We tell clients to ask vendors plainly how their data gets used. It would be strange not to answer that question ourselves. This page describes what actually happens to information you give us, in the same plain terms we'd want from anyone else.
Last updated 15 August 2026 · Effective on publication at impactzone.ai
Impact Zone is an AI strategy consulting practice operated by Chad Thiessen, publishing at impactzone.ai. We help values-driven organizations use AI strategically to focus impact, measure it, and continually adapt and improve.
For the purposes of data protection law, Impact Zone is the controller of the information described here — meaning we decide what is collected and why.
Impact Zone currently operates as an unincorporated sole proprietorship under Chad Thiessen. Incorporation is planned; this section will be updated with the registered legal entity name once that happens.
We do not currently publish a registered business address. The reliable way to reach us about anything on this page, or to make a request under section 12, is [email protected].
This is a business-to-business site. Our clients are decision-makers at organizations with roughly $2M to $100M in revenue or funding, along with B Corps, social ventures and nonprofits. Everything we collect, we collect from adults acting in a professional capacity on behalf of an organization.
We do not run a consumer service, we do not offer user accounts or logins, and we do not knowingly collect information from anyone under 18. See section 15.
We collect only what you type into one of the places below, plus the technical basics any website generates in order to be served to your browser. There is no account system, no profile building, and no hidden collection running in the background.
Your name, email address, organization name, the category you select from the dropdown describing your organization, and whatever you write in the message field. You choose what goes in the message — please don't put anything confidential or sensitive in it before we've spoken.
Our booking calendar is hosted by GoHighLevel. When you book, it collects the details required to schedule and confirm the appointment — typically your name, email address, and the time slot you pick, plus anything you add in an optional notes field.
The quiz is a GoHighLevel survey. It is not live on the site at the time of writing. When it is live, it collects your answers to the quiz questions together with the contact details you provide, so we can send you your result and follow up if you want help.
This is the most data-rich thing on the site, so it gets its own section — see section 4.
If you email us directly, we hold that correspondence and any contact details in it.
Our site is a set of static files with no backend or database of our own. We do not log visits ourselves. The hosting provider that serves these pages generates standard server logs in the ordinary course of delivering a web page — typically IP address, timestamp, requested file and browser user-agent — which we do not use to identify individuals or build profiles.
This site is hosted by DreamHost. Per DreamHost's own published policy, raw HTTP access and error logs are rotated out after a short period (by default, about 7 days) rather than retained long-term.
The $5 DIY AI Implementation Plan is a multi-step worksheet built as a GoHighLevel survey. Two things about it are worth stating plainly, because most privacy policies would bury them.
Your answers are recorded to our CRM progressively, as you enter them. A contact record is created or updated from the first field you fill in. If you start the worksheet and abandon it halfway, we still hold what you entered up to that point, and we may send you a follow-up email about the step you stopped on. There is a notice saying this at the top of the form, before any field, so you can decide before you start rather than after. If you would rather we didn't hold a partial entry, email us and we'll delete it.
Some of this is commercially sensitive to your organization — a named internal bottleneck, a real performance baseline, and candid notes about where a process is breaking down. We treat it that way. It is used to help you and to follow up usefully, and we do not publish it, sell it, or share it with anyone outside the processors listed in section 7.
When you click a "stuck here?" link inside the worksheet, we tag your contact record with the step you got stuck on — for example, that you stalled on defining ownership, or on data readiness. We also tag whether you started the worksheet and whether you completed it. These tags exist for one purpose: so that if we follow up, we can talk about the thing you actually got stuck on rather than sending you a generic message. They are not used for advertising, they are not shared, and they are not sold. You can ask us to remove them.
Some of what our forms ask for is information about your colleagues rather than about you. The workflow-owner field deliberately asks for a role or title rather than a name, but the friction notes are free text, and it's easy to describe what a specific colleague said without meaning to identify them. Those people never filled in our form and may not know they're in it.
Two things follow from that. First, only enter details about other people if you have the authority to share them — and where a role title would do the job, use the role title instead of a name. Second, if you are named in our records because someone else entered your details, you have exactly the same rights as anyone else under section 12, and you can email us to see or remove what we hold.
Where the law under which you are protected requires a legal basis for processing, ours is: performance of a contract with you (delivering a service you purchased), your consent (submitting a form, subscribing to follow-ups), and our legitimate interest in operating and improving a business-to-business consulting practice — balanced against your interests, which is why there is no tracking, no profiling for advertising, and no data sale.
You can withdraw consent or opt out of follow-up messages at any time, by using the unsubscribe link in any message or by emailing us. Withdrawing consent does not affect processing that already happened.
Every form, booking, survey and contact record on this site runs through GoHighLevel. We do not operate our own database. GoHighLevel is our processor: it stores and processes this information on our instructions, and it is the system of record for all contact and lead data described in this policy.
GoHighLevel is operated by HighLevel LLC, headquartered in Dallas, Texas, United States. Their own privacy policy states that they act as a processor for their customers' data and that they may transfer information to affiliates and service providers in other countries. Their terms and privacy policy are published at gohighlevel.com.
Beyond GoHighLevel, information may be handled by our web hosting provider (see section 3) and by ordinary business email. If we engage a contractor who needs access to client records, they are bound by confidentiality obligations before they get it.
We will also disclose information where we are legally required to — for example in response to a valid legal order.
As we connect additional tools to our CRM — for example, wiring a business email inbox or calendar directly into GoHighLevel — those tools may become processors of your information too. We will name them here as they're added, rather than leaving this as a standing blanket permission.
This site currently runs no analytics, no advertising pixels, and no tracking cookies. There is no Google Analytics, no Meta pixel, no LinkedIn tag, no heatmap tool, and no cross-site tracking of any kind in the pages we serve.
Our web fonts are self-hosted — the font files are served from this site rather than from Google Fonts or any other font CDN — so simply loading a page does not hand your IP address to a third party before you've chosen to interact with anything.
Two honest caveats. First, where we embed a GoHighLevel component (the booking calendar, the quiz, the DIY plan form), that embed is served by GoHighLevel and may set its own cookies or browser storage needed to make the form work. That happens inside the embed, on pages where you have chosen to use it. Second, if we add analytics later, we will update this page and say so plainly before or when it goes live — this section is a description of what is true today, not a permanent promise about the future.
We do not sell, rent, or trade personal information. We do not share it with data brokers, advertising networks, or list vendors. We do not use it to build advertising audiences or lookalike audiences. If that ever changed, it would require your explicit opt-in, not a quiet edit to this page.
Checkout is not built yet. The $5, $50, $500 and $5,000 offers are real and priced, but at the time of writing this site does not process payments and we do not hold any card or bank details.
Checkout will run through Stripe, a third-party payment processor that handles card details directly on its own PCI-compliant systems. We receive only the confirmation that a payment succeeded and the associated order and contact information — never your full card number. Stripe's own privacy policy governs how it handles your payment details directly.
We are stating our actual retention approach here rather than saying "as long as necessary," which means nothing. We keep data long-term by default — a record of what worked and what didn't is genuinely useful to how we run the business, and to you if you come back. That default isn't indefinite for everyone regardless of what they want, though:
Outside of financial records, you can always ask us to delete your data earlier than these defaults. We will, unless we are legally required to keep a specific record.
Which data protection law applies to you depends on where you are. Rather than make you work that out, we apply the following as a baseline to everyone who contacts us, wherever you are:
To use any of them, email [email protected]. We aim to respond within 30 days. We may need to confirm you are who you say you are before releasing or deleting a record — that check protects you, not us.
Depending on where you live, you may also have the right to complain to a data protection regulator. As a British Columbia-based practice, our home regulator is the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca) under BC's Personal Information Protection Act; if you're elsewhere, your own local regulator may also have jurisdiction.
Some of this is structural rather than something we had to build. This site is static, with no accounts, no logins, no database of our own and no custom backend — so there is no application of ours holding your data to be broken into. The records live in GoHighLevel, and are protected by the access controls that platform provides and by ours over that account.
Access to those records is limited to Chad Thiessen and to any contractor who genuinely needs it for a piece of work, each bound by confidentiality obligations. Pages and form submissions are served over an encrypted connection.
No system is perfectly secure, and we would rather say that than imply otherwise. If a breach occurred that affected your information, we would notify you and any regulator we are required to notify, without undue delay.
Our CRM provider is based in the United States and, per its own policy, may transfer data to affiliates and service providers in other countries. Because Impact Zone operates from British Columbia, Canada, your information will typically be transferred from Canada to the United States when it reaches GoHighLevel. Canadian privacy law permits this kind of transfer provided we take reasonable steps to ensure comparable protection is maintained; we rely on our processor's own published safeguards for that. If the law that protects you requires a specific transfer mechanism beyond that, we will name it here.
This is a business-to-business service. It is not directed at children, we do not market to them, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted information through one of our forms, email [email protected] and we will delete it.
When we change this page we will update the date at the top. If a change actually matters — adding analytics, adding a payment processor, changing who processes your data, or changing how long we keep it — we will say so clearly rather than relying on a silently updated date, and where the change requires your consent we will ask for it before it takes effect.
This policy and any dispute arising from it are governed by the laws of the Province of British Columbia, Canada, without regard to conflict-of-laws principles. As Impact Zone's registered legal entity is established, this section will be updated to match. Nothing here limits any right you have under the mandatory law of the country you are in.
Questions about this policy, or a request about your data:
Impact Zone · impactzone.ai · British Columbia, Canada
See also our Terms of Service.
Write your data policy before the tool goes live, not after something leaks.
That's advice we give clients, so this page exists before the forms it describes are switched on. If you want the same discipline applied to your own AI rollout, start with a conversation.
Book a Discovery Call