SP Optima AI Capability Index™
How SP Optima collects, uses, and protects the information you submit through the AI Capability Assessment Tool. This notice covers data handling only; the contractual terms of using the assessment (eligibility, intellectual property, disclaimers, liability and governing law) are in the separate Assessment Terms of Use. By submitting, you confirm you have read both and consent to the collection and processing described below.
SP Optima Pty Ltd (ABN 39 697 333 850) operates the AI Capability Assessment Tool, a self-assessment platform that produces the SP Optima AI Capability Index™. We are based in Victoria, Australia.
For privacy queries: enquiries@spoptima.com
SP Optima AI Capability Index™, AI Persona, and the underlying capability framework, level criteria and persona descriptions are the intellectual property of SP Optima Pty Ltd. All rights reserved.
Required to submit (both tracks)
Additionally required on the Full assessment track
On the Quick snapshot track, the fields listed under Additionally required on the Full assessment track above are not asked and not collected. The Quick snapshot track is designed for personal exploration and we only ask for what's necessary for an individual snapshot.
Automatically captured
utm_source, utm_campaign, utm_medium). These are values we put into our own campaign links to measure which channels drive submissions. We do not capture the full referrer URL, browser headers, or any tracking data from third-party sites.Computed automatically from your responses
When you submit, the system computes and stores several derived values alongside your raw responses. These are deterministic outputs of your answers; no external data is added. They include:
Aggregate cohort statistics
SP Optima periodically captures aggregate statistics about the respondent population. These snapshots include total respondent count, the median Index score overall and across each of the seven dimensions, and aggregate distributions of personas, future-role matches, match-strength bands, adaptation speed, and human skills self-ratings. The snapshots contain no personal data, no individual responses, and no identifiers; they are a point-in-time view of the cohort as a whole, used to track how AI capability is evolving across the mid-market over time. The snapshots inform SP Optima research outputs, industry insights, and board reporting.
Recorded when you interact with the dashboard
We use this only to understand which dashboard outputs people find useful enough to share or save. The event log does not capture what you do with the snapshot once it leaves your browser (who you share it to, where you post it, who sees it after that).
Cookies and local storage
We do not use tracking cookies of any kind. Your in-progress assessment selections are saved in your browser's local storage (so they survive a page refresh) and are never shared with us until you submit. Site analytics use our web analytics service in cookieless mode, which captures anonymous traffic patterns and cannot be linked to any individual. No advertising cookies, no cross-site trackers, no third-party tags.
We do not intentionally collect or store, in the assessment database
Our hosting and infrastructure providers (see Where your data is stored, below) may process limited technical logs required to deliver and protect the service. These logs are held by those providers under their own privacy policies, and we do not draw on them for the assessment.
The submission endpoint also accepts a hidden anti-spam field (a “honeypot”). This field is invisible to real users; if it arrives populated, the submission is silently discarded and is not written to our records.
If you open Optima, the AI coach available from your results, what you type is sent to Google’s Vertex AI to generate a reply. Your conversation is not stored by us. It is held in your browser for as long as the page is open. We keep no transcript, and we cannot read your conversation. To speed up replies, Google may keep a temporary, encrypted copy of each request, which includes the conversation so far, for up to 24 hours before deleting it automatically. That copy carries no name, email address or organisation.
Your conversation is not used to train AI models. Google is contractually restricted from using customer data to train or fine-tune its models without our instruction, and we give no such instruction.
Optima receives a summary of your assessment results so it can talk about them: your dimension scores, your overall Index, your persona name and your adaptation speed. It does not receive your name, your email address, or your organisation. That removal happens before the request leaves our systems, and it works by allowing a fixed list of fields through rather than by trying to strip identifying ones out.
We do keep a small usage record for each coaching session, so we can tell whether the feature works and what it costs to run. That record contains counts and timings only: how many turns, how long replies took, how many words were processed, and the star rating you give if you choose to give one. It carries no email address, no name and no message text, and the session identifier in it is random and generated in your browser, so the record cannot be connected back to you or to your submission.
If you ask Optima to email you a coaching plan, that plan is generated from your conversation and sent to the address on your confirmed submission. A copy of that email is kept in the SP Optima mailbox it is sent from and in our CRM, as described in Where your data is stored.
Your data is used for the following purposes only:
Email is used to deliver your results and as a personal identifier only. We send a confirmation link to the address you provide. Once you click it, we send your AI Capability Index summary to the same address, and that same link becomes the way you return to your results. It is not single use: it keeps working for as long as your results exist, so treat it as private and do not forward it. Anyone who has the link can see your results without signing in. We do not use your email address for marketing, newsletters, or other unsolicited messages. If we want to contact you about anything other than your results or a privacy request you have made, we will ask for separate consent.
We do not use your submissions to train AI models. Your responses are stored as structured data in Google's cloud, with our Google Workspace data region set to the European Union, and analysed using standard aggregation methods. We do not pass them to any third-party model provider for training, fine-tuning, or other model-development purposes. Where we use third-party AI tools in our own work, we select providers whose terms preclude training on customer content where reasonably possible.
Small groups in research and client work. In any research we publish or client work we deliver, we suppress, combine or generalise any group small enough to make someone reasonably identifiable.
Small groups on your dashboard. Your dashboard compares you with people who gave the same answers, so a group can be as small as two people, you included. If you’re the only one so far, it compares you with a wider group instead. We never show names, email addresses, organisations or how many people are in a group, but in a group of two, someone who knows who the other person is could work out their scores. The country chart lists every country, so a country with only one respondent shows that person’s Index.
The tool relies on the following third-party processors:
These providers operate under their own privacy policies and security certifications, and process data on our behalf as our agents under data processing agreements. Your submission is stored in the European Union, as described above. The copies of the emails we send you, which include your results, and your contact record are held by our CRM provider. It and the services it relies on process them in the United Kingdom, the European Economic Area and the United States. This means some of your personal information is stored or processed outside Australia. Where any processing takes place outside its region of origin, including transient processing by our hosting provider, we rely on recognised transfer safeguards such as Standard Contractual Clauses or the EU-US Data Privacy Framework and its UK extension.
We take reasonable steps to protect personal information handled by these providers, including using reputable service providers, applying access controls, reviewing the privacy and security documentation they publish, and relying on contractual terms or platform settings where available.
Confirmation tokens are stored alongside your submission in the same Google data store. A token you never click expires after 24 hours. Expired tokens are swept daily and retained in an audit log for a further 7 days before deletion. Unconfirmed submissions are not promoted to the main records and are discarded when their token expires.
A token you have clicked works differently, and this is the part worth knowing. It is kept for as long as your results are kept, so that the link in your email continues to open your results whenever you return to it. It does not expire after 24 hours and it is not retired after one use. If you want it retired sooner, ask us to delete your submission using the contact details below, which removes the results and the link together.
The tool uses your browser's localStorage to remember
your in-progress answer selections and chosen assessment track, so they
survive a page refresh on the same device. Keys are prefixed with
aisc_. The personal details you enter (such as your name,
email, organisation and the optional profile fields) are
not retained between sessions. They are cleared whenever
the form is opened fresh, so they neither linger on the device nor
pre-fill for anyone who uses the same browser afterwards. None of this
data is transmitted to SP Optima or any third party before you submit,
and you can clear all of it at any time via your browser's site-data
controls.
We do not use tracking cookies, analytics cookies, or advertising cookies. We use a cookieless web analytics service, which collects no personally identifying data. We do not deploy third-party advertising or marketing trackers on the assessment pages.
When you click the confirmation link in your results email, a token appears briefly in the page URL. It is removed from the address bar once your results load and it is not stored in your browser. The token itself stays valid, so clicking the same link again reopens your results rather than being refused. If you click a link that was never confirmed and has since expired, the dashboard will not render and you will be invited to start a new submission.
When you submit the assessment, SP Optima sends two automated emails to the address you provided:
Both emails are transactional. They are direct responses to your submission, sent only to fulfil your request to receive your results. We do not add you to a mailing list. We do not send marketing email from this address. If you have not submitted, you will not receive these emails. If you do receive an unexpected confirmation email, you can safely ignore it. The link will expire unused after 24 hours and no further messages will be sent.
You may request that any pending confirmation token tied to your email address be deleted before it expires by writing to enquiries@spoptima.com.
We retain identifiable submissions for 24 months from the date of submission. After that, we either delete the row or de-identify it (removing name, email, and company name). We retain de-identified data for longitudinal research, and aggregate it so that no individual is reasonably identifiable before we publish or share it.
You can request earlier deletion at any time (see Your rights, below).
Copies of the emails we send you are kept in our sending mailbox and our CRM until you ask us to delete them or we disconnect that mailbox from the CRM. If you ask us to delete your data, we delete your contact record and the copies in our mailbox, and block your address in our CRM so we can no longer access its copies. Where full deletion of those copies needs action by the CRM provider, we ask the provider to delete them on your behalf.
We do not keep coaching conversations. They exist in your browser while the page is open, and the only other copy is the temporary, encrypted one Google may hold for up to 24 hours to speed up replies, which is then deleted automatically. There is nothing for us to delete on request. A coaching plan you ask us to email is kept as described above. The usage record described above is kept indefinitely, because it holds only counts, timings and a random session identifier, and cannot be connected to you or to your submission.
No system can guarantee absolute security. While we take reasonable steps to protect your data, you accept that any transmission of information over the internet carries inherent risk.
If we become aware of an unauthorised access to, or disclosure of, your personal information that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), where applicable.
Under the Australian Privacy Principles (where applicable), you have the right to:
To exercise any of these, email enquiries@spoptima.com with the subject line “Privacy request”. To help us locate your record quickly, please include the work email address you used to submit and an approximate date of submission. We aim to respond within 30 days.
This notice is written primarily for Australia. If you are in the European Economic Area, the United Kingdom or Canada, the following also applies.
Lawful basis (EEA/UK). We process your data on these bases: to generate and deliver your results, performance of a contract or steps taken at your request; to send your confirmation and summary emails, the same; for de-identified research and benchmarking, our legitimate interest in understanding how AI capability is evolving, balanced against your interests; and where we ask for it separately, your consent. You can withdraw consent at any time without affecting processing already carried out.
Your additional rights (EEA/UK). Alongside the rights listed above, you may request a copy of your data in a portable format, ask us to restrict processing, and object to processing based on legitimate interests. You may lodge a complaint with your local data protection authority as well as, or instead of, the OAIC.
Automated processing. Your Index, persona and Future Fit results are produced by automated processing of your responses (profiling). They are indicative only and are not used to make decisions producing legal or similarly significant effects about you, and should not be used as the sole basis for employment, promotion or similar decisions.
International transfer. Your submission is stored and processed within the European Union. Copies of the emails we send you, and your contact record, are held by our CRM provider and processed in the United Kingdom, the European Economic Area and the United States, as described in Where your data is stored. Where any processing takes place outside the EEA or UK, we rely on Standard Contractual Clauses or the EU-US Data Privacy Framework and its UK extension.
Canada. We handle your data consistently with PIPEDA, and you may complain to the Office of the Privacy Commissioner of Canada. If you are in Quebec, additional requirements under Law 25 may apply to cross-border transfers; contact us for details.
The tool is intended for adult workplace assessment and is not designed for, marketed to, or intended to be used by people under 18. We do not knowingly collect submissions from minors. If we identify a submission from a person under 18, we will delete it. If you believe a minor has submitted, please contact us at enquiries@spoptima.com.
We may update this notice from time to time as the tool evolves or as legal requirements change. The “last updated” date at the bottom reflects the current version. We flag material changes via the SP Optima website. Where a change materially affects how we use personal data and we rely on your consent, we seek fresh consent before that change applies to you.
If you believe SP Optima has breached your privacy rights, please email enquiries@spoptima.com in the first instance. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or by calling 1300 363 992.