Privacy Policy

This Privacy Policy explains how Priority Governance collects, uses, discloses, retains, and protects personal information when you visit prioritygovernance.com; submit the free AI Governance QuickScan; verify a business email; purchase or download the AI Governance Starter Kit; book or participate in an AI Governance QuickStart Workshop; communicate with us; or otherwise use our website and related services (collectively, the “Services”).

Priority Governance is operated from Colorado, United States. In this Policy, “Priority Governance,” “we,” “us,” and “our” refer to the operator of prioritygovernance.com. This Policy does not apply to the independent practices of third-party websites or services.

1. Notice at collection

The following table summarizes the categories of personal information we may collect, why we collect them, and the types of recipients to which they may be disclosed for business purposes. The categories listed describe our practices during the 12 months preceding this Policy and the information we expect to continue collecting.

We do not sell personal information and do not share personal information for cross-context behavioral advertising. See Section 13.

2. Information you provide through the QuickScan

When you submit the QuickScan, we collect:

Organization name and website.

Industry and organization-size band.

Respondent name, business email, and role or title.

Selections indicating whether the organization sells into regulated, enterprise, or public-sector markets.

Multiple-choice answers to 21 assessment questions, including “Not sure” selections.

Selections describing what prompted the scan.

Your choices about contact concerning your results, related products or services, and a possible future testimonial request.

Records showing the Terms, Privacy Policy, methodology, consent, and other versions associated with the submission.

The QuickScan has no substantive free-text assessment field and does not accept document uploads.

3. Business-email validation and verification

The QuickScan requires a business email. We perform format and domain checks and may reject malformed addresses or addresses associated with commonly used free or personal email domains.

We use a transactional email provider to send a verification link or code. We may process the email address, verification token or code, verification status, send and verification timestamps, expiration information, provider message identifier, delivery or bounce status, and related security metadata.

Verification messages are transactional. Verification alone does not enroll you in marketing communications.

4. Purchase, payment, and download information

When you purchase a Starter Kit, Workshop, or another paid Service, we or our providers may collect:

Purchaser and billing contact information.

Organization name and business email.

Product, price, discount, tax, currency, payment status, and transaction identifiers.

Billing address or tax-location information when required.

Order confirmation, delivery, download-link, download-status, and support records.

Fraud, chargeback, refund, and dispute information.

Payment-card and bank-account information is collected and processed by the payment provider. Priority Governance does not need to store full payment-card or bank-account numbers in its application database. We may receive limited payment details, such as payment type, last four digits, expiration information, billing country, transaction identifier, and payment status, as provided by the processor.

5. Workshop and scheduling information

When you book, prepare for, or participate in a Workshop, we may collect:

Participant names, business emails, roles, and organization.

Scheduling details, time zone, meeting link, attendance, reminders, and rescheduling history.

The organization’s QuickScan results and selected priorities.

High-level pre-session questionnaire responses, business trigger, target outcome, approved-tool names, policy or inventory status, deadlines, and advisor involvement.

Decisions, action items, owners, due dates, limitations, evidence references, corrections, and requested deliverables.

Communications, feedback, and support requests.

The standard Workshop does not require sensitive customer, employee, health, financial, credential, contract, source-code, production-log, privileged, or regulated records. Describe data categories and workflows rather than providing the underlying data.

Priority Governance does not record a Workshop unless recording is disclosed in advance and authorized as required. If a Workshop is recorded under a separate agreement, we will provide additional notice concerning the recording, purpose, access, and retention.

6. Information collected automatically

Our application database stores submission timestamps, record metadata, consent and methodology versions, and a pseudonymous one-way identifier derived from the submitting device’s IP address. The application submission record does not store the raw IP address. We use the IP-derived identifier for security, abuse prevention, submission integrity, rate limiting, and troubleshooting.

Our hosting, network, database, email, payment, scheduling, file-delivery, video-meeting, and security providers may process technical information in operational logs, such as raw IP address, browser or device type, requested pages, timestamps, referrer information, request headers, payment or delivery events, and diagnostic or security information. Their handling and retention depend on our configurations, their services, and applicable law.

7. Information we do not request through the QuickScan

Do not submit passwords, credentials, access tokens, Social Security numbers, government identifiers, payment-card or bank information, protected health information, children’s personal information, sensitive employee or customer records, privileged communications, confidential contracts, restricted source code, production logs, trade secrets, security vulnerabilities, or third-party information you are not authorized to disclose.

The QuickScan does not provide user accounts and does not collect account passwords. Paid Services may use purchase confirmations, download links, scheduling links, or provider-hosted pages rather than a Priority Governance user account.

8. How we use information

We use personal information to:

Validate and verify a business email and associate it with a submission.

Receive, process, score, and display QuickScan results.

Generate the Policy Starter Outline and question-level recommendations.

Process orders, payments, discounts, taxes, refunds, disputes, and accounting records.

Deliver downloadable products and provide delivery support.

Schedule, prepare for, facilitate, document, and follow up on Workshops.

Create requested Decision Logs, 30-Day Roadmaps, Leadership Summaries, and related outputs.

Communicate about results or related products and services when requested or permitted.

Send transactional, service, security, legal, purchase, booking, and delivery communications.

Ask whether you would like to provide feedback or a testimonial when separately permitted.

Operate, maintain, troubleshoot, secure, and prevent misuse of the Services.

Maintain records of consent, Terms acceptance, policy versions, submissions, orders, licenses, requests, and communications.

Improve the QuickScan, scoring methodology, content, products, Workshops, and user experience.

Create aggregated or de-identified internal insights intended not to identify a respondent or organization.

Enforce our agreements, resolve disputes, comply with law, and protect rights, safety, and security.

9. Automated scoring and AI-model use

QuickScan scoring and generation of the on-screen Readiness Level, pillar results, and Policy Starter Outline are deterministic and based on selected answers. No external AI model currently receives or processes QuickScan submissions for scoring or generation.

We do not use QuickScan submissions, purchaser information, Workshop inputs, or customer-specific deliverables to train a public AI model.

Priority Governance may use software-assisted drafting and editing tools to create or maintain its general, non-customer-specific content. If we later use an external AI provider to process identifiable customer submissions or Workshop content, we will evaluate the provider, update this Policy, and provide any notice or choice required before that processing begins.

The QuickScan does not make employment, credit, housing, insurance, education, healthcare, legal, or similarly consequential decisions about individuals. Its score is an informational, organization-level self-assessment result.

10. Legal bases for international users

Where a law such as the EU or UK GDPR requires a legal basis, we rely on one or more of the following, depending on the processing:

Contract: to provide a QuickScan you request, process a purchase, deliver a product, schedule or provide a Workshop, and support the applicable Service.

Consent: for optional marketing contact, a testimonial request, or another activity for which we specifically request consent. You may withdraw consent prospectively.

Legitimate interests: to secure and improve the Services, prevent fraud and abuse, maintain business records, communicate with organizational users, understand service performance, and establish or defend legal claims, balanced against affected rights.

Legal obligation: to comply with tax, accounting, law-enforcement, court, regulatory, and other legal requirements.

We do not use consent as the basis for necessary transactional processing when another basis applies.

11. How we disclose information

We disclose personal information only as described in this Policy:

Service providers: Providers that host, store, transmit, authenticate, secure, process payments, deliver email or files, schedule meetings, provide video conferencing, calculate tax, support accounting, or otherwise support the Services. Current core infrastructure includes Supabase for the submission database and administrative authentication and Vercel for application hosting and delivery. A transactional email provider supports verification and service communications. Paid Services may add payment, scheduling, file-delivery, and video-meeting providers.

Authorized personnel and contractors: People who need information to provide a requested Service, prepare deliverables, support users, maintain the system, or protect the Services.

Professional advisors: Attorneys, accountants, auditors, insurers, consultants, and other advisors subject to appropriate duties of confidentiality.

Legal and safety purposes: When we reasonably believe disclosure is required by law or necessary to protect rights, investigate fraud or misuse, enforce agreements, respond to lawful requests, or protect safety and security.

Business transactions: In connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, subject to applicable law.

At your direction: When you direct, authorize, or request the disclosure.

We require service providers to process information for the services they provide to us, subject to contractual and legal obligations appropriate to their role.

12. Third-party pages and services

A checkout, payment, scheduling, video-meeting, or file-delivery page may be operated by a third party. That provider may collect information directly under its own privacy policy in addition to processing information for Priority Governance. Review the provider’s notices when using its page.

Priority Governance is not responsible for the independent practices of a third-party website that is not acting as our service provider.

13. Sale, targeted advertising, analytics, and cookies

Priority Governance does not sell personal information and does not share personal information for cross-context behavioral advertising. We do not currently use advertising cookies, advertising pixels, or third-party targeted-advertising analytics on the QuickScan.

The site uses strictly necessary technologies and limited operational logs required to deliver, secure, verify, sell, and support the Services. A third-party checkout, scheduling, or video-meeting page may use necessary or optional technologies under that provider’s policy and settings.

If we introduce nonessential analytics, advertising technologies, or cookies, we will update this Policy and provide any notice, consent mechanism, Global Privacy Control response, or opt-out required before activation.

14. Communications and choices

You may receive verification messages and other transactional, purchase, download, booking, Workshop, service, security, or legal communications necessary to provide an interaction you requested.

We may contact you about your results or related Priority Governance products and services when you request or permit that contact or when another lawful basis allows an appropriate business communication. Marketing messages will identify the sender and provide a working unsubscribe method and other information required by applicable law.

You may opt out of marketing by using the unsubscribe method, replying with your request, or emailing privacy@prioritygovernance.com. We will process the request within the period required by law. Opting out of marketing does not stop necessary transactional or legal communications.

Permission to request a testimonial does not authorize publication. We obtain separate approval before publishing an identifiable testimonial, organization name, logo, quotation, score, or case study.

15. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, considering the Service requested, relationship duration, security needs, legal obligations, dispute periods, and whether information can be de-identified. In general:

QuickScan submissions and generated outputs: Retained while needed to provide and support results, maintain submission and consent records, improve the Services, and support related customer interactions, then deleted or de-identified unless a dispute, security matter, legal obligation, or active customer relationship requires longer retention.

Email-verification data: Tokens or codes are short-lived and are invalidated, deleted, or rendered unusable after verification or expiration. Verification status and related evidence may remain with the submission and consent record.

Purchase and license records: Retained for the period needed to provide access and support, establish the license, prevent fraud, handle refunds or chargebacks, and satisfy tax, accounting, contract, and legal requirements.

Workshop inputs and customer-specific deliverables: Retained while needed to prepare, deliver, correct, and support the Workshop and maintain appropriate business records, then deleted or de-identified unless the customer requests continued retention, the parties agree otherwise, or law or a dispute requires longer retention.

Communications and preferences: Retained while needed to respond, provide Services, document requests and opt-outs, and maintain business records.

Security and operational logs: Retained according to security needs, system configurations, provider practices, and legal requirements.

Backups: Residual copies may remain for a limited period until overwritten or expired through the ordinary backup cycle.

De-identified or aggregated information: May be retained for research, measurement, security, and service improvement when it is not reasonably linkable to a respondent or organization.

Counsel and Priority Governance will periodically review retention criteria and operational deletion schedules.

16. Privacy requests available to everyone

Regardless of where you live, you may request:

Access to personal information associated with you.

Correction of inaccurate personal information.

Deletion of personal information.

A copy of information you provided in a reasonably portable format.

Withdrawal of optional contact permission.

Objection to or restriction of certain processing where applicable.

Submit a request to privacy@prioritygovernance.com, preferably from the business email used for the QuickScan or purchase. Because the site may not use a customer account, we may request information reasonably necessary to verify the request and protect the organization and other individuals.

We may deny or limit a request when an applicable exception permits or requires us to protect other people, maintain security, prevent fraud, comply with law, preserve tax or transaction records, establish or defend legal claims, or retain information validly de-identified. We will respond within the period required by applicable law.

If applicable law provides a right to appeal, you may appeal by replying to our decision or emailing the same address with “Privacy Appeal” in the subject line.

17. Jurisdiction-specific rights

Depending on your location and whether a law applies to Priority Governance’s activities, you may have additional rights concerning access, correction, deletion, portability, objection, restriction, withdrawal of consent, appeal, or opting out of sale, targeted advertising, sharing, or certain profiling.

Residents of Colorado and California may have rights described by their respective privacy laws when the law applies. Individuals in the European Economic Area or United Kingdom may also have the right to lodge a complaint with the data-protection authority in their location.

We do not discriminate against a person for exercising an applicable privacy right. Sale and targeted-advertising opt-outs are not currently needed for our stated practices because we do not engage in those activities. If our practices change, we will provide the required opt-out methods and recognize applicable browser-based preference signals.

18. Deletion mechanics

The administrative system supports deletion of QuickScan submissions from the active database. Deleting information from the active database may not immediately remove residual copies from security logs, transaction records, email records, legal records, completed deliverables, or backups. Those copies are handled through their applicable retention cycles and legal exceptions.

Where feasible and legally permitted, we will instruct relevant service providers to delete or return information covered by a valid request.

19. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. Current measures include server-side submission processing, restricted administrative access, default-deny public database access, administrator email allowlisting, data minimization, and an IP-derived pseudonymous security identifier rather than storage of raw IP addresses in application submission records.

Additional paid-service providers are selected and configured based on the functions they perform. No method of transmission, payment, meeting, download, storage, or security is completely secure, and we cannot guarantee absolute security.

20. International access and transfers

Priority Governance operates from the United States. Our providers may process information in the United States and other locations where they operate. If you access the Services from outside the United States, your information may be transferred to a country whose data-protection laws differ from those in your location.

Where legally required, we will use an approved transfer mechanism or other recognized safeguard. Contact us for additional information about an applicable transfer mechanism.

21. Children

The Services are intended for adults acting in a business or organizational capacity and are not directed to children. You must be at least 18 to submit the QuickScan, purchase a Service, or participate as the booking customer. We do not knowingly collect personal information from children. If you believe a child submitted personal information, contact privacy@prioritygovernance.com so we can investigate and take appropriate action.

22. Changes to this Policy

We may update this Policy to reflect changes in our Services, providers, practices, or legal obligations. We will post the revised Policy with a new effective date. If a change materially expands how we use previously collected personal information, we will provide additional notice or obtain consent when required. We will not quietly repurpose previously collected information for a materially incompatible purpose.

23. Contact

Questions, privacy requests, appeals, or concerns may be sent to privacy@prioritygovernance.com.

Priority Governance operates from Colorado, United States.

Launch Check: Confirm the operator’s legal name and complete notice address; applicable controller/business status and thresholds; Supabase and Vercel regions and agreements; the transactional email, payment, scheduling, video-meeting, tax, and file-delivery providers actually selected; exact retention schedule; international transfer mechanism; cookie configuration; marketing-email footer process; and whether additional jurisdiction-specific notices are required before publishing.