Privacy Policy
How WattNext collects, uses, shares and protects personal data — including the voice interviews at the heart of ViVo Pulse.
Review draft: 24 September 2026 · Proposed version 1.3
Please note
This is a proposed replacement page and is not yet in effect. The operating-company details and confidentiality wording have been updated. Remaining operational and legal checks must be resolved before publication.
1. About this policy
This policy explains how WattNext AI Inc collects, uses, shares and protects personal information when you use wattnext.ai, our website voice assistant, the ViVo Pulse interview application and supporting services, and our free assessment tools.
The free tools include the Friction Calculator, Organisational Visibility Assessment, Leadership Archetype, Leadership Effectiveness, Scaling Readiness and Culture Health assessments. Information provided at the point of collection may explain a particular tool or activity in more detail.
If you took part in an interview, start with section 4. If you contacted us, registered for an event or used a free tool, see sections 5 and 6. This policy addresses applicable Canadian privacy requirements, including the Personal Information Protection and Electronic Documents Act (PIPEDA), and the EU General Data Protection Regulation (GDPR) where it applies.
2. Who we are
WattNext is operated by WattNext AI Inc, based in Ontario, Canada. Our address is 49 Kelsey Crescent, Barrie, Ontario, L4N 0J5, Canada. We operate the WattNext platform and the ViVo Pulse organisational diagnostic.
WattNext France is the IP licensing company. This policy concerns the services operated by WattNext AI Inc. IP ownership does not, by itself, mean that the licensing company receives participant information.
Our team works from Canada and France, so authorised team members may access information from those countries. Service providers may process information in other countries, as explained in sections 8 and 9.
For privacy questions, contact support@wattnext.ai.
3. Our two roles
Our responsibilities depend on the activity. When a client commissions interviews, we process interview information to provide that service under the client’s instructions and our agreement. For our own website, enquiries, events and free tools, we determine how information is used for the purposes described in this policy.
Where GDPR applies, these roles are described as processor and controller respectively. Canadian accountability requirements continue to apply where relevant.
| Context | Our role under GDPR | Controller |
|---|---|---|
| Client-commissioned ViVo Pulse interviews | Processor for the commissioned service | The organisation identified in your participant notice, usually your employer |
| Website, enquiries, event registrations and website voice assistant | Controller | WattNext AI Inc |
| Free assessment tools | Controller | WattNext AI Inc |
The participant notice for a commissioned interview should identify the responsible client and explain the purpose of the assessment and the basis for processing. A consultant or adviser may help arrange a project; that does not automatically make them the controller.
We assist clients with privacy requests concerning information processed on their behalf. This does not remove our own obligations under applicable law. Any exceptional disclosure of interview information is subject to section 4.5.
4. If you took part in a voice interview
4.1 What we collect
- Invitation and participation details supplied by the commissioning organisation, which may include your name, email address, job title, role band, tenure and time in role. Contact information you provide during registration, including a telephone number where requested. An audio recording and transcript of your interview. Call metadata, including start and end times, duration, number of sessions, how the call ended and progress through the questions. Scores derived from the transcript against our assessment framework and numerical representations of text, known as vector embeddings, used to retrieve related material.
4.2 Why we process it
We use this information to conduct and transcribe the interview, analyse responses against the ViVo Pulse framework, and produce organisational findings for the client. We also use information to operate and support the service and carry out the safety checks described in section 4.5.
4.3 Participation and the basis for processing
The commissioning organisation is responsible for explaining its purposes and the applicable legal basis or consent arrangements in its participant notice. Where GDPR applies, the client must identify an appropriate lawful basis. We do not assume that the same basis applies to every project.
Where Canadian law requires consent, the applicable collection, use and disclosure must be explained through the relevant participant notice and consent process, unless a legal exception applies. You can end an interview at any time. Ending the interview does not automatically delete information already collected; see section 12 for privacy requests.
4.4 Sensitive information
Our questions concern how your organisation works. We do not ask you to disclose health information, religious beliefs, trade union membership, sexual orientation or other sensitive personal information. Please avoid volunteering these details or unnecessarily identifying other people.
Open-ended answers can nevertheless contain sensitive information. Where this happens, it may be present in the recording and transcript. Its handling must comply with the applicable privacy requirements, the client’s instructions and any lawful safety response. Where GDPR applies, processing special-category information requires an applicable Article 9 condition as well as an Article 6 lawful basis.
If you have disclosed something you are concerned about, contact support@wattnext.ai. We will assess your request and, where necessary, work with the responsible client to restrict or remove information, subject to applicable legal requirements.
4.5 Safety concerns and limits to confidentiality
We use automated checks to identify potential safety concerns in interview transcripts. A flag does not automatically result in information being shared with your employer or the commissioning organisation. We consider concerns individually and take reasonable steps to protect participants’ confidentiality.
Confidentiality is not absolute. Where necessary and permitted or required by applicable law, we may disclose limited information to address a serious risk to a person’s life, health or safety, to comply with a legal obligation or binding legal process, to obtain legal advice, or to establish, exercise or defend legal claims. A concern about reputational harm or commercial embarrassment alone is not a reason to disclose interview information.
For a safety concern, an appropriate response may be to identify a person to someone able to help and say that urgent contact or support is needed, without sharing their words, recording or transcript. An identifying alert is itself a disclosure of personal information. We will seek to use a limited alert where that is sufficient; further details will be shared only where necessary and lawful. This is not a promise that interview content can never be disclosed.
Recipients depend on the circumstances and may include emergency services, a competent authority, a legal adviser, a court or, where appropriate and necessary, a designated person at the commissioning organisation who can help. An employer is not the automatic recipient, particularly where it may be implicated in the concern. We limit disclosure to the information reasonably necessary for the lawful purpose and comply with applicable consent and notification requirements.
ViVo Pulse is an organisational diagnostic, not an emergency, clinical, safeguarding-monitoring or investigative service. Safety checks may miss concerns or flag them incorrectly. We do not guarantee detection, real-time review, contact with a participant or intervention. Do not rely on the service for urgent help. If someone is in immediate danger, contact the appropriate local emergency service.
4.6 What the commissioning organisation receives
The commissioning organisation receives findings about themes and patterns across the organisation, together with scores aggregated by role band. It does not have access through the platform to your individual audio recording or a readable transcript of your interview. Access to those records is restricted to authorised WattNext personnel and service providers that need it to deliver the service.
Safety flags are not routinely shared with your employer or the commissioning organisation. Any exceptional safety or legal disclosure is subject to the limits described in section 4.5.
We take reasonable steps to reduce the risk of identifying participants in routine organisational reporting. Confidential collection and aggregated reporting do not make the underlying records anonymous. Voices, contextual details and findings about small groups can make people identifiable. We cannot guarantee anonymity or eliminate every risk of identification or employment consequences. Please contact us if you have concerns about how your information may be represented.
5. Website visitors and marketing contacts
If you contact us or register for an event, we use the information you provide, such as your name, email address, organisation and message, to respond, administer the event and provide information you request. Event registration may involve sharing your email address with a calendar or event-service provider.
If you choose to use our website voice assistant, we process the information you share to respond to your questions and handle any follow-up you request. Information about recording, transcription and any additional collection should be provided when you start that interaction. A website conversation is separate from a confidential ViVo Pulse interview.
For activities subject to GDPR, responding to enquiries and administering requested events generally serves our legitimate interests in communicating with people who contact us. Where consent is required, including for particular marketing communications or tracking, we obtain it. Under applicable Canadian requirements, we obtain consent where required or rely on an applicable exception.
You can unsubscribe from marketing messages using the link in the message or by contacting us. Essential service communications are separate from promotional messages.
6. Free assessments and the Friction Calculator
We operate the free tools and are responsible for the information collected through them. This may include your answers, business information, assessment results and contact details you choose to provide. Some tools assess leadership or organisational characteristics; results may therefore relate to you as well as your organisation.
The Organisational Visibility Assessment also records your IP address, browser user agent, referring page and campaign parameters. Other technical data depends on the tool and is explained in any notice provided with it.
We use information to calculate and deliver results, respond to requests, maintain the tools and understand their use. Where GDPR applies, our legitimate interests support operating and improving the tools, subject to your rights. We obtain consent for activities that require it, such as non-essential tracking or particular promotional follow-up. A request for an assessment result is not blanket consent to unrelated marketing.
8. Who else processes your information
We use service providers to operate the services. The table describes the providers listed in our service notice and the types of information involved. A provider’s base or international presence does not establish the precise region used by our account; cross-border processing is explained in section 9.
| Provider | Purpose | Information involved |
|---|---|---|
| ElevenLabs | ViVo Pulse voice interviews and transcription | Audio, transcripts and call metadata |
| OpenAI | Transcript analysis and scoring | Transcript text |
| Google Cloud Storage | Audio storage | Audio recordings |
| Firebase Authentication (Google) | Staff and client sign-in | Account email and identity information |
| Render | Application and database hosting | Application information |
| Netlify | Website and application hosting | Request metadata |
| Google Analytics | Website analytics | Page visits, interactions, browser and device data |
| Meta | Advertising measurement and audience building | Page visits, tracked actions, browser and device data |
| Resend | Transactional email | Names, email addresses and service messages |
| Sentry | Error monitoring | Technical diagnostics |
We do not sell personal information. We engage interview-processing providers on terms that do not permit them to use interview content to train their own models, and we do not use interview content to train models of our own.
Where necessary and permitted by law, information may also be shared with professional advisers, competent authorities or other recipients involved in a specific legal or safety matter. The limits in section 4.5 apply to these safety and legal disclosures. A service provider’s responsibilities depend on its actual role; not every recipient acts as our processor for every purpose.
9. International processing and transfers
WattNext AI Inc operates from Canada, with team access from Canada and France. Our providers may process information in the United States and other countries. Information processed abroad may be subject to access by courts, law enforcement or other authorities under the laws of those countries.
For information subject to PIPEDA, we remain accountable for information transferred to service providers for processing and use contractual or other measures to provide a comparable level of protection.
Where GDPR transfer rules apply, transfers outside the European Economic Area require an applicable transfer mechanism. Depending on the recipient and circumstances, this may be a relevant adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses. We do not treat a provider’s location or certification as automatically sufficient for every transfer.
Contact support@wattnext.ai for information about the safeguards applicable to a particular service or transfer, including how to obtain a copy where available. A client’s data-processing agreement may provide additional details.
10. How long we keep information
We retain personal information for the purposes for which it was collected and applicable legal requirements. The service retention periods are set out below. A client agreement or legal obligation may require a different period.
| Information | Retention period or criteria | Starting point |
|---|---|---|
| Interview audio recordings | 12 months | Date of interview |
| Interview transcripts and derived scores | 24 months | Date of interview |
| Visibility Assessment identifying details | 24 months, then anonymised or deleted | Assessment submission |
| Other assessment information | For delivery of results, requested follow-up and any period explained in the tool’s notice | Collection or submission, as applicable |
| Marketing and enquiry contacts | While needed for the enquiry or an ongoing, permitted relationship; inactive information is reviewed for deletion | Last relevant interaction |
| Marketing opt-out records | Limited information needed to respect the opt-out | Date of opt-out |
| Account and client records | Contract duration and applicable legal, accounting or claims-related retention requirements | Contract end for post-contract retention |
A legal preservation requirement or an unresolved complaint or claim may affect deletion. Information used for an individual decision must also be retained as required by applicable law so that access rights can be exercised.
We may retain genuinely anonymised and aggregated information for longer. Removing a name alone does not make information anonymous; information that can reasonably be linked back to a person remains personal information.
11. Security
We use technical and organisational safeguards intended to protect personal information, including encryption in transit and at rest, role-based access and restricted access to interview audio and transcripts. Audio is served through short-lived signed links rather than public URLs. Staff sign-in uses a dedicated identity provider.
Our error monitoring is configured to exclude personal information. No security measure guarantees complete protection. If you believe you have identified a vulnerability or a privacy incident, contact us promptly using the details in section 17.
12. Your privacy rights
Your rights depend on the law that applies and the circumstances of the processing. We may need to verify your identity before responding.
Under applicable Canadian privacy law
- Ask whether we hold personal information about you and request access to it and information about its use and disclosure. Challenge the accuracy or completeness of your information and request appropriate correction. Withdraw consent, subject to applicable legal or contractual restrictions and reasonable notice. We will explain relevant consequences. Raise a concern about our handling of information and challenge our compliance with applicable privacy requirements.
For access requests under PIPEDA, the usual response deadline is 30 days. Where an extension is permitted, we will explain the reason, the new deadline and applicable complaint rights. Access is provided at minimal or no cost, with advance notice of any permitted charge.
Where GDPR applies
- Access and correction
- Request access to your personal data and correction of inaccurate or incomplete data.
- Erasure and restriction
- Request deletion or restriction where the legal conditions are met.
- Portability
- Receive qualifying information in a structured, commonly used, machine-readable format.
- Objection
- Object to processing based on legitimate interests and to direct marketing.
- Consent
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
- Automated decisions
- Exercise applicable rights concerning solely automated decisions with legal or similarly significant effects.
For GDPR requests, the usual response period is one month, subject to permitted extensions. Requests are generally free; legal exceptions may apply.
Send requests to support@wattnext.ai. For a client-commissioned interview, we will help identify the responsible client and assist with the request where we act on its behalf. A request to delete information is assessed under the applicable law; it is not an unconditional right to immediate deletion of every record.
13. Automated processing and AI
ViVo Pulse uses AI to analyse interview transcripts and produce indicator scores that contribute to organisational findings. Scores are aggregated across participants and reviewed by our team before a report is issued. The diagnostic concerns organisational systems, not individual employee performance.
We do not use ViVo Pulse to make decisions about you as an individual solely by automated means that have legal or similarly significant effects. AI analysis can be incomplete or incorrect and requires appropriate human judgement.
Free assessment tools may automatically generate a personal or organisational profile from your answers. These are indicative outputs, not employment decisions made by WattNext. Safety checks are described separately in section 4.5.
14. Children
Our services are intended for adults aged 18 or over. They are not directed at children. If you believe someone under 18 has provided personal information through our services, please contact us so we can assess and address the situation.
15. Complaints
Please contact support@wattnext.ai if you have a privacy concern. We will review it and respond. Contacting us does not remove your right to approach a competent privacy authority.
For matters under PIPEDA, you may contact the Office of the Privacy Commissioner of Canada. Follow the authority’s applicable complaint process.
Where GDPR applies, you may lodge a complaint with a competent EU/EEA supervisory authority, including in the country where you habitually reside or work, or where the alleged infringement occurred. The CNIL is the French supervisory authority. Other applicable privacy laws may provide additional complaint rights.
16. Changes to this policy
We update this policy when our practices or applicable requirements change. The published version will state its effective date. We will provide appropriate notice of material changes and obtain any fresh consent required by law. A policy update does not, by itself, authorise a new use of previously collected information.
17. Contact
WattNext AI Inc
49 Kelsey Crescent
Barrie, Ontario, L4N 0J5
Canada
Email: support@wattnext.ai
Please mark privacy enquiries for the attention of the person responsible for privacy. We will direct your message to the appropriate person.