Privacy should be understandable before participation.

Who is responsible

ThinkProof is owned and operated by CONNECTNEXA SOLUTIONS L.L.C.. CONNECTNEXA SOLUTIONS L.L.C. operates the service and is responsible for the personal information described in this notice, except where an organization independently determines how and why participant information is used. In that situation, the organization may also be responsible under applicable privacy law.

Information collected

ThinkProof may collect account and contact information, organization details, campaign metadata, participant identifiers, consent records, assessment responses, scoring and review records, reports, support messages, purchase and invoice status, and security or audit events. The payment provider handles card and bank details; ThinkProof does not store full payment-card numbers.

Sources

Information comes from you, the organization that invited you, your interaction with the service, reviewers acting under the ThinkProof process, payment and hosting providers, and security or authentication systems used to operate the service.

Purposes

Information is used to provide the challenge, administer company pilots, authenticate users, create and review profiles, produce permitted reports, process payments, respond to support requests, maintain security and audit records, prevent misuse, comply with law, and improve the service. We do not use participant results for advertising.

AI processing and meaningful human control

Automatic AI scoring is optional and must be explicitly enabled. Eligible scoring requests exclude participant names and email addresses and redact common contact information found in answer text. Low-confidence, incomplete, inconsistent, or flagged results require human review. ThinkProof is not designed to make solely automated decisions that produce legal or similarly significant effects, and current results must not be used for employment, admission, credit, insurance, clinical, legal, or other high-stakes decisions.

Organization access

Company administrators can access only their organization workspace. Private answer text is not displayed in the company dashboard by default. Identifiable profile sharing must follow the notice and consent presented for the applicable pilot. Aggregate reporting should use reasonable group sizes and avoid re-identification.

Service providers and disclosures

We may use providers for hosting, identity, forms, business email, spreadsheets, payment processing, security, support, analytics, and optional AI processing. Providers may process information only for contracted services and legal obligations. We may also disclose information when required by law, to protect rights or safety, in connection with a business transaction, or with your direction or consent.

Cookies and similar technology

The service may use cookies or similar technology that is necessary for authentication, security, session continuity, and core operation. The current service does not sell personal information or use it for cross-context behavioral advertising. If non-essential analytics or advertising technology is introduced, this notice and any required consent controls will be updated first.

Retention

Information is retained only as long as reasonably necessary for the stated pilot, account administration, review, support, security, dispute resolution, and legal, tax, or accounting obligations. A pilot agreement or participant notice may specify a shorter period. Information may be deleted, anonymized, or aggregated when it is no longer needed, subject to applicable obligations.

Security

We use administrative, technical, and organizational safeguards appropriate to the service, including access controls, separation of organization workspaces, data minimization, and review gating. No online system can guarantee absolute security. Report a suspected privacy or security issue promptly without emailing sensitive assessment content.

Your choices and rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or an explanation of processing, and to object or withdraw consent where consent is the basis. We may need to verify your identity and may retain information where law permits or requires. You may also contact the organization that invited you when it controls the applicable pilot.

International processing

Providers may process information in countries other than your own. Where applicable law requires a transfer mechanism or additional safeguards, the responsible party must put them in place before the relevant processing begins.

Children

The public service is intended for adults and is not directed to children under 13. Participants under 18 may be invited only through a separately approved educational pilot with required authorization, notices, and safeguards. Contact us if you believe a child’s information was submitted improperly.

Contact

Privacy questions or rights requests may be sent to support@thinkproof.ai. Do not send assessment answers, government identifiers, health information, or card numbers by email.

Effective: August 16, 2026.