This Privacy Policy explains how High Intent Digital ("High Intent Digital", "we", "us", or "our") collects, uses, shares, and protects personal information in connection with the AIMS Charter platform (the "Service") and our website at highintentdigital.com.
This Policy applies to individuals who visit our website, take the AI Risk Snapshot, register for an account, use the Service, communicate with us, or otherwise interact with High Intent Digital.
This Policy does not cover data our customers process using the Service in their own capacity as data controllers. Where High Intent Digital acts as a processor of personal data on behalf of a customer, that processing is governed by our Data Processing Addendum (available on request; final DPA to be published prior to public launch).
2. Information we collect
2.1 Information you provide directly
Account registration: name, email address, company name, password (stored as a PBKDF2-SHA512 hash, never in plaintext).
AI Risk Snapshot: answers to Snapshot questions, contact information, company details, tier selection.
Onboarding: role, department, activation date, communication preferences, SSO details, and other configuration answers.
Payment information: billing name and address. Credit card and bank account details are collected and stored by our payment processor (Stripe) and are not stored by High Intent Digital.
Customer Data submitted to the Service: policies, incidents, vendor evaluations, module entries, uploaded documents, employee attestations, and any other information you or your Users submit. This information is processed on your behalf; you are the controller and High Intent Digital is the processor. See our Data Processing Addendum.
Communications: emails, chat messages, and any other correspondence you send us.
2.2 Information we collect automatically
Usage data: pages viewed, features used, session duration, IP address, browser type and version, operating system, referring URL.
Cookies and similar technologies: see the Cookies section below.
Log data: server logs including timestamps, request paths, response codes, and error messages.
Marketing tracking: when you interact with our marketing communications (email opens, link clicks), our marketing platform (SharpSpring) records this activity.
Payment status: our payment processor (Stripe) tells us the status of your subscription.
Public sources: we may consult public sources (LinkedIn, company websites) to verify or supplement account information at signup.
3. How we use information
We use information to:
Provide, operate, secure, and improve the Service
Create and manage your account
Process payments and manage subscriptions
Send transactional messages (verification, password reset, receipts, service notifications)
Respond to your requests and provide customer support
Send marketing communications where you have opted in (you can opt out at any time)
Detect, prevent, and address technical issues, fraud, and abuse
Enforce our Terms of Service
Comply with applicable law, respond to lawful requests, and defend our legal rights
Aggregate anonymized data for research, benchmarking, and product analytics (no individual can be identified in aggregated data)
4. Legal basis for processing (GDPR)
If you are in the European Economic Area, United Kingdom, or Switzerland, our legal basis for processing your personal information depends on the specific processing:
Contract performance: to provide the Service you have subscribed to (Article 6(1)(b) GDPR)
Legitimate interests: to secure and improve the Service, communicate with you about your account, detect and prevent fraud, and pursue our commercial interests where these are not overridden by your rights (Article 6(1)(f) GDPR)
Consent: for marketing communications and non-essential cookies (Article 6(1)(a) GDPR); you may withdraw consent at any time
Legal obligation: to comply with tax, accounting, and other legal requirements (Article 6(1)(c) GDPR)
Where we process special-category data on behalf of a customer under the Service (for example, if a customer chooses to log an incident involving employee personal data), the customer is responsible for establishing an appropriate legal basis under Article 9 GDPR before submitting such data.
5. How we share information
We do not sell personal information. We share personal information only as described here:
Sub-processors: service providers who process personal information on our behalf, under contractual data-protection commitments. See the Sub-processors section.
Affiliates: other High Intent Digital entities, where applicable, for the same purposes stated in this Policy.
Legal obligations: government authorities, courts, or other third parties where required by law, legal process, or a valid legal demand.
Protection of rights: to enforce our Terms, protect our rights, property, or safety, or to detect fraud or security issues.
Business transfers: to a successor entity in the event of a merger, acquisition, or sale of assets, subject to standard confidentiality and privacy protections.
With your consent: for any other purpose we describe and to which you consent at the time of collection.
Customer Data (data our customers submit to the Service) is not shared with any third party except sub-processors listed below, and only as necessary to operate the Service for you.
6. Sub-processors
We use the following sub-processors to operate the Service. This list is illustrative and may be updated from time to time; the current list is maintained by us and available on request (a published version is coming), and customers can subscribe to change notifications by emailing privacy@highintentdigital.com.
Netlify Inc. (United States), hosting, content delivery, serverless functions, blob storage for account data. Privacy policy.
Stripe Inc. (United States), payment processing, subscription management. Privacy policy.
Google LLC (United States), transactional email delivery via Gmail. Privacy policy.
SharpSpring Inc. (United States), marketing automation, lead capture, email drip campaigns. Privacy policy.
Additional sub-processors may be added as we integrate new capabilities. Where the change materially affects your rights, we will notify affected customers.
7. Data retention
We retain personal information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.
Account data: retained for the life of your Account plus 90 days after termination. You may request earlier deletion in writing (subject to legal retention obligations).
AI Risk Snapshot responses: retained for as long as you remain in our lead nurture; you may unsubscribe and request deletion at any time.
Financial records: retained for at least 7 years to comply with tax and accounting law.
Log data: retained for up to 12 months.
Aggregated / anonymized data: retained indefinitely (cannot be linked to an individual).
8. Your rights
Depending on your jurisdiction, you may have the following rights over your personal information:
Access: request a copy of the personal information we hold about you
Correction: request that we correct inaccurate information
Deletion: request that we delete your personal information (subject to legal retention obligations)
Restriction: request that we limit certain processing
Portability: request a machine-readable copy of your data
Objection: object to processing based on legitimate interests
Withdraw consent: withdraw consent where consent is the legal basis (for marketing, this is one-click unsubscribe at the bottom of every marketing email)
Complaint: lodge a complaint with your data protection authority
To exercise these rights, email privacy@highintentdigital.com. We will respond within 30 days (or 45 days for complex requests, with an interim response).
California residents: under CCPA / CPRA you have additional rights including the right to know what categories of personal information we collect, the right to delete, the right to correct, the right to opt out of sale or sharing (we do not sell personal information), and the right to non-discrimination for exercising your rights. Requests may be submitted to the same address above.
9. International data transfers
High Intent Digital is based in the United States. Our sub-processors are primarily based in the United States. If you access the Service from outside the United States, your personal information will be transferred to and processed in the United States, which may have data protection laws different from those in your jurisdiction.
Where we transfer personal information out of the European Economic Area, United Kingdom, or Switzerland, we rely on the Standard Contractual Clauses (SCCs) adopted by the European Commission, on the UK International Data Transfer Addendum where applicable, and on any additional supplementary measures our sub-processors provide. Documentation is available on request.
10. Cookies and tracking
We use cookies and similar technologies to operate the Service, remember your preferences, understand usage patterns, and (where you consent) support marketing analytics. Categories:
Strictly necessary: session management, authentication, security. These cannot be disabled.
Analytics: aggregate visitor metrics via first-party log processing. Anonymized IP.
Marketing: SharpSpring visitor tracking cookie (__ss_tk) links your marketing activity to any subsequent form fills. You can opt out via your browser's cookie controls or via your account preferences (once available).
Once we begin serving customers in the European Economic Area or United Kingdom, we will present a cookie consent banner allowing you to accept or reject each optional cookie category before it fires.
11. Children
The Service is intended for professional and organizational use. It is not directed to children under 16 (or 13 in the United States) and we do not knowingly collect personal information from children. If you believe a child has provided information to us, please contact privacy@highintentdigital.com and we will delete it.
12. Security
We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include:
Encryption of data in transit (HTTPS / TLS)
Encryption at rest for stored data
Access controls, authentication, and role-based permissions
Password hashing (PBKDF2-SHA512 with per-user salt and 200,000 iterations)
Session token rotation and TTL-based expiration
Rate limiting on public endpoints and authentication endpoints
Regular security review of our code, dependencies, and infrastructure
Vendor due diligence on our sub-processors
No system is entirely secure. If we become aware of a security incident affecting your personal information, we will notify affected users and (where required) authorities within applicable legal timelines.
We may update this Policy from time to time. Material changes will be announced by email to registered users and by posting the updated Policy on this page at least 30 days before they take effect. Non-material changes may be posted without prior notice.
Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.
14. Contact
For questions about this Policy, requests to exercise your rights, or complaints: