1. Who we are
drivechange.ai is operated by AInvirion, which acts as the controller of the personal data described in this policy. Contact: [email protected].
2. What we collect
Account data: your name, email address, and a hashed password (we never store passwords in plain text), plus your preferred language and role. Organization data: the profile an administrator provides — organization name, industry, company size, country, and optional context about tools, priorities, and governance. Assessment data: your answers to the assessment questions and the scores derived from them. Support data: the content of support requests you file. Technical data: standard server logs (IP address, user agent, timestamps) used for security and operations, plus aggregate usage analytics collected in your browser as described in section 10.
3. How we use it
We use this data to operate the service: authenticate you, score responses, generate reports for you and your organization's administrators, maintain anonymized industry benchmarks, respond to support requests, secure the service, and send transactional email (such as invitations and password resets). We do not sell personal data, and we do not use it for third-party advertising.
4. Anonymized benchmarking
Benchmarks compare organizations against industry reference bands. Peer comparisons drawn from assessment data use anonymized, aggregated records (industry, size band, layer and vector scores, role mix) and are shown only once at least 30 organizations of the same industry and size cohort have participated. Individual organizations and individual people are never identifiable in benchmarks.
5. Sharing and processors
We share personal data only with service providers that host and operate the platform on our behalf: cloud infrastructure (DigitalOcean, hosted in the United States), transactional email delivery, Google Analytics (for the aggregate usage measurement described in section 10), and — if you file a support request — GitHub, where support tickets are tracked; do not include sensitive information in support requests. Within your organization, administrators can see respondent status and aggregate results; individual responses are handled according to your organization's engagement configuration. We may disclose data if required by law.
6. International transfers
The service is hosted in the United States. If you use it from another jurisdiction, your data is transferred to and processed in the US by the providers listed above.
7. Security
Sensitive data is encrypted at rest with a separate encryption key per organization, wrapped by a master key — a compromise of one tenant's key does not expose another's. Data in transit is protected with TLS. Access to production data is restricted and logged. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify affected organizations without undue delay.
8. Retention
We keep account and assessment data for as long as your account or your organization's engagement is active. When an account or organization is deleted, associated personal data is removed within a reasonable operational window; anonymized, aggregated benchmark records — which identify no one — are retained.
9. Your rights
Depending on where you live, you may have rights to access, correct, export, restrict, object to the processing of, or delete your personal data. To exercise any of these rights, contact [email protected]; if you are a respondent, we may route the request through your organization's administrator where the organization controls the data. You may also lodge a complaint with your local data-protection authority.
10. Cookies and local storage
We use Google Analytics 4 to measure how the site is used in aggregate — which pages are visited, and how visitors move between them. Google sets its own cookies in your browser for this purpose and processes the data as described in section 5; analytics loads only on drivechange.ai, not in development or preview environments. We do not use advertising cookies, and we do not run third-party ad networks on the site. You can block analytics cookies through your browser settings or a content blocker; the service works normally without them. Separately, we use browser local storage for strictly functional purposes that no cookie policy can opt out of without breaking the service: keeping you signed in and remembering your language and theme preferences.
11. Children
The service is intended for working professionals and is not directed at children under 16. We do not knowingly collect data from children.
12. Changes to this policy
We will post any changes to this policy on this page with a new "last updated" date, and for material changes we will provide additional notice through the service or by email.