Courage Type Privacy Policy

1. Introduction and Scope

This Privacy Policy describes the collection, use, disclosure, retention, and protection of personal information by ScareYourSoul LLC, an Ohio limited liability company ("Company," "we," "us," or "our"), in connection with The Courage Type assessment and related products and services.

This Policy applies to couragetype.com, associated assessment and results pages, and related services operated by the Company through scottsimon.us or other websites expressly referencing this Policy (collectively, the "Services").

This Policy describes our information practices and the rights available to individuals under applicable law. Where processing requires consent or separate authorization, such consent or authorization will be obtained in accordance with applicable legal requirements.

2. Information We Collect

We collect information provided by participants, information generated through assessment participation, and technical information collected through interaction with the Services.

2.1 Information Provided Directly

Information collected may include:

Identification and contact information, including name and email address.
Responses to assessment questions concerning behavioral tendencies, decision-making, relationships, professional circumstances, health-related behavior, and responses to challenging or uncertain situations.
Professional information, including employment role, seniority, organizational size, and related characteristics.
Interests, preferences, and information concerning potential participation in educational or professional-development programs.
Transaction records, correspondence, inquiries, and information provided in connection with products or services.

Payments are processed through third-party payment providers. The Company does not retain complete payment-card information.

2.2 Technical and Usage Information

We may collect IP addresses, device characteristics, browser information, approximate geographic location, referral sources, campaign identifiers, and information concerning use of the Services.

This may include assessment completion times, question-level interaction data, response modifications, abandonment points, and interactions with website communications.

2.3 Generated and Derived Information

We may generate assessment scores, primary and secondary behavioral-response classifications, Courage Type results, domain-specific results, and related interpretive information.

We may also generate engagement profiles and qualification classifications to determine the relevance of particular educational, professional, or commercial offerings.

3. Purposes of Processing

Personal information is processed for the following purposes:

Assessment Administration: Administering the assessment, calculating results, delivering reports, and maintaining participant records.

Service Delivery: Providing requested products and services, processing transactions, managing communications, and responding to inquiries.

Personalization: Identifying relevant educational materials, programs, workshops, and professional services based on participant interests, assessment information, and engagement history.

Research and Development: Evaluating assessment methodology, analyzing behavioral patterns, improving existing services, and developing new research, educational materials, and commercial products.

Analytics and Operations: Evaluating website functionality, participation trends, service performance, and operational effectiveness.

Marketing: Communicating information about publications, programs, services, and events, subject to applicable consent requirements and communication preferences.

Security and Compliance: Protecting systems, preventing fraud, enforcing applicable agreements, and satisfying legal obligations.

The Company may use automated processes to classify participants and determine relevant service offerings. These classifications are not used to make automated decisions producing legal or similarly significant effects concerning participants.

Materially different uses of identifiable personal information will be subject to any additional notice, consent, or authorization required by law.

4. Assessment Information and Confidentiality

The Courage Type is an educational and behavioral-development assessment based on self-reported responses to situational questions.

The assessment is not a medical examination, psychological diagnosis, clinical evaluation, or substitute for professional medical or mental health advice.

Individual assessment responses, identifiable Courage Type results, and associated participant records are treated as confidential information.

Access is restricted to authorized personnel, contractors, and service providers with a legitimate operational purpose and is subject to appropriate confidentiality and security requirements.

The Company does not sell personally identifiable assessment responses or Courage Type results.

The Company does not disclose assessment responses, Courage Type results, or identifiable information derived from them to third-party advertising platforms.

Certain assessment questions concern physical well-being or health-related behavior. Information qualifying for additional protection under applicable privacy laws will be processed subject to the corresponding legal requirements, including separate consent or authorization where required.

Participants may voluntarily disclose their results. Information independently disclosed publicly by a participant may be accessible to third parties outside the Company's control.

5. De-Identified and Aggregated Information; Commercial Use

The Company may create de-identified and aggregated information from assessment responses, results, participant characteristics, and related service data.

De-identified Information means information processed so that it cannot reasonably be associated with an identifiable individual or household, consistent with applicable law.

Aggregated Information means information combined from multiple participants and presented using safeguards designed to prevent individual identification.

Information remains subject to applicable personal-information protections where it can reasonably be linked to an identifiable individual, notwithstanding the removal of direct identifiers.

5.1 Commercial Rights and Permitted Uses

To the fullest extent permitted by applicable law, the Company reserves the right to use, analyze, reproduce, publish, distribute, license, sell, transfer, and otherwise commercially exploit qualifying de-identified and aggregated information and the research findings, statistical analyses, benchmarks, reports, and derivative products developed from such information.

Permitted activities include, without limitation:

Behavioral, organizational, academic, and commercial research;
Statistical analysis and industry benchmarking;
Commercial research reports and organizational insights;
Publications, presentations, books, and educational materials;
Licensing or sale of qualifying de-identified datasets, research findings, and statistical products;
Development and commercialization of assessments, analytical tools, software, educational programs, and other products and services;
Research collaborations and licensing arrangements with academic institutions, commercial entities, and other organizations.

These rights apply only to information and uses satisfying applicable de-identification, confidentiality, consent, and other legal requirements.

5.2 De-Identification and Safeguards

The Company will maintain reasonable technical and organizational measures designed to prevent de-identified information from being associated with identifiable individuals or households.

Such measures may include removal of direct identifiers, generalization of indirect identifiers, statistical aggregation, suppression of small groups, and restrictions on data access and disclosure.

The Company publicly commits to maintaining and using information designated as de-identified only in de-identified form and will not attempt to re-identify individuals from that information.

Recipients of de-identified datasets will be contractually required to maintain appropriate safeguards, use the information in de-identified form, and refrain from attempting re-identification.

Removal of names, email addresses, or other direct identifiers alone does not establish that information has been adequately de-identified.

5.3 Retention and Subsequent Uses

Qualifying de-identified and aggregated information may be retained for research, analytical, educational, and commercial purposes without a predetermined expiration date, where permitted by law.

Deletion of identifiable personal information does not necessarily require withdrawal of information lawfully incorporated into research products or datasets that have been effectively de-identified.

Nothing in this Section authorizes disclosure or commercialization of identifiable personal information in violation of applicable law.

6. Disclosure of Personal Information

The Company may disclose personal information to the following categories of recipients when necessary for legitimate purposes consistent with this Policy:

Service Providers and Contractors: Providers supporting hosting, assessment administration, data processing, email delivery, payment processing, scheduling, security, analytics, and related operations. Such providers are subject to applicable contractual restrictions and data protection obligations.

Organizational Clients: Sponsoring organizations receiving information in accordance with Section 7 and applicable participant authorizations.

Professional Advisers: Legal, accounting, insurance, and other advisers where reasonably necessary for legitimate business or legal purposes.

Legal and Regulatory Authorities: Government agencies, courts, and other authorized recipients where disclosure is required by law or reasonably necessary to establish, exercise, or defend legal rights.

Business Transactions: Parties involved in mergers, acquisitions, reorganizations, financing arrangements, or transfers of business assets, subject to applicable safeguards and legal obligations.

Other Authorized Recipients: Third parties receiving information pursuant to valid participant authorization or another applicable lawful basis.

The Company does not sell personal information for monetary consideration.

Certain advertising-related technologies operating on marketing pages may nevertheless constitute a "sale," "sharing," or targeted advertising under applicable privacy laws, including where no monetary payment occurs. Applicable opt-out rights are described in Section 11.

The Company's commercial rights concerning qualifying de-identified and aggregated information are governed separately by Section 5.

7. Organizational and Corporate Assessments

The Courage Type may be administered in connection with employer-sponsored programs, leadership development, workshops, organizational training, and other professional engagements.

Where participation is sponsored by an organization, participants will receive notice concerning the categories of information, if any, disclosed to that organization.

Individual assessment responses and personally identifiable Courage Type results will not be disclosed to an employer without the participant's express authorization, except where disclosure is otherwise required by law.

The Company may provide organizational clients with aggregated analyses, participation metrics, and group-level reports, subject to appropriate confidentiality and de-identification safeguards.

Group-level Courage Type results will be reported only for groups containing at least 10 participants. Additional aggregation, suppression, or withholding will be applied where a particular category, subgroup, or combination of characteristics could reasonably permit individual identification.

The minimum group size does not independently establish that information is anonymous. The Company will evaluate identification risk in the context of the information and intended recipients.

The Courage Type is not designed or validated for employee selection, hiring, promotion, termination, or other consequential employment determinations. The Company does not authorize organizational clients to use the assessment for such purposes without separate contractual authorization and appropriate legal and professional review.

Organizational clients are subject to applicable contractual limitations governing access, confidentiality, permitted use, and redistribution of assessment information.

8. Cookies, Analytics, and Advertising Technologies

The Services may use cookies and similar technologies for essential functionality, session management, performance measurement, analytics, and other legitimate operational purposes.

Subject to applicable law and user preferences, marketing pages may employ advertising technologies to measure campaign performance and support advertising activities.

The Company does not disclose assessment responses, Courage Type results, or information derived from them to advertising platforms. Advertising technologies are not deployed on assessment question pages, individualized results pages, or personalized assessment reports.

Assessment responses and Courage Type classifications are not used to create, upload, or target advertising audiences on third-party advertising platforms.

Where advertising activities constitute a sale, sharing, or targeted advertising under applicable law, individuals may exercise applicable opt-out rights through the privacy controls provided by the Company.

The Company honors Global Privacy Control and other legally recognized opt-out preference signals where required by applicable law.

Individuals may unsubscribe from marketing communications through the mechanism provided in applicable emails. Transactional and necessary administrative communications may continue where permitted.

9. Data Retention

The Company retains personal information only for periods reasonably necessary to fulfill the purposes identified in this Policy, comply with applicable legal and contractual obligations, maintain business records, resolve disputes, and protect legitimate business interests.

Retention periods are determined by the category of information, the purpose of processing, applicable statutory requirements, and the necessity of continued retention.

Upon expiration of the applicable retention period, information will be deleted, securely disposed of, or de-identified, as appropriate.

Information may remain temporarily in protected backup systems in accordance with established backup and deletion procedures, subject to applicable legal requirements.

De-identified and aggregated information may be retained as described in Section 5.

10. Information Security

The Company maintains reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information processed and the risks associated with its collection, storage, transmission, and use.

Such safeguards may include encryption, access controls, authentication measures, vendor oversight, confidentiality restrictions, and secure data management procedures.

Access to identifiable assessment information is limited to authorized individuals with a legitimate business need.

No electronic system can be guaranteed to be completely secure. The Company does not warrant absolute security against unauthorized access or other security incidents.

Security incidents involving personal information will be assessed, addressed, and reported in accordance with applicable legal requirements.

11. Privacy Rights and Individual Choices

Depending on applicable law, individuals may have the right to:

Access personal information maintained by the Company;
Request copies of qualifying personal information;
Correct inaccurate information;
Request deletion, subject to applicable exceptions;
Withdraw consent where processing depends on consent;
Opt out of qualifying sales, sharing, targeted advertising, or certain automated profiling;
Restrict or object to particular processing activities where applicable;
Appeal certain determinations concerning privacy requests;
Exercise additional rights relating to sensitive personal information.

Privacy requests may be submitted to the Company using the contact information in Section 15.

The Company may undertake reasonable verification procedures before processing requests and may decline or limit requests where permitted by law.

Requests will be addressed within the time periods required by the applicable jurisdiction. Where provided by law, individuals may authorize representatives to submit requests on their behalf.

The Company will not unlawfully discriminate against individuals for exercising their privacy rights.

Certain rights may not apply to information lawfully maintained in a de-identified or aggregated form that can no longer reasonably be associated with an identifiable individual.

12. International Processing

The Company is established in the United States. Personal information may be processed in the United States or other jurisdictions where the Company's authorized service providers operate.

The Services may be accessed by individuals located outside the United States. Where applicable international data protection laws govern processing, the Company will comply with requirements concerning lawful processing, individual rights, retention, and international transfers.

For processing subject to the European Union or United Kingdom General Data Protection Regulation, the applicable legal basis will depend on the processing purpose. Such bases may include performance of a contract, compliance with legal obligations, legitimate interests where permitted, and consent where required.

Where those regulations apply, individuals may have additional rights, including rights to object to processing, request restriction or portability, and lodge complaints with an appropriate supervisory authority.

International transfers will be subject to safeguards required by applicable law.

13. Children's Privacy

The Services are intended exclusively for individuals aged 18 years or older.

The Company does not knowingly collect personal information from individuals under 18 through the Services.

Where the Company becomes aware that information has been collected from an ineligible individual, it will take appropriate corrective action, including deletion where required by law.

14. Amendments

The Company may amend this Policy to reflect changes in applicable law, assessment functionality, information practices, or business operations.

Revisions will be published with an updated effective date.

Where required by law, material changes affecting previously collected information will be subject to additional notice or consent.

15. Contact Information

Questions, complaints, and requests concerning this Policy or the Company's information practices may be directed to:

ScareYourSoul LLC
Attn: Privacy
Email: privacy@scareyoursoul.com