Safari, Firefox, Edge each offer per‑site controls).
• Enable the Global Privacy Control (GPC) in a supported browser. We honor GPC as an opt‑out of sale and sharing.

Mobile application

The mobile application does not use browser cookies. It uses SDK identifiers, device push tokens (Apple Push Notification service for iOS; Firebase Cloud Messaging for Android), and (on iOS) abides by the Apple App Tracking Transparency framework — we will display the ATT prompt before requesting any tracking permission, and on iOS we do not access the IDFA without your permission. See the Privacy Policy for full detail on app‑side identifiers.

U.S. state & EU/UK rights

California residents

If you are a California resident, see Section 9 of the Privacy Policy for your CCPA rights. You can exercise that right via the cookie banner, the footer “Do Not Sell or Share My Personal Information” link, or by sending a Global Privacy Control signal.

Other U.S. states

Residents of Colorado, Connecticut, Delaware, Kentucky, Maryland, Minnesota, Montana, Nevada, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have rights to opt out of targeted advertising and certain types of profiling. You can exercise these the same way as the California rights above.

EEA, UK, and Switzerland

If you access the Platform from the EEA, the UK, or Switzerland, non‑essential cookies are blocked until you give your consent via the banner, and you can withdraw consent at any time. Our legal basis for non‑essential cookies is consent. Our legal basis for strictly necessary cookies is the legitimate interest of operating the Platform you have asked to use.

Changes to this policy

We will update this Cookie Policy when our cookie set changes. We will give notice in the Platform before any material change — for example, before switching analytics providers — and obtain renewed consent where required.