Persona 28 Assessment Privacy Policy

1. Who we are

Persona 28 LLC, an Indiana limited liability company ("Persona 28", "we", "us"), provides leadership-development and organizational assessment experiences.

This Privacy Policy describes how we handle personal information in connection with our assessment and leadership-simulation services, including MicroSim, LeaderSim, and other Persona 28 assessment or simulation products that expressly reference this policy (the "Services").

The Services may be offered individually or administered by an organization for leadership development, talent assessment, succession planning, internal talent decisions, hiring or candidate assessment, or related organizational purposes, subject to the applicable Service's terms and applicable law. The MicroSim Terms of Use remain specific to MicroSim; this shared Privacy Policy does not replace any Service's terms.

2. What this policy covers

This policy covers the Services, their assessment results and reports, and related Persona 28 administration workspaces, accounts, invitations, delivery and support processes. Collection, processing and delivery vary by Service and customer arrangement; a feature or provider described here need not be used by every Service.

MicroSim is a short simulated leadership conversation that produces a Leadership Snapshot. LeaderSim includes a more extended leadership simulation, conversations and written work, with its own evaluation and report format. Other products are covered only when they expressly reference this policy.

It does not cover unrelated Persona 28 products or websites, or the practices of third parties whose sites you reach through links from ours. An organization's independent employment practices, decisions and further use of reports should be explained in that organization's own notices.

This policy describes current practices. If we change what we collect or how we use it, we will update this policy and its version identifier.

3. Information you provide

What we collect depends on how your assessment is arranged:

• Assessment responses and written work. We save your simulation messages,

conversations and, where the Service includes them, written deliverables or drafts you submit or save.

• Your name and email address. For MicroSim's individual offering, these are requested after the simulation

to personalize and deliver your Leadership Snapshot. Other Services or organization-administered offerings may collect contact details beforehand. We store the name you give us, subject to basic formatting and validation. We do not derive your name from your email address.

• Your MicroSim follow-up choice. For MicroSim's individual offering, the

email step also includes a follow-up option, which is selected by default and which you can deselect. We record whether it was left selected in the contact records described under "MicroSim follow-up" in section 7. Your choice does not affect delivery of your Leadership Snapshot.

• Organization-administered assessment details. The organization or its

authorized Persona 28 support representative supplies participant names, email addresses, organization affiliation and any participant reference used to arrange and identify assignments. These details may be supplied before you enter the simulation, rather than collected from you afterward.

• Administrator account details. The administration workspace processes

administrator email addresses, passwords for account authentication, organization memberships and information used to administer assessments. Participant access is separate from administrator access; the applicable Service provides its participant-entry instructions.

• Background and research questionnaire information, where enabled. LeaderSim

may ask about age range, gender, race or ethnicity, country or region, job level and function, industry, work and leadership experience, and assessment language. These questions support research into whom the assessment serves and its performance across groups. Optional questions are identified and may be skipped; "Prefer not to answer" is offered where applicable. Country or region and assessment language are required when this questionnaire is used. These answers are stored separately from the simulation transcript, are not sent to the AI characters or evaluation models, and do not affect the participant's assessment. MicroSim does not currently collect this questionnaire.

Please avoid including unnecessary personal or confidential information in your assessment responses.

4. Information created when you use the Services

Depending on the Service, using it also creates:

• Session records — when your session started, ended, or expired, how far you

got, and which version of the simulation you saw.

• Analysis records — information produced when we analyze your responses, as

described in section 5.

• Assessment reports, including PDF reports and, where participant delivery

is offered, the snapshot shown to you on the web.

• Delivery records — preparation and delivery information for the methods

actually used, including email status where the Service uses email.

• Administration records — assignments, completion status, scoring/evaluation

outputs, report verification, account/invitation events, assessment credits and related support/security records.

• Access records — information used to control and, if needed, revoke access

to your assessment or, where offered, your personal result link.

• Service-protection information, described in section 8.

5. How your responses are analyzed

Persona 28 analyzes your responses using AI systems and its leadership framework to identify behaviors demonstrated in the simulation and produce assessment results and reports. The timing, form and content of that evaluation depend on the Service.

Three things are worth being clear about:

• Short quotations of your own words may appear in assessment reports, presented as

things you said during the simulation.

• We may keep the information generated during this analysis to operate the

service and to evaluate the quality, consistency, reliability, and performance of the Services.

• Analysis records stay associated with your session. For organization-administered

assessments, they can be linked through the administration workspace to you and your organization. Participant-level records are not anonymous or de-identified merely because some systems use internal identifiers instead of names. See section 7.

6. How AI is used

Persona 28 uses AI systems to operate simulated interactions, analyze responses, and help generate assessment feedback and reports, depending on the Service. Simulated colleagues or executives are AI characters, not people on the other side of the conversation. Assessment content, including conversation and written responses, is transmitted to AI service providers for these purposes. AI-assisted analysis contributes to assessment results.

AI-generated analysis has limitations and may not capture every aspect of your behavior or interpret every response the same way a human reviewer would.

Assessment results describe behavior demonstrated in the applicable simulation; the scope and report format vary by Service. A MicroSim Leadership Snapshot, for example, describes one short simulated conversation. Results are not a psychological, clinical, or diagnostic evaluation, a guarantee of future performance, or an automated hiring, promotion, or other employment decision. Persona 28 does not make employment decisions about you through the Services. The applicable Service's terms explain appropriate use.

7. How we use information

We use the information described above to:

• provide the Services and keep your session working;
• analyze your responses and prepare the applicable assessment results or reports;
• personalize and deliver results, including a personal result link, where

the Service and customer arrangement include that delivery;

• administer the customer's requested organizational assessments and make results

and reports available to authorized organization administrators or other authorized customer representatives, subject to the Service and customer arrangement;

• maintain account, assignment, assessment-credit and report-verification records;
• support participants and administrators and handle privacy requests;
• keep the service running and diagnose problems;
• protect the service and our participants from abuse and misuse;
• meet our legal and regulatory obligations.

MicroSim follow-up. When you complete MicroSim's individual offering and provide an email address for your Leadership Snapshot, Persona 28 adds or updates your email address in its contact records, which we maintain with our email service provider, Kit, and records there that you completed the MicroSim and your MicroSim follow-up preference. We do this whether or not you leave the follow-up option selected. If you are already in our contact records, we add only this MicroSim information and do not change your subscription status; if you have previously unsubscribed from Persona 28 email, completing the MicroSim does not resubscribe you.

The email step includes a follow-up option, which is selected by default and which you can deselect. If you leave it selected, Persona 28 may occasionally contact you about your MicroSim experience, your Leadership Snapshot or related Persona 28 services. If you deselect it, we record that preference and do not contact you on the basis of this option. Deselecting it does not affect delivery of your Leadership Snapshot.

Completing the MicroSim does not enroll you in a newsletter, drip campaign, automated email sequence or automated sales email; any follow-up is deliberately initiated by Persona 28. If you leave the follow-up option selected, Persona 28 staff may also manually add your contact details to HubSpot, the customer relationship management (CRM) service we use to manage personal follow-up. Kit and HubSpot are not connected, and no information is synchronized automatically between them. You can ask us to stop follow-up at any time by replying to a follow-up email, using the unsubscribe link in any email we send through Kit, or contacting privacy@persona28.com. This paragraph does not apply to organization-administered assessments.

Internal use. We may use participant responses and information generated from the simulation internally to operate, evaluate, test, validate, secure, research, and improve the Services and related Persona 28 leadership-development and assessment technology.

Those internal purposes include:

• providing and operating the Services;
• quality assurance, including reviewing the quality of the reports we produce;
• troubleshooting, and detecting and diagnosing technical failures;
• evaluating the consistency and reliability of our analysis;
• validation, research, and evaluation work;
• safety and security;
• developing and improving the Services and related Persona 28

leadership-development and assessment technology.

For those purposes, we may review your simulation responses, the results of the analysis, the information supporting an observation, the report prepared for you, and the technical and quality information associated with your session. This work uses participant-level information, including information that identifies you, where that is necessary for the purpose. For organization-administered assessments, that use must also be consistent with applicable law, participant disclosures and the applicable customer agreement. An instruction to administer an assessment is not unlimited permission for unrelated research or product development.

Aggregate and de-identified information. We may also create and use aggregate or de-identified information for research, analysis, validation, evaluating and improving the product, assessing its reliability and performance, and describing how the product performs or is used.

These are two different things. The participant-level records described in sections 3, 4, and 5 are not de-identified simply because aggregate or de-identified information can be derived from them.

What we do not do. We do not sell your personal information. We do not use it for third-party advertising or share it with advertisers. We do not use it for purposes unrelated to those described in this policy.

8. Protecting the Services

The Services process technical and security information to maintain sessions, authenticate access, protect against automated abuse and excessive use, and diagnose failures. Depending on the Service, this includes request and network information, browser information, timestamps, access and authentication events, and operational records. Necessary cookies and related security mechanisms maintain participant or administrator sessions and protect accounts and forms.

We do not use this information for advertising or cross-site tracking. MicroSim and its related administration workspace do not use advertising cookies, tracking pixels, third-party analytics or session-replay tools; MicroSim does not store your raw network address in your participant record. That storage detail does not describe every Service's operational logging.

Service providers also keep operational records, which may include network information, under their applicable service arrangements. See section 9.

These statements describe the MicroSim application. Emails Persona 28 sends through Kit or HubSpot, including follow-up described in section 7, may record whether a message was opened or a link was clicked.

9. Service providers

We use service providers to support hosting, storage, AI processing, security and delivery on our behalf. The providers and processing used depend on the Service and its configuration. We provide the information needed for their functions; these providers do not determine Persona 28's organizational assessment purposes. Their processing is subject to applicable service arrangements and legal requirements.

Authorized staff may deliver account setup or assessment invitation links privately through a one-to-one channel agreed with the organization. The recipient and communication services used for that delivery handle the address, message and complete invitation link. Assessment responses and organization reports are not included in those invitation messages. Organization reports are accessed through the authorized report-delivery process described in section 10.

MicroSim's controlled AI requests do not include structured administrator or participant contact fields. LeaderSim separates the research questionnaire described in section 3 from its AI processing. Information you write in a response may nevertheless identify you or others and is processed with that response. Do not include unnecessary personal, sensitive or confidential information.

10. Security and access to results and reports

We take reasonable measures to protect information in our care.

For MicroSim's individual offering with participant report delivery, access to your Leadership Snapshot is controlled by a personal link that expires and can be revoked. Treat it like a password: anyone who has it can open your snapshot, so please do not forward it.

Your email address is a delivery destination, not a credential. Knowing an email address does not give anyone access to a result.

For organization-administered assessments, the invitation enables entry to your assigned assessment, not access to the organization's workspace or report. Persona 28 may make assessment results or reports available to authorized organization administrators or other authorized representatives of the administering organization, subject to the applicable Service and customer arrangement. Organization-facing reports are accessed through authenticated accounts with the appropriate organization permissions. Report formats and delivery arrangements differ by Service. Participants do not automatically receive the organization's report through their participant access. Contact the inviting organization about its report-distribution arrangements; section 13 addresses applicable privacy rights.

Organizations are responsible for their downstream use and handling of reports, including protecting downloaded copies and limiting further distribution in accordance with applicable law, participant notices and their agreement with Persona 28.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. How long we keep information

We keep information for as long as reasonably necessary for the purposes described in this policy, including providing and improving the assessment service, supporting customer relationships, security and fraud prevention, audit and legitimate business recordkeeping, resolving disputes, and meeting applicable legal and contractual obligations. Retention depends on the type of information, the purpose for which it is held and the requirements that apply to it.

A single fixed retention period does not apply to all Services or categories of information. We review the continuing need to retain information as those purposes and requirements change. Assessment and account records may remain after an assessment ends or access is closed; closing access is not deletion. Requests concerning retention or deletion are handled as described in section 13. Service-provider records, backups and copies received by an organization are also subject to the applicable retention arrangements and obligations.

12. Your choices

• Participation. Individual participation is voluntary. For an organization-administered

assessment, the inviting organization should explain its purpose, whether participation is required for its process, any alternatives or accommodations, and the implications of not participating. You can stop using the simulation; Persona 28 does not determine those organizational arrangements.

• You choose what you write. Please do not include information you would not

want analyzed and stored — including confidential information belonging to your employer or others, or sensitive personal information about yourself or anyone else. The separately identified research questionnaire, where offered, is described in section 3; its optional questions can be left unanswered.

• Contact information and report delivery depend on the offering, as described

in sections 3 and 10. Organization-administered reports go to authorized organization representatives rather than automatically to participants.

• MicroSim personal result links, where offered, expire, and we can revoke one at your

request.

• MicroSim follow-up. You can deselect the follow-up option when you submit your

email address, and you can ask us to stop follow-up later by replying to a follow-up email, using the unsubscribe link in any email we send through Kit, or contacting privacy@persona28.com. You can object at any time to our use of your information for direct marketing.

13. Your privacy rights

Depending on where you live, you may have rights regarding your personal information — such as the right to request access to it, correction of it, or deletion of it.

You may contact us regarding access to, correction of, or deletion of personal information at privacy@persona28.com. Persona 28 handles these requests through that contact channel and will evaluate and respond to them in accordance with applicable law, contractual obligations and legitimate retention requirements. We may need to verify your identity and, for an organization-administered assessment, coordinate with the organization where appropriate.

Certain information may be retained where necessary for security, fraud prevention, audit, legal or contractual obligations, recordkeeping, or other legitimate purposes, to the extent permitted by applicable law. We will explain the action taken and any applicable reason for retaining information or limiting a request as required by law. This does not limit rights that cannot lawfully be limited.

Closing access or cancelling an assessment does not itself delete assessment records or copies already received by an authorized organization. A request may involve several systems or recipients; we do not promise immediate or complete deletion of every record.

14. Who can take part

The Services are intended for adult professionals, not children. MicroSim is intended for working professionals age 18 or older. Eligibility for other Services is described in their applicable terms and participation arrangements. We do not knowingly collect personal information from children. If you believe someone under 18 has given us information, contact us at privacy@persona28.com. We will investigate promptly, take appropriate steps to prevent further participation and handle the information in accordance with applicable law.

15. Service availability

Geographic availability can differ by Service and customer arrangement. This policy is not an offer of every Service in every location. The current MicroSim pilot is offered to participants in the United States.

If we later offer MicroSim in other countries, we will update this policy and any disclosures that apply.

16. Changes to this policy

We may update this policy. When we do, we will change the effective date shown at the top of this page and the version identifier shown at the foot of it. Where a change is material, we will take reasonable steps to bring it to the attention of participants.

17. Contact

For questions about this policy or about how your information is handled, or to make a privacy request, contact Persona 28 LLC at privacy@persona28.com.

For anything else, the general Persona 28 contact page is at https://www.persona28.com/contact.

Version: privacy-v4