Privacy Policy

1. Who operates GrowthReadyIQ

GrowthReadyIQ is operated by Seven Tree Media, referred to in this Policy as "GrowthReadyIQ," "we," "us," or "our." GrowthReadyIQ provides goal-specific business readiness assessments, research context, AI-assisted reporting, financial and valuation context, improvement plans, advisor collaboration, document workflows, account management, and related services. This Policy applies to the GrowthReadyIQ marketing website, application, related portals, communications, and supported integrations.

Privacy contact and designated contact for privacy inquiries: Devon Jones, GrowthReadyIQ, care of Seven Tree Media. Email: devon@growthreadyiq.com. Telephone: 403-585-5132. Location: Alberta, Canada.

Our services involve business information that may include information about identifiable individuals. We recognize that business confidentiality and personal privacy can overlap, particularly for owner compensation, shareholder matters, contact details, and information about employees, successors, investors, and advisors.

2. What information we collect

We may collect account and identity information, including name, email, phone number, business name, title, employer, login credentials or authentication records, invitation and referral details, and communication preferences. We may collect business and assessment information, including industry, business model, location, revenue bands, actual or estimated financial figures, cash, debt, ownership and compensation context, customers, employees, operating procedures, contracts, succession arrangements, strategic goals, timelines, and answers to assessment questions.

We may collect platform work information, including generated reports and recommendations, action decisions, task assignments, comments, milestones, schedules, advisor notes, supplemental questions, professional support requests, authorized valuation adjustments, uploaded files, evidence submissions, and verification outcomes. Where eligible and activated, this may include capital-raising profiles, investor mandate criteria, disclosure choices, and consent decisions.

We also may collect technical and usage information, such as IP address, device and browser information, sign-in and security events, session identifiers, page views, feature interaction and diagnostic logs, and information needed to provide, protect and improve the Service. Marketing site forms may be processed by an embedded third-party form provider selected by us, and that provider may collect submission and technical metadata under its applicable terms.

3. Sources of information

Information may be supplied by you; by a business owner, authorized Partner, representative, team member or invited specialist; through uploads or approved integrations; through activity in our Service; and from publicly accessible business or market sources used for contextual research. An invitation or referral connects the identified parties within permitted scopes; it does not make private business records available to every advisor using the platform.

Public research may describe market conditions, industries, company websites, competitors and third-party publications. We distinguish research context from user-provided assessment evidence. Public information may be incomplete or outdated, and we may retain source information to allow review of report claims.

4. Why we use information

We process information to create and administer accounts; authenticate users; deliver interviews and assessments; research relevant public context; apply goal-specific frameworks; generate reports and contextual financial analysis; maintain Action Plans and engagement workspaces; enable authorized professionals to collaborate; handle documents, invitations, notifications, help requests, sharing and support; operate requested capital and investor-discovery workflows; prevent misuse; investigate errors; maintain security; measure service performance; fulfill agreements; and meet legal duties.

We may use aggregated or de-identified information to understand service usage, product quality or general trends when doing so is appropriate and permitted. We use personally identifiable business assessment data for additional purposes only when there is a valid legal basis and the applicable notice, permission or consent. We do not treat a user's request for an assessment as automatic permission for investor marketing or public disclosure.

5. Legal bases and consent

Applicable privacy laws vary by jurisdiction. Where consent is required, we seek consent suited to the purpose and sensitivity of the information. Other lawful grounds may apply, including carrying out contractual obligations, satisfying legal requirements, and legitimate interests where permitted and appropriately balanced against individual rights.

For individuals covered by the UK GDPR or EU GDPR, the applicable legal basis may include performance of a contract, legitimate interests in securely operating and improving the Service, compliance with legal obligations, and consent for specified optional activities. Additional explicit consent may be required for particular sensitive processing. You may withdraw consent where it is the legal basis, subject to limitations relating to prior lawful processing, contractual needs and statutory retention duties.

6. AI-supported interviews, findings and reports

GrowthReadyIQ uses software processes and AI-enabled services to interpret assessment answers, select governed follow-up questions, summarize business evidence, produce narrative reports and practical recommendations, and support eligible financial and matching analyses. Inputs may be transmitted to contracted technology providers to perform these functions, under the conditions and protections applicable to those arrangements.

AI-assisted inferences can be inaccurate or incomplete. Assessment scores follow the selected assessment framework; results can depend on self-reported business facts. A diagnostic score, a live action-completion projection, a confidence measure, a valuation scenario, and an investor-match signal are different outputs. None represents a credit decision, professional appraisal, guarantee of sale, or confirmed funding commitment. Appropriate human assessment and professional diligence remain important.

We seek to limit access to sensitive business information and avoid additional AI training uses that exceed the communicated purpose or applicable authorization. Specific provider arrangements, model retention settings and permitted uses depend on the contracted configuration and may change with notice where legally required. Contact us for further information about material processing arrangements relevant to your information.

7. Authorized Partners, specialists and visibility

The Service supports different roles, including business owners, Partners, Partner team members, specialists, and account administrators. Information visibility depends on account associations, ownership, engagement membership, assignment, role permissions, sharing decisions, and applicable configuration. Access to a report does not inherently provide access to its raw interview answers, sensitive financial information, uploaded documents, or valuation details.

An invited expert may access only the information and actions allowed for that engagement. Authorized Partners may review client-facing reports and separate advisor briefings, manage eligible engagement work and provide professional support. A client-specific advisor briefing is distinct from the client's published assessment report. Platform administrators may access information to the extent needed for authorized operation, maintenance, security, troubleshooting and legal compliance.

8. Partner and business responsibilities

Business owners and Partners may have independent legal duties to provide notices, obtain consent, establish authority to submit information, restrict professional access, and respond to individuals whose details they enter. A Partner may act as an independent controller for its own client relationship and a service recipient or authorized processor in other contexts. Responsibility for a particular dataset depends on the parties' purposes, permissions, instructions and applicable law, rather than a single label applied to every use.

If you enter information about an employee, customer, co-owner, successor, investor, supplier or other person, you are responsible for having appropriate authority to provide that information and for limiting the disclosure to what is reasonably necessary.

9. Service providers and disclosures

We may use hosting, cloud storage, infrastructure, database, authentication, email, automation, CRM, website form, analytic, logging, AI processing, customer support, payment or other technology service providers, depending on the feature and configuration. Providers may access personal information as needed to deliver their services under appropriate contractual, technical and organizational measures.

We may disclose information to the authorized businesses, Partners, specialists and recipients selected through the Service; to service providers performing contracted work; to legal or regulatory authorities when required or permitted by law; to professional advisers under confidentiality duties; and in connection with a genuine business reorganization, financing, merger or sale, subject to applicable safeguards. We may preserve or disclose information when reasonably necessary to investigate misuse, enforce lawful rights, or protect users and the platform.

10. Sharing reports and documents

Certain users may create report-sharing links with section selection, expiration and optional password controls, where available and authorized. Anyone obtaining an active link may be able to view the content permitted by the link's configuration. Recipients may save, screenshot, print or otherwise retain information after access is revoked or a link expires. Before sharing, review the intended recipient, selected sections and confidentiality expectations.

Document uploads and evidence records are associated with appropriate accounts, assessments or engagements. Authorized reviewers may verify or reject submitted evidence. Uploading a file does not automatically verify it, amend a finalized interview or generate a new report.

11. Investor discovery and consent

Investor-discovery features, where enabled and available to eligible accounts, follow a distinct, opt-in workflow. The assessment owner selects whether discovery consent is granted and which information sections may be disclosed. A Partner's involvement does not replace that owner decision. Approved opportunity data may be compared with authorized investor mandates and disclosed to relevant recipients within the enabled feature.

Consent may be revoked through the available controls. Revocation restricts future disclosure under the workflow, subject to lawful retention and information previously received or copied by authorized third parties. A match signals possible alignment; it is not a financing promise.

12. Cookies, website technologies and analytics

We may use cookies, local storage, server sessions and similar technologies for login security, account recognition, presentation choices, site reliability, language or appearance preferences, preferences between visits, basic analytics, and any optional marketing features actually enabled on the site. A website appearance selection may be stored in your browser so your chosen light or dark design carries between pages.

Third-party embedded forms, integrations or media may set their own identifiers and collect technical information. We provide additional notices and choices where required for nonessential technologies. You can adjust browser settings to manage local storage and cookies, though some account functions rely on necessary session technologies. If advertising pixels or cross-context advertising technologies are introduced, applicable consent and opt-out obligations will be addressed before activation.

13. Marketing communications

We may contact you about requested services, invitations, assessment progress, reports, assigned tasks, invitations, security matters and other transactional account needs. Separately, we may send product or marketing communications when permitted by applicable law and the recipient's preferences.

Commercial electronic messages sent from or into Canada are subject to Canada's Anti-Spam Legislation, including applicable consent, identification and unsubscribe requirements. U.S. commercial email is subject to applicable CAN-SPAM requirements. Unsubscribing from promotional communications may not stop account security or requested service notices.

14. Data security

We use risk-appropriate technical and organizational safeguards intended to protect information from unauthorized access, use, alteration, disclosure or loss. Measures may include access controls, role permissions, transport protections, authentication controls, monitoring, logging, restricted administrative access, and service-provider review. Safeguards and implementation vary by system and configuration, and information security requires ongoing attention.

You are responsible for maintaining the secrecy of your credentials, controlling invitations and share links, restricting the information you submit, and alerting us about suspected account misuse. No networked service can eliminate every operational or security risk.

15. Retention and deletion

We retain personal and business information for periods reasonably necessary to fulfill the stated purposes, maintain continuing assessments and engagements, comply with law, resolve disputes, support legitimate accounting or audit duties, prevent abuse, and enforce agreements. Different categories, including completed reports, assessment history, engagement records, security logs and backups, may have different retention schedules.

A permitted deletion request may result in deletion, anonymization or access restriction, subject to technical limitations, backup cycles, lawful retention requirements, and other parties' independent records. A request to delete from the platform does not remove files or reports already downloaded by external recipients. We will explain material exceptions when responding to an eligible request.

16. International data processing

Information may be processed or accessed in Canada, the United States, or other countries where our service providers and authorized recipients operate. Laws in those countries can differ from those in your home jurisdiction, and lawful access requests by authorities may be possible.

We assess and apply contractual, organizational, and legal safeguards required for applicable cross-border transfers. If Canadian provincial requirements, Québec private-sector law, or European data protection rules require an assessment or transfer mechanism, those requirements must be addressed for the relevant processing arrangement. Contact us for details applicable to your account and location.

17. Access, correction, requests and complaints

Depending on the law applicable to you, you may request access to personal information, correction of inaccurate information, withdrawal of consent, deletion, a copy of certain data, restriction of processing, an objection to certain uses, or information about significant automated processing. Some requests are subject to verification, lawful exemptions and the rights of other people. Certain account details and document controls may be available directly in the platform.

Send requests to devon@growthreadyiq.com, describing the request and the account or business involved. We may ask for reasonable identity verification before releasing sensitive records. Where information is controlled by an independent Partner, we may assist in routing the request to the appropriate party. We will respond within the period required by the relevant law and explain available complaint routes.

18. Canadian privacy rights

Canadian organizations and individuals may have protections under the Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta's Personal Information Protection Act (PIPA), British Columbia's PIPA, Québec's private-sector privacy law as amended by Law 25, and other applicable laws. Relevant rights can include appropriate notice, meaningful consent, access, correction, reasonable safeguards, limiting collection and retention, and complaints to the relevant privacy regulator.

Alberta law includes mandatory notification to the provincial Privacy Commissioner where a breach poses a real risk of significant harm. Federal or other provincial reporting and individual notification obligations may also apply. We assess incidents against the rules applicable to the affected records and individuals.

19. United States privacy rights

Some U.S. states provide additional privacy rights depending on the individual's residence, the data at issue, the organization's activity, and applicable coverage thresholds. Where relevant law applies, eligible individuals may have rights to know, access, correct, delete, obtain certain portable information, opt out of defined data sales or targeted-advertising sharing, limit specified uses of sensitive information, and appeal certain refusals.

For California residents, the California Consumer Privacy Act, as amended, may provide notice and rights concerning categories of information collected, sources, purposes, disclosed categories and recipients, retention, access, correction, deletion, and opt-out rights. We do not offer personally identified assessment files as a commercial list for sale. The legal meaning of "sale" or "sharing" may include certain advertising technology arrangements even where money is not exchanged; any such covered practice requires the applicable disclosure and choice. You may submit requests using the contact details above. We do not discriminate unlawfully against users for exercising privacy rights.

20. EU, EEA, UK and other regions

Where the GDPR, UK GDPR or similar laws apply, individuals may exercise available rights of access, correction, erasure, restriction, portability, objection, withdrawal of consent, and safeguards concerning decisions based solely on automated processing that produce legal or similarly significant effects. Requests can be subject to lawful exemptions, identity checks and the identity of the appropriate controller. You may contact your supervisory data protection authority where entitled to do so.

People in other jurisdictions may have additional rights under local law. We consider applicable requirements for transparency, retention, data transfers, safeguards and complaint handling when providing services into those markets.

21. Automated decisions, profiling and professional judgment

Readiness outputs, illustrative valuations, forecast dates and investor matching information can rely on structured calculations and AI-supported analysis. We treat these as decision support for human users. They do not themselves constitute binding financial, employment, investment, credit, insurance or professional decisions. If applicable law grants additional rights regarding significant automated decisions, please contact us to request relevant information and review.

22. Children's privacy and sensitive information

The Service is intended for adults acting in business or professional capacities. We do not design it for use by children under 18 or knowingly solicit children's personal information. If we become aware of information submitted inappropriately about a child, we will assess deletion or restriction as required by law.

Users should avoid uploading health records, government identification numbers, payment card data, passwords, personal account credentials, or other highly sensitive personal information unless the specific workflow requires it and the user has appropriate authority. Business owners and advisors should limit personal employee, customer and family data to what is genuinely necessary.

23. Changes to this policy

We may update this Policy as practices, technology, features or legal requirements change. The "Last updated" date identifies the latest version. Material changes will be communicated as required by applicable law, including additional consent where necessary. Continued use after notice is subject to the applicable agreement and law.

24. How to contact us

Seven Tree Media, operator of GrowthReadyIQ
Attention: Privacy Contact
Email: devon@growthreadyiq.com
Phone: 403-585-5132
Alberta, Canada

We welcome privacy inquiries, access or correction requests, data deletion requests and reports of a possible security incident through these channels.