Privacy Policy

Who we are

This site is provided by United We Transform, operated by Collaboration.Ai. For the purposes of the European Union General Data Protection Regulation (GDPR) and the United Kingdom GDPR, we are the data controller for the limited personal data described in this policy.

You can reach us about privacy, data protection, or any request under this policy at brandon@openworklab.com. We read every message sent to that address and respond within the timelines the applicable law requires.

What we collect and what we do not

We keep collection deliberately small. Here is the complete picture.

Google Analytics usage data

When analytics is active and, in the EU and UK, when you have consented, Google Analytics 4 processes standard usage data through cookies. This includes your IP address (used to derive an approximate, city-level location and then not stored by us in identifiable form), your device and browser type, the pages you view, the referring page, and on-site interactions such as clicks and scrolling. We use this to understand how the site is used and to improve it. We have enabled IP anonymization.

Ordinary PostHog analytics, only after you accept

Ordinary PostHog analytics starts only after you explicitly accept analytics. A previous choice that named only Google Analytics does not enable PostHog. PostHog records public page visits and five selected actions: showing Finder results, opening a Finder result, opening an exercise print page, downloading a run card, and starting a facilitator session. Events include a random browser identifier, session identifiers, browser and device information, and the public page path.

We disable automatic click collection, session recording, heatmaps, error capture, surveys, performance capture, and person profiles. We remove URL query strings, fragments, referring pages, and other unapproved event properties before sending events. We do not send tool input or participant session links. IP-based location enrichment is disabled. PostHog receives the network IP address needed to deliver its service, but our ordinary analytics project now discards client IP addresses before storing new events. Earlier events captured before that setting changed on September 28, 2026 may retain IP addresses. We have not deleted those historical events. Optional company insights uses a separate project and choice, described below.

What you type into the tools stays in your browser

No accounts, no ads, no sale of data

• There are no user accounts on this site, so we do not collect names, email addresses, or passwords to use it.
• We do not run advertising, we do not use advertising cookies, and we do not personalize ads.
• We do not sell or share personal information, as those terms are defined by the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
• If you email us, we receive your email address and whatever you choose to write, and we use it only to respond to you.

Cookies and similar technologies

When analytics is active and permitted, Google Analytics 4 sets a small number of first-party cookies. There are no advertising cookies on this site.

Your analytics choices

Ordinary PostHog analytics stays off until you accept analytics, wherever you live. Google Analytics keeps its existing regional consent settings. Accepting permits Google and ordinary PostHog analytics; declining or withdrawing stops new ordinary PostHog captures and sends Google an analytics consent denial. A previous denial remains in effect.

Change analytics choices Withdraw analytics consent

Your saved choice applies in this browser.

You can reopen these controls through the Analytics choices link in the footer. Withdrawal stops new ordinary PostHog captures and removes its analytics persistence. Requests already submitted while you allowed analytics may still finish or retry. Withdrawal does not delete previously received events; contact us for a data request. You can also clear site data in your browser or install the Google Analytics opt-out browser add-on.

Optional company insights

Company insights are available only after your separate permission.

If you choose Allow company insights, we send public page visits to a separate PostHog project. PostHog records the visit time, the page path without query strings or fragments, an independent random browser identifier, and your IP address. Origami can read that project's events and use the IP address to infer a company. We use company-level interest to assess relevant business outreach. The match does not identify which person visited. It does not subscribe you or grant permission to contact a named person. We do not send tool actions, input text, referrers or identifiers from our ordinary analytics project.

Your analytics and company-insights choices are separate. Accepting analytics never enables company insights. Withdrawing either choice leaves the other unchanged. Do Not Track and Global Privacy Control disable both. You can use the site without either.

Allow company insights Decline or withdraw company insights

Company insights are available only after your separate permission.

Withdrawal stops new company-insights captures and resets their browser identifiers. Requests submitted while permission was active may still finish or retry. Withdrawal does not erase earlier records. Contact us to request deletion.

Legal bases for processing

Under GDPR Article 6, our legal bases are as follows.

• Consent for PostHog everywhere, including a separate choice for optional company insights when available, and for Google Analytics in the EU, the EEA, the UK, and Switzerland. You can withdraw that consent at any time.
• Legitimate interests for Google Analytics elsewhere, namely our interest in measuring and improving the site. Where we rely on legitimate interests you may object, as described below.
• Legitimate interests for keeping brief hosting and security logs to protect the site against abuse and to keep it available.

We do not carry out profiling or automated decision-making that produces legal or similarly significant effects.

Sharing and processors

We do not sell your personal information and we do not share it for cross-context behavioral advertising. The service providers below process the limited data described here.

• Google provides Google Analytics 4, processing the usage data described above on our behalf.
• PostHog provides the consented product analytics described above. We use its US hosting region.
• Origami reads only the separate company-insights project for the consented company-matching purpose described above.
• Cloudflare provides hosting, content delivery, and security. In that role it processes limited technical data such as IP addresses in server and security logs.

We may also disclose information if the law requires it, or to establish, exercise, or defend legal claims.

International transfers

Our providers may process data in the United States and other countries. Where personal data is transferred out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards, including the European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework and its UK and Swiss extensions.

Data retention

Google Analytics data associated with cookies and identifiers is retained for 14 months and then deleted automatically. Hosting and security logs are kept briefly, only as long as needed for security and reliability, and then discarded. Because the tools run in your browser, we do not retain any of the content you enter into them. PostHog event data remains subject to the retention settings of the relevant PostHog project. Withdrawing a choice stops new captures for that purpose; contact us to request deletion of existing data. If you email us, we keep that correspondence only as long as needed to handle your request.

Your rights

Depending on where you live, you have rights over your personal data. We honor these rights and will not discriminate against you for exercising them.

EU, EEA, and UK (GDPR and UK GDPR)

• Access to the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data.
• Restriction of processing.
• Data portability.
• Objection to processing based on legitimate interests.
• Withdrawal of consent at any time, without affecting processing already carried out.
• Lodging a complaint with your local data protection supervisory authority.

California (CCPA/CPRA)

• The right to know what personal information we collect and how we use it.
• The right to delete personal information.
• The right to correct inaccurate personal information.
• The right to opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of.
• The right not to receive discriminatory treatment for exercising these rights.

To exercise any of these rights, email us at brandon@openworklab.com. We will verify your request as needed and respond within the timelines the applicable law sets.

Do Not Track and Global Privacy Control

Our analytics controls treat a Global Privacy Control signal or an enabled browser Do Not Track preference as a denial for both analytics and optional company insights. PostHog does not load or capture new events while that signal is present, and we send a denied analytics consent update to Google. We do not sell personal information or use advertising cookies.

Children

This site is intended for a general, professional audience and is not directed to children. We do not knowingly collect personal data from children under 16 in the EU or under 13 in the United States. If you believe a child has provided us with personal data, contact us and we will delete it.

Security

We use technical and organizational measures appropriate to the limited data we process, including encryption in transit and the security controls provided by our infrastructure provider. No method of transmission or storage is perfectly secure, but keeping collection small is itself a core part of how we protect you.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date at the top of the page. The current version is effective as of September 28, 2026. Material changes will be reflected here, so please check back periodically.

Questions about this policy? Email brandon@openworklab.com.