CCPA/CPRA Governance Policy

This governance policy describes the operational controls KSMmodel.ai applies to meet the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). It supplements — and does not replace — the Privacy Notice. Where the two documents describe the same practice, the Privacy Notice is the consumer-facing notice at collection and this document records how we administer it.

1. Scope and roles

For the KSM™ AI Visibility Assessment, related research communications, and this website, the entity operating KSMmodel.ai acts as a business. Vendors that process personal information on our documented instructions act as service providers or contractors. We do not act as a third party receiving personal information for our own commercial purposes.

2. Categories of personal information

• Identifiers — name, business email, organization, IP address. Collected from you and from your device. Retained per the schedule in Section 8.
• Commercial / professional information — job title, industry, the website URL submitted for assessment, and consultation preferences.
• Internet or network activity — pages viewed, referring source, request logs, and consent records.
• Inferences — diagnostic KSM™ scores and prioritized findings derived from publicly observable signals about the website submitted.

We do not collect Social Security numbers, financial account credentials, precise geolocation, biometric identifiers, health data, or other sensitive personal information as defined by the CPRA, and we do not knowingly collect personal information from consumers under 16.

3. Purposes and business purposes

Personal information is collected and used only for the disclosed purposes: delivering the requested assessment and report, verifying the requester, security and abuse prevention, service improvement, responding to inquiries, and — where you have opted in — research and consulting communications. We do not use or disclose personal information for purposes incompatible with these disclosed purposes without providing a new notice.

4. No sale, no sharing, no cross-context advertising

We do not sell personal information and we do not share personal information for cross-context behavioral advertising, and we have not done so in the preceding 12 months. Consequently there is no "Do Not Sell or Share My Personal Information" transaction to opt out of. If this ever changes, we will update this policy and the Privacy Notice and publish a functioning opt-out mechanism before the change takes effect.

5. Global Privacy Control and consent defaults

Non-essential cookies and analytics are off by default and remain blocked until you enable them. We detect and honor Global Privacy Control (GPC) signals as a valid opt-out preference and as a refusal of non-essential processing. Manage categories at any time with Cookie Settings or read the Cookie Policy.

6. Consumer rights and how we handle requests

• Right to know the categories and specific pieces of personal information collected
• Right to delete personal information, subject to statutory exceptions
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information (none is collected)
• Right to opt out of sale or sharing (no sale or sharing occurs)
• Right to non-discrimination for exercising any right

Submit a request through Privacy Choices or by emailing privacy@ksmmodel.ai. Operating standard: we acknowledge within 10 business days and substantively respond within 45 calendar days, extending once by up to 45 additional days where reasonably necessary and telling you why. Verification is proportionate to the sensitivity of the request; identity evidence is used only to verify and is not retained beyond that purpose. Authorized agents may submit requests with written permission and we may still verify the consumer directly.

7. Service-provider and contractor controls

Every vendor with access to personal information is engaged under a written contract that limits processing to our instructions, prohibits sale or retention for the vendor's own purposes, requires equivalent safeguards and subcontractor flow-down, and requires assistance with consumer rights requests, deletion, and security incidents. Vendors are reviewed before onboarding and on a recurring basis.

8. Retention schedule

• Abandoned or unverified assessment requests: 7–30 days
• Assessment inputs and delivered reports: 12 months, then deleted or de-identified
• Security and abuse logs: 30–90 days unless required for an active investigation
• Consent, opt-out, and suppression records: retained as evidence of compliance
• Privacy request records: only what is required to demonstrate fulfillment

We do not retain personal information longer than reasonably necessary for the disclosed purpose that justified its collection.

9. Data minimization and privacy by design

Forms collect the minimum fields needed to deliver the requested output. We do not request a phone number on the introductory assessment; a phone number is collected only when you choose phone or SMS contact for a consultation. Marketing consent is presented separately and unchecked.

10. Security safeguards

We maintain reasonable administrative, technical, and physical safeguards appropriate to the personal information we handle, including transport encryption, access control on a least-privilege basis, vendor review, and logging. No system is perfectly secure and we do not claim absolute security.

11. Accountability, training, and review

Personnel with access to personal information receive privacy and security guidance appropriate to their role. This policy, the Privacy Notice, the Cookie Policy, the vendor inventory, and the retention schedule are reviewed at least annually and whenever we materially change data flows, and each version is dated.

12. Contact

Privacy questions and California rights requests: privacy@ksmmodel.ai. KSMmodel.ai is the responsible party for this site; written correspondence is currently handled by email. The registered entity name and mailing address will be added following legal review.