Privacy Notice

This Privacy Notice explains how KSMmodel.ai processes personal information. When you request an assessment, we process the information necessary to provide the service you requested, secure the service, and comply with law. We use your information for marketing only when we have a valid legal basis and, where required, your separate consent.

0. Our official properties

The Knowledge Structuring Model (KSM™) is presented across two official web properties:

• KSMmodel.ai provides framework, methodology, research, content, capabilities, adoption, partnership, and consultation information. Personal information is collected here only when you submit a consultation request or choose to receive marketing communications.
• KSMmodel.app is the official KSM™ assessment application. When you select an assessment call to action on KSMmodel.ai, you continue to KSMmodel.app, where the assessment, scoring, results, recommendations, and reports are provided. Assessment information is processed only as needed to generate and deliver the requested service and for the other purposes described in the privacy notice applicable to that application.

Marketing consent remains separate and optional on both properties, and is never required to receive an assessment. The two properties are operated for the same framework, but we do not claim that they share identical infrastructure, processors, or retention schedules; the actual processors, retention periods, and data flows for each property must be verified and published before production launch.

Cross-property links to the assessment application include only non-personal campaign parameters (source, medium, campaign, and the location of the link). Personal information is never placed in URL parameters or sent to analytics.

1. Who is responsible

KSMmodel.ai is the party responsible for this website and for the referral information described in this notice. For each data flow described below, KSMmodel.ai acts as the controller (GDPR/UK GDPR) and business (CCPA/CPRA) unless stated otherwise. For privacy questions, contact privacy@ksmmodel.ai. KSMmodel.ai is the responsible party for this site; written correspondence is currently handled by email. The registered entity name and mailing address will be added following legal review.

2. Notice at collection

We provide this notice at or before the point of collection. The assessment form displays a service-processing notice directly above its submit button, and optional marketing consent is presented separately and unchecked.

3. Information we collect

• Identifiers and professional information: first name, last name, business email, organization name, country/region, and optional job title and industry.
• Assessment inputs: the public website URL you confirm you are authorized to submit, and publicly observable data collected about that website and related public sources.
• Consent and compliance records: consent status, disclosure version, page URL, UTC timestamp, source, email-verification status, and withdrawal or opt-out status.
• Technical and security data: IP address, device and browser data, and request logs used for security, rate limiting, and abuse prevention.
• Consultation requests: contact channel preference, and a phone number and time zone only if you choose phone or SMS contact.

We do not request a phone number on the introductory assessment form, and we do not knowingly collect special-category data or information from children.

4. Purposes and legal bases

• Deliver the requested assessment — performance of a contract or steps taken at your request (GDPR Art. 6(1)(b)).
• Verify your email and confirm authorization — contract performance and legitimate interests in preventing unauthorized assessment requests (Art. 6(1)(b), (f)).
• Security, abuse prevention, and service integrity — legitimate interests (Art. 6(1)(f)).
• Marketing email about KSM™ research and services — your consent where required (Art. 6(1)(a)); otherwise legitimate interests for business-to-business communication with an opt-out.
• Non-essential analytics and marketing cookies — your consent (Art. 6(1)(a)).
• Legal compliance and record keeping — legal obligation and legitimate interests (Art. 6(1)(c), (f)).

5. Automated assessment logic and limitations

The KSM™ Assessment applies a documented scoring methodology to publicly observable signals about the website you submit. It produces a diagnostic score and prioritized recommendations. It does not make decisions about you as an individual, does not evaluate creditworthiness, employment, insurance, or eligibility, and does not produce legal or similarly significant effects. Scores are limited by the evidence available on the assessment date and do not guarantee AI placement, citation, recommendation, traffic, or revenue. See the methodology and limitations.

6. Service providers and recipients

We disclose personal information only to processors and service providers under contract, limited to the purposes above. Categories currently used:

• Website and application hosting, and content delivery
• Transactional and marketing email delivery
• Assessment analysis and data-enrichment tooling operating on public web data
• Customer relationship management and consent record keeping
• Consent management, privacy-request intake, and aggregate analytics

We execute data-processing agreements with each processor, and CCPA/CPRA service-provider or contractor terms that restrict the use of assessment data to our instructions.

7. Sale and sharing status

We do not sell personal information and we do not share personal information for cross-context behavioral advertising. This has been the case for the preceding 12 months. Because no sale or sharing occurs, no opt-out of sale or sharing is required; if that ever changes, we will update this notice and publish a working opt-out control before the change takes effect. We honor Global Privacy Control signals as a refusal of non-essential processing.

8. Retention

• Abandoned or unverified assessment requests: 7–30 days
• Assessment inputs and delivered reports: 12 months, then deleted or de-identified unless you maintain an account or request continued service
• Security and abuse logs: 30–90 days unless required for an active investigation
• Marketing consent and suppression evidence: retained as necessary to demonstrate consent or honor opt-out obligations
• Privacy request records: only what is required to demonstrate fulfillment and compliance

9. International transfers

Personal information may be processed in the United States and other countries where our processors operate. Where required, transfers rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another valid mechanism, together with technical and organizational safeguards. You may request further information about the safeguards that apply.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to processing, to withdraw consent, and not to be discriminated against for exercising a right. Withdrawing consent is as easy as granting it. Submit a request from Privacy Choices or by emailing privacy@ksmmodel.ai. We verify requests proportionately and do not retain identity documents longer than needed to verify. You may also lodge a complaint with your supervisory authority.

11. Cookies

Non-essential cookies stay blocked until you allow them where consent is required. Manage categories at any time using Cookie Settings or read the Cookie Policy.

12. Email practices

Verification and report-delivery messages are transactional and are sent even if you decline marketing. Commercial email identifies the sender accurately, includes a valid physical postal address, and provides one-step unsubscribe. Opt-outs are processed immediately and in no case later than 10 business days, remain available for at least 30 days after a message is sent, and are maintained on a durable suppression list shared with our sending vendors.

13. Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect the information we collect, including transport encryption, least-privilege access control, vendor review, and logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Children's privacy

The service is intended for business use and is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us so we can delete it.

15. California residents

California residents have rights to know, delete, correct, limit the use of sensitive personal information, and opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising. Our operational controls, request-handling standards, and retention schedule are documented in the CCPA/CPRA Governance Policy.

16. EEA, UK, and Swiss residents (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information as controller under the GDPR and UK GDPR. Our legal bases are contract performance for assessments and reports you request (Art. 6(1)(b)), legitimate interests for security, fraud prevention, and service improvement (Art. 6(1)(f)), consent for non-essential cookies and marketing email (Art. 6(1)(a)), and legal obligation where applicable (Art. 6(1)(c)). We do not use special-category data and do not make solely automated decisions with legal or similarly significant effects; assessment scoring is advisory and reviewed by a person before any recommendation is issued.

You may request access, rectification, erasure, restriction, and portability, object to processing based on legitimate interests, and withdraw consent at any time without affecting the lawfulness of prior processing. Requests are answered within one month, with an extension of up to two further months for complex requests, and are free unless manifestly excessive. Submit a request from Privacy Choices or email privacy@ksmmodel.ai. Transfers outside the EEA or UK rely on the Standard Contractual Clauses or the UK International Data Transfer Addendum as described in section 9. You may lodge a complaint with your national data protection authority or, in the UK, the Information Commissioner's Office.

17. Changes

We version this notice and record which version applied when consent was collected. Material changes will be posted here with an updated date.

18. Contact

Questions about this notice or to exercise a privacy right: privacy@ksmmodel.ai. KSMmodel.ai is the responsible party for this site; written correspondence is currently handled by email. The registered entity name and mailing address will be added following legal review.