Privacy Policy

1. Who we are

Exceed is a service operated by ResearchOrg (“we,” “us,” or “our”); Exceed is a subsidiary of ResearchOrg. ResearchOrg is the organization responsible for the personal information collected through Exceed. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws.

This Policy applies to the Exceed websites, applications, and services (the “Service”) and should be read together with our Terms of Service.

2. Information we collect

We collect the following categories of personal information:

• Account information — such as your name, email address, password, and timezone.
• Your self-assessment — your item-level answers about your own energy and working style, and the profile (type, confidence, evidence) computed from them.
• Your manager and stakeholder assessments — your own observations of a manager or other workplace stakeholder you choose to add, submitted as item-level answers, plus the profile computed from them. See Section 4 for how this is handled.
• Tracker and habit data — the daily and weekly habits generated from your results, your check-ins against them, and any currency-log entries and notes you record.
• Payment information — payments are processed by Paddle (see Section 7). We do not collect or store full payment-card numbers; we receive limited transaction details such as confirmation status, billing country, and partial card information.
• Usage and device information — such as IP address, device and browser type, pages viewed, and log data, collected through cookies and similar technologies.
• Communications — messages you send us, including support requests.

3. How we use your information

• to provide, operate, and improve the Service, including generating your profile, gap analysis, and tracker;
• to recompute your results if our scoring or bands change, without asking you to re-answer;
• to process payments (through ResearchOrg and Paddle);
• to send transactional and service communications (for example, account and activation notifications);
• to maintain security, prevent fraud and abuse, and debug issues;
• to comply with legal obligations and enforce our Terms.

4. Information you submit about other people

Exceed lets you record your own perception of a manager or other workplace stakeholder — for example, how they communicate, decide, and what you’ve observed them value. This information is your account’s data, not theirs: it reflects your observations, is used solely to generate insights for your own account, and is not shared with, or disclosed to, the person it describes. Managers and stakeholders do not have accounts, cannot access the Service, and are not themselves users under these Terms or this Policy.

By submitting this information, you confirm it reflects your own good-faith, honest observation, and you take responsibility for how you record and act on it. See our Terms of Service for more on acceptable use.

5. Your consent

We collect, use, and disclose your personal information with your consent, except where permitted or required by law. By using the Service, you consent to the handling of your information as described in this Policy. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice — though doing so may limit your ability to use the Service. To withdraw consent, contact us using the details below.

6. How we share your information

We do not sell your personal information. We share it only as follows:

• With service providers (processors) who help us operate the Service under appropriate agreements — including Paddle (payments), and providers for database and authentication, transactional email, error monitoring, and hosting.
• For legal and safety reasons — to comply with law, respond to lawful requests, or protect the rights, safety, and property of ResearchOrg, our users, or the public.
• In a business transfer — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

7. Payments and Paddle

Payments through the Service are collected by ResearchOrg using Paddle (Paddle.com Market Limited and its affiliates) as our merchant of record. Paddle processes your payment information under its own privacy policy and maintains PCI-DSS-compliant payment security. We receive transaction confirmations and limited billing details from Paddle, but not your full card number.

8. International data transfers

Some of our service providers may store or process personal information outside of Canada, including in the United States and other countries. Where information is transferred outside Canada, it may be subject to the laws of those jurisdictions, and we take reasonable steps to ensure it is protected by comparable safeguards.

9. Data retention

We keep your raw assessment answers, not just the computed result, so your profile stays recomputable if a scoring or band definition changes later — a deliberate design choice, not an incidental one. We retain personal information for as long as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we take reasonable steps to delete or anonymize it, subject to any legal retention requirements.

10. How we protect your information

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, use, or disclosure. All data is scoped to your own account at the database level. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your rights and choices

Subject to applicable law, you may:

• access the personal information we hold about you and request a copy;
• request correction of inaccurate or incomplete information;
• withdraw consent or request deletion of your information (subject to legal limits);
• update much of your account information directly in the Service.

To exercise these rights, contact our Privacy Officer using the details below. If you have an unresolved concern, you may also contact the Office of the Privacy Commissioner of Canada.

12. Cookies and analytics

We use cookies and similar technologies that are necessary to operate the Service (such as keeping you signed in) and, where applicable, to understand usage and improve the Service. You can control cookies through your browser settings; disabling some cookies may affect how the Service works.

13. Age requirement

The Service is intended for individuals who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, please contact us and we will take appropriate steps.

14. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will take reasonable steps to notify you, such as posting the updated Policy with a new “Last updated” date. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

15. Contact us

To ask about this Policy or exercise your privacy rights, contact our Privacy Officer: