Change Reactor
Terms & Conditions

Terms and Conditions

Important information about how Change Reactor collects, uses, protects, stores, and manages information across our website, services, programs, and digital platforms.

01

How We Collect Information

  • Visiting our website.
  • Subscribing to Field Notes or email lists.
  • Downloading resources.
  • Booking sessions or purchasing offers.
  • Completing intake forms, applications, or surveys.
  • Contacting us via email, forms, or social media.
  • Working with us privately or in programs.
02

How We Use Your Information

Purpose Legal Basis
Respond to inquiriesLegitimate interest
Deliver services & manage client relationshipsContractual necessity
Process payments, invoices, refundsContractual necessity / Legal obligation
Send newsletters, updates, offersConsent (CASL)
Prepare for sessions & personalize supportContractual necessity
Improve website, services & user experienceLegitimate interest
De-identified pattern analysis & method improvementLegitimate interest
Meet legal, tax, accounting & recordkeeping obligationsLegal obligation
Protect security & integrity of systemsLegitimate interest
03

Session Recordings, Transcripts & Notes

Some services involve recordings, transcripts, or detailed notes. These are used to:

  • Prepare for future sessions.
  • Track progress & personalize experience.
  • Create included deliverables (summaries, personal materials).
  • Improve service quality.
  • Identify de-identified aggregate patterns.

Consent: We request explicit consent before recording or transcribing any session. You may decline; however, this may affect the type of support, personalization, or deliverables we can provide.

Storage: Recordings and transcripts are stored in Google Drive with access limited to the founder and essential contractors bound by confidentiality agreements.

04

AI Assisted Tools

We may use AI assisted tools (e.g., Claude, ChatGPT, Gemini) for:

  • Summarizing notes, organizing themes.
  • Drafting internal materials, preparing for sessions.
  • Reviewing de-identified patterns, supporting content creation.

Safeguards:

  • We limit personal information shared with AI tools to what is necessary.
  • Where possible, we use de-identified, anonymized, or minimized information rather than raw identifiable data.
  • We do not use private client recordings, transcripts, or reflections to train public AI models.
  • Human judgment, interpretation, and final decisions remain with Change Reactor.
05

De-Identification & Aggregate Use

De-identified information is modified to reduce the likelihood of connecting it to a specific person. Aggregate information combines data across multiple participants to show broader patterns.

We use this to:

  • Improve The Switch and other offers.
  • Identify recurring transformation patterns.
  • Develop educational frameworks.
  • Train internal systems and contractors.

We do not sell de-identified or aggregate information.

06

Public Use of Client Stories

We will not publicly share your name, identifiable personal information, story, quote, testimonial, recording, transcript, image, screenshot, or case study without separate explicit written consent.

If we wish to use your story publicly, we will ask for permission and explain exactly how it will be used. You may choose whether to agree.

07

Cookies, Analytics & Tracking Technologies

Our website uses:

  • Google Analytics (usage patterns, page visits).
  • Cookies (session management, preferences).
  • Meta Pixel / Facebook Pixel (if installed, will be disclosed at time of implementation).
  • Webflow Analytics (hosting platform analytics).

Consent: We display a cookie consent banner on our first visit. You may accept or decline non-essential cookies. Essential cookies (security, functionality) cannot be disabled. You can adjust browser settings to block cookies, though some website features may not function properly.

08

Third Party Platforms & Service Providers

We use trusted third party providers. Your information may be processed by:

Vendor Purpose Location
WebflowWebsite hostingUnited States
StripePayment processingUnited States
HubSpotCRM, email marketingUnited States
Google WorkspaceEmail, calendar, video meetings, cloud storageUnited States
QuickBooksAccounting & invoicingUnited States
ZapierWorkflow automationUnited States
Claude / ChatGPT / GeminiAI-assisted business operationsUnited States / Varies

Cross Border Transfers: Your information may be transferred to, stored, or processed in the United States or other jurisdictions. We address this through:

  • Standard Contractual Clauses (SCCs) or equivalent safeguards.
  • Data Processing Agreements (DPAs) with vendors.
  • Selecting vendors with robust security certifications.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

09

How We Protect Your Information

We implement reasonable administrative, technical, and organizational safeguards:

  • Access Controls: Password protected systems; access limited to founder and essential contractors.
  • Authentication: Multi factor authentication (2FA) enforced on all accounts.
  • Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256) where available.
  • Vendor Review: Regular review of what information is shared with service providers and AI tools.
  • Staff Training: Contractors bound by confidentiality and data handling requirements.
  • Incident Response: Documented breach response plan (see Section 10).

No method of online transmission or electronic storage is completely secure. While we do our best, we cannot guarantee absolute security.

10

Data Breach Notification

In the event of unauthorized access, disclosure, or loss of personal information:

  • We will investigate the breach promptly.
  • We will notify affected individuals within 72 hours of discovery where there is a real risk of significant harm.
  • We will report to the Office of the Privacy Commissioner of Canada (OPC) and/or Alberta OIPC as required by law.
  • We will take reasonable steps to mitigate harm and prevent recurrence.
11

Data Retention

We retain personal information only as long as reasonably necessary:

Data Type Retention Period
Marketing subscriptionsUntil unsubscribe + 1 year, then deletion
Payment & invoice records7 years (tax/accounting legal requirement)
Client notes, intake forms, transcriptsDuration of engagement + 2 years, then secure deletion
Session recordingsDuration of program + 1 year, then secure deletion
De-identified/aggregate dataRetained indefinitely (non-identifiable)
Email communications (business)3 years post last interaction

You may request deletion earlier (see Section 12), subject to legal, tax, accounting, or contractual obligations that require retention.

12

Your Rights

Depending on applicable privacy law, you have the right to:

  • Access: Request a copy of personal information we hold about you.
  • Correction: Request correction of inaccurate or incomplete information.
  • Deletion: Request deletion of your personal information.
  • Withdraw Consent: Withdraw consent for marketing emails or optional data uses.
  • Object: Object to certain processing activities.
  • Portability: Request your data in a portable format where feasible.
  • Questions: Ask about recordings, transcripts, AI tools, or de-identified analysis.
Privacy Contact

Email: rumi@changereactor.com

Response Time: Within 30 days of verified request.

Verification: We may need to verify your identity before processing certain requests.

13

Children’s Privacy

Our services are intended for adults (18+). We do not knowingly collect personal information from children. If we become aware that a child has submitted personal information, we will take steps to delete it promptly.

14

Links to Other Websites

Our website may contain links to third party sites. We are not responsible for their privacy practices, content, or security. Please review their policies before submitting personal information.

15

International Visitors

If you access our services from outside Canada, you understand that your information may be collected, processed, transferred, or stored in Canada, the United States, or other jurisdictions where our third-party providers operate. Privacy laws in those jurisdictions may differ from your own. By using our website, you consent to this transfer.

16

Updates to this Policy

We may update this Privacy Policy to reflect changes in our business, services, technology, or legal obligations. The updated version will be posted on this page with a revised “Last Updated” date. Material changes will be notified via email to active clients/subscribers. Continued use after changes constitutes acceptance.

17

Contact Us

For questions, concerns, or to exercise your privacy rights:

Change Reactor

Privacy Contact: rumi@changereactor.com

Business Address: Calgary, Alberta, Canada

Website: changereactor.com

Note: This policy is effective as of the date listed above and supersedes all prior versions.