privacy policy.
How In Good Company Collective collects, uses, shares, and protects personal information.
1. Who We Are and What This Policy Covers
In Good Company Collective, LLC ("In Good Co.," "we," "us," or "our") is an Arizona company that provides learning and talent services and two online assessment tools, CARE 360 and The Element Profile (the "Tools"). This Privacy Policy explains how we collect, use, share, and protect personal information when you:
- Visit ingoodcocollective.com (the "Site")
- Contact us, sign up for updates, or register for a workshop
- Buy or manage a subscription to the Tools
- Take an assessment or give feedback through the Tools, including as a Subject, Rater, or participant
- Work with us on a consulting, design, or workshop project
Our two roles. For information about our customers, website visitors, and people who contact us, we decide how the information is used, so we are its "controller." For assessment information we handle on behalf of an organization or coach that uses the Tools (an "Administrator"), that organization or coach is the controller and we act as its "processor" (GDPR and UK GDPR) or "service provider" (CCPA). In that case, we use the information only to provide the Tools under our contract with the Administrator, including our Data Processing Addendum (DPA).
If you were invited to an assessment by your employer or a coach, their own privacy notice also applies, and they are your first point of contact for questions about how they use your results.
This policy should be read together with our Terms and Conditions. Capitalized terms not defined here have the meanings given in those Terms.
Last updated: October 11, 2026
2. Information We Collect
We collect only what we need to run the Site, deliver our services, and operate the Tools.
| Category | Examples | Where it comes from |
|---|---|---|
| Account and contact details | Name, work email, job title, organization, login credentials | You, or the Administrator who invites you |
| Assessment participant details | Names and emails of Subjects, Raters, and participants; rater group (self, supervisor, peer, direct report, skip-level) | The Administrator |
| Assessment responses | Ratings, answers, written comments, The Element Profile answers, and the results and AI narratives generated from them | Subjects, Raters, and participants |
| Billing information | Plan, billing contact, billing address, payment history | You and Stripe (we do not store full card numbers) |
| Communications | Messages, support requests, workshop registrations, survey and feedback responses | You |
| Technical data | IP address, browser and device type, log data, session cookies needed for login | Your device, automatically |
| Website analytics and marketing data | Pages visited, referring site, email opens and clicks (when we use analytics or email tools) | Your device and our service providers |
| Client project data | Employee or participant information a client shares with us for a consulting or workshop project | The client |
Sensitive information. The Tools are not designed to collect health information or other sensitive personal details, and we ask people not to include them in written answers. If sensitive details are included in a comment, they are processed like other assessment responses.
3. How We Use Information and Our Legal Bases
We use personal information for the purposes below. If you are in the EEA or UK, the GDPR and UK GDPR require us to name a legal basis for each one.
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Create and manage accounts, process subscriptions, and provide the Tools | Performance of our contract with you |
| Run assessments, generate reports and AI narratives, and send invitations and reminders on an Administrator's behalf | Processed for the Administrator under our DPA; the Administrator determines its own legal basis |
| Bill you, process payments, and keep financial records | Contract; legal obligation (tax and accounting) |
| Send service messages, such as receipts, renewal reminders, price-change notices, and changes to our Terms | Contract; legal obligation |
| Respond to inquiries and deliver consulting and workshop services | Contract, or our legitimate interest in responding to you |
| Keep the Site and Tools secure, prevent fraud and misuse, and fix problems | Legitimate interests |
| Improve the Tools, and conduct internal research and benchmarking, using de-identified, aggregated data that cannot identify any person or organization, including data combined across customers | Legitimate interests |
| Send newsletters and marketing emails | Consent where required by law; otherwise legitimate interests. You can unsubscribe at any time. |
| Comply with law, enforce our Terms, and protect our rights | Legal obligation; legitimate interests |
We do not use assessment responses for advertising, and we do not use them to make automated decisions that have legal or similarly significant effects on anyone. Decisions based on results are made by people at the Administrator's organization.
De-identified data. Removing names alone does not make data de-identified. When we de-identify data, we take reasonable measures to prevent it from being linked to any person or organization, we maintain and use it only in de-identified form, and we do not attempt to re-identify it, except to test that our de-identification processes meet legal requirements. We require anyone we share it with to follow the same rules.
4. Assessment Data: Who Sees What
If you take part in an assessment, here is who can see your information.
| CARE 360 (multi-rater feedback) | The Element Profile (self-assessment) | |
|---|---|---|
| The person being assessed | Their own report: averages by rater group and comments with names removed | Their own results |
| The organization's Administrators | The same report as the Subject | That person's results |
| Individual Rater answers | Never shown to the Subject or Administrators | Not applicable |
| Anonymity | Individual answers are never shown, but group averages are shown however many Raters respond. If only one person in a group responds (for example, a single supervisor), the average reflects that person's ratings and may identify them. Self-assessments are not anonymous. | Not anonymous |
Rater confidentiality (CARE 360). Rater identities are not linked to responses anywhere a platform user can see. We remove names from comments but do not edit their wording, so please avoid details that could identify you. Authorized In Good Co. personnel may access underlying data only to operate, support, or secure the Tools, or where required by law, and never share it with the Subject or Administrators.
Linking across Tools. CARE 360 and The Element Profile share one account. If an organization uses both, information about the same person in each Tool may be connected using their email address, so authorized Administrators can view it together. Linking never reveals which Rater gave which CARE 360 response.
AI-generated narratives. Reports include written narratives generated automatically by our AI provider, Anthropic, from the assessment information needed for each report, such as responses and comments. Narratives are not reviewed by a person before delivery and may contain errors. Under our agreement, Anthropic uses this data only to generate narratives for us, does not use it to train its models, and deletes it within 30 days, unless it must keep it longer to investigate misuse or comply with law.
Development use only. The Tools are developmental. They are not offered for hiring, and results should not be the sole basis for decisions about employment, pay, or discipline.
5. How We Share Information
We do not sell or share personal information. We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA).
We disclose personal information only in these situations:
- With Administrators. Assessment results are shared with the organization or coach that set up the assessment, as described in Section 4.
- With our service providers (subprocessors). These companies process data for us under contracts that limit how they can use it:
| Provider | Purpose |
|---|---|
| Supabase | Database and user authentication |
| Railway | Application hosting |
| Stripe | Payment processing |
| Resend | Transactional email (invitations, receipts, notifications) |
| Anthropic | Generating AI narratives in reports |
We may also use website analytics and email marketing providers, which we will add to this list when we do. We notify Administrators by email at least 30 days before adding or replacing a subprocessor that handles assessment data.
- For legal reasons. When required by law, court order, or government request, or when needed to protect the rights, safety, or property of our customers, users, or In Good Co.
- In a business transfer. If we are involved in a merger, acquisition, or sale of assets, personal information may be transferred to the new owner, subject to this Privacy Policy.
- With your direction. When you ask us to share information, for example by inviting a coach or colleague.
6. Cookies, Marketing Emails, and Children
Cookies. The Tools use only cookies and similar technologies that are strictly necessary to keep you logged in and to keep the service secure. The Site may use analytics cookies to understand how visitors use it. Where the law requires it, we will ask for your consent before setting non-essential cookies, and you can change your choice at any time. You can also block or delete cookies in your browser settings, although parts of the Site or Tools may not work without strictly necessary cookies.
Marketing emails. If you sign up for updates, or if you are a customer and the law allows it, we may email you about new offerings, events, and resources. Every marketing email includes an unsubscribe link. Unsubscribing does not stop service messages, such as receipts, renewal reminders, and notices about your subscription or our Terms.
Children. The Site and Tools are intended for adults and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.
7. Retention, Security, and International Transfers
How long we keep information. We keep personal information only as long as needed for the purposes in this policy:
| Information | How long we keep it |
|---|---|
| Assessment data during an active subscription | 24 months after an assessment closes, or until the Administrator deletes it |
| Account and assessment data after a subscription ends | 60 days, so the customer can resubscribe or request an export; then deleted from active systems |
| Accounts suspended for non-payment | Kept while suspended; once cancelled, the 60-day period above applies |
| Data sent to our AI provider | Deleted by the provider within 30 days, except where it must keep it longer to investigate misuse or comply with law |
| Billing and payment records | As long as tax and accounting law requires, typically up to 7 years |
| Inquiries and contact form messages | As long as needed to respond, then up to 2 years |
| Newsletter and marketing lists | Until you unsubscribe |
| De-identified, aggregated data | May be kept indefinitely, because it cannot identify anyone |
Backups. Deleted data may remain in our automated database backups until those backups are overwritten in our normal backup cycle. Backups are kept secure and are used only to recover from data loss or system failure. If we ever restore a backup, we will delete again any data previously scheduled for deletion before resuming normal operations.
Security. We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, or misuse, and our infrastructure providers maintain independent security certifications. No system is completely secure, so we cannot guarantee absolute security. If a security incident affects assessment data, we will notify the affected Administrator within 72 hours of confirming it, as described in our DPA.
International transfers. We are based in the United States, and our service providers process data in the United States. When we transfer personal data from the EEA or UK to the United States, we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, which are built into our DPA.
8. Your Privacy Rights
Depending on where you live, you may have the following rights over your personal information.
EEA and UK residents (GDPR and UK GDPR):
- Access: get a copy of your personal information
- Rectification: correct inaccurate information
- Erasure: ask us to delete your information
- Restriction: ask us to limit how we use it
- Portability: receive it in a commonly used format
- Objection: object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent: where we rely on consent, withdraw it at any time
- Complain: lodge a complaint with your local data protection authority
California residents (CCPA):
- Know: what personal information we collect, use, and disclose
- Delete: ask us to delete your personal information
- Correct: ask us to correct inaccurate information
- Opt out of sale or sharing: we do not sell or share personal information, so there is nothing to opt out of
- Non-discrimination: we will not treat you differently for exercising these rights
How to make a request. Email info@ingoodcocollective.com. We will verify your identity before acting on your request and respond within the time required by law (generally one month under the GDPR and 45 days under the CCPA). You may use an authorized agent where the law allows.
If your data came from an assessment. When we hold your information on behalf of an employer or coach, we may refer your request to that Administrator and help them respond, because they control how your results are used. Deleting your data may affect your organization's reports. Because Rater responses are kept confidential, we cannot reveal who gave a particular rating or comment, even in response to an access request from the Subject.
9. Changes and Contact
Changes to this policy. We may update this Privacy Policy from time to time. We will post the updated version on the Site with a new "Last updated" date. For material changes, we will notify customers by email or in-app notice at least 14 days before they take effect.
Contact us. Questions or requests about this policy or your personal information:
In Good Company Collective, LLC
info@ingoodcocollective.com
2640 E Sunrise Place, Chandler, AZ 85286