Important information about how Change Reactor collects, uses, protects, stores, and manages information across our website, services, programs, and digital platforms.
| Purpose | Legal Basis |
|---|---|
| Respond to inquiries | Legitimate interest |
| Deliver services & manage client relationships | Contractual necessity |
| Process payments, invoices, refunds | Contractual necessity / Legal obligation |
| Send newsletters, updates, offers | Consent (CASL) |
| Prepare for sessions & personalize support | Contractual necessity |
| Improve website, services & user experience | Legitimate interest |
| De-identified pattern analysis & method improvement | Legitimate interest |
| Meet legal, tax, accounting & recordkeeping obligations | Legal obligation |
| Protect security & integrity of systems | Legitimate interest |
Some services involve recordings, transcripts, or detailed notes. These are used to:
Consent: We request explicit consent before recording or transcribing any session. You may decline; however, this may affect the type of support, personalization, or deliverables we can provide.
Storage: Recordings and transcripts are stored in Google Drive with access limited to the founder and essential contractors bound by confidentiality agreements.
We may use AI assisted tools (e.g., Claude, ChatGPT, Gemini) for:
Safeguards:
De-identified information is modified to reduce the likelihood of connecting it to a specific person. Aggregate information combines data across multiple participants to show broader patterns.
We use this to:
We do not sell de-identified or aggregate information.
We will not publicly share your name, identifiable personal information, story, quote, testimonial, recording, transcript, image, screenshot, or case study without separate explicit written consent.
If we wish to use your story publicly, we will ask for permission and explain exactly how it will be used. You may choose whether to agree.
Our website uses:
Consent: We display a cookie consent banner on our first visit. You may accept or decline non-essential cookies. Essential cookies (security, functionality) cannot be disabled. You can adjust browser settings to block cookies, though some website features may not function properly.
We use trusted third party providers. Your information may be processed by:
| Vendor | Purpose | Location |
|---|---|---|
| Webflow | Website hosting | United States |
| Stripe | Payment processing | United States |
| HubSpot | CRM, email marketing | United States |
| Google Workspace | Email, calendar, video meetings, cloud storage | United States |
| QuickBooks | Accounting & invoicing | United States |
| Zapier | Workflow automation | United States |
| Claude / ChatGPT / Gemini | AI-assisted business operations | United States / Varies |
Cross Border Transfers: Your information may be transferred to, stored, or processed in the United States or other jurisdictions. We address this through:
We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.
We implement reasonable administrative, technical, and organizational safeguards:
No method of online transmission or electronic storage is completely secure. While we do our best, we cannot guarantee absolute security.
In the event of unauthorized access, disclosure, or loss of personal information:
We retain personal information only as long as reasonably necessary:
| Data Type | Retention Period |
|---|---|
| Marketing subscriptions | Until unsubscribe + 1 year, then deletion |
| Payment & invoice records | 7 years (tax/accounting legal requirement) |
| Client notes, intake forms, transcripts | Duration of engagement + 2 years, then secure deletion |
| Session recordings | Duration of program + 1 year, then secure deletion |
| De-identified/aggregate data | Retained indefinitely (non-identifiable) |
| Email communications (business) | 3 years post last interaction |
You may request deletion earlier (see Section 12), subject to legal, tax, accounting, or contractual obligations that require retention.
Depending on applicable privacy law, you have the right to:
Email: rumi@changereactor.com
Response Time: Within 30 days of verified request.
Verification: We may need to verify your identity before processing certain requests.
Our services are intended for adults (18+). We do not knowingly collect personal information from children. If we become aware that a child has submitted personal information, we will take steps to delete it promptly.
Our website may contain links to third party sites. We are not responsible for their privacy practices, content, or security. Please review their policies before submitting personal information.
If you access our services from outside Canada, you understand that your information may be collected, processed, transferred, or stored in Canada, the United States, or other jurisdictions where our third-party providers operate. Privacy laws in those jurisdictions may differ from your own. By using our website, you consent to this transfer.
We may update this Privacy Policy to reflect changes in our business, services, technology, or legal obligations. The updated version will be posted on this page with a revised “Last Updated” date. Material changes will be notified via email to active clients/subscribers. Continued use after changes constitutes acceptance.
For questions, concerns, or to exercise your privacy rights:
Privacy Contact: rumi@changereactor.com
Business Address: Calgary, Alberta, Canada
Website: changereactor.com
Note: This policy is effective as of the date listed above and supersedes all prior versions.