SP Optima AI Capability Index™

Privacy notice

How SP Optima collects, uses, and protects the information you submit through the AI Capability Assessment Tool. This notice covers data handling only; the contractual terms of using the assessment (eligibility, intellectual property, disclaimers, liability and governing law) are in the separate Assessment Terms of Use. By submitting, you confirm you have read both and consent to the collection and processing described below.

Who we are

SP Optima Pty Ltd (ABN 39 697 333 850) operates the AI Capability Assessment Tool, a self-assessment platform that produces the SP Optima AI Capability Index™. We are based in Victoria, Australia.

For privacy queries: enquiries@spoptima.com

SP Optima AI Capability Index™, AI Persona, and the underlying capability framework, level criteria and persona descriptions are the intellectual property of SP Optima Pty Ltd. All rights reserved.

What we collect

Required to submit (both tracks)

• Full name (first and family)
• Email address
• Track choice (Quick snapshot or Full assessment)
• Adaptation speed (your self-rating of how you update your AI practice over time)
• Industry (from a fixed list)
• Country of work (from a fixed list)
• Years in workforce (total professional experience, in five-year bands)
• AI tool usage frequency (from a fixed list)
• Human skills self-rating (a five-point scale: Developing, Capable, Confident, Influential, Exceptional). Captures interpersonal capability that the capability matrix does not measure (communication, influence, relationships, conflict navigation). Used as a contextual modifier when matching you to relationship-heavy future roles.
• Your responses to the capability statements (35 statements on the Quick snapshot track, 105 on the Full assessment track, across 7 dimensions and 5 levels)

Additionally required on the Full assessment track

• Career seniority level (from a fixed list)
• Company or organisation name
• Role family (from a fixed list)
• Company size (from a fixed list)

On the Quick snapshot track, the fields listed under Additionally required on the Full assessment track above are not asked and not collected. The Quick snapshot track is designed for personal exploration and we only ask for what's necessary for an individual snapshot.

Automatically captured

• Submission timestamp
• Time taken to complete the assessment (the delta between when the form was loaded and when it was submitted). Used internally to flag rushed submissions for data quality and to understand engagement.
• An organisation tag derived from the company name you entered, or, if left blank, inferred from the domain of your work email
• UTM parameters present in the URL when you loaded the form (utm_source, utm_campaign, utm_medium). These are values we put into our own campaign links to measure which channels drive submissions. We do not capture the full referrer URL, browser headers, or any tracking data from third-party sites.
• Aggregate site analytics via our web analytics service. This includes pageviews, referrer sources, and country-level geography. It is cookieless, contains no personally identifying data, and cannot be linked to your submission or your email address.

Computed automatically from your responses

When you submit, the system computes and stores several derived values alongside your raw responses. These are deterministic outputs of your answers; no external data is added. They include:

• Your overall SP Optima AI Capability Index™ (a score from 1.0 to 5.0)
• A score for each of the seven dimensions (1.0 to 5.0)
• A “capability gap” descriptor reframed from your self-rated adaptation speed
• A persona code and persona name based on your scoring pattern
• Your peak (strongest) dimension and any additional strong dimensions
• Aggregate counts of how many capability statements you ticked at each level
• Your Future Fit Panel projection: primary and secondary future-role match (names), match strength bands (Strong, Emerging, or Developing), match-strength numeric scores, the three driving dimensions for each role, and the likely company size bands. These are illustrative scenario estimates triangulated from Microsoft, McKinsey, WEF, PwC and Gartner research on the AI-era workforce over the next 2-5 years. Not empirically validated forecasts.
• Your cohort percentile at the moment of submission (frozen). This preserves a historical reference for where you stood at submission time, separate from the live cohort comparison shown on your dashboard (which moves as the cohort grows).

Aggregate cohort statistics

SP Optima periodically captures aggregate statistics about the respondent population. These snapshots include total respondent count, the median Index score overall and across each of the seven dimensions, and aggregate distributions of personas, future-role matches, match-strength bands, adaptation speed, and human skills self-ratings. The snapshots contain no personal data, no individual responses, and no identifiers; they are a point-in-time view of the cohort as a whole, used to track how AI capability is evolving across the mid-market over time. The snapshots inform SP Optima research outputs, industry insights, and board reporting.

Recorded when you interact with the dashboard

• The action you took (Share, Download, or Print on your snapshot)
• The timestamp of that action
• Your work email (used to match the event to your submission)
• Your overall capability level and persona code at the moment of the action

We use this only to understand which dashboard outputs people find useful enough to share or save. The event log does not capture what you do with the snapshot once it leaves your browser (who you share it to, where you post it, who sees it after that).

Cookies and local storage

We do not use tracking cookies of any kind. Your in-progress assessment selections are saved in your browser's local storage (so they survive a page refresh) and are never shared with us until you submit. Site analytics use our web analytics service in cookieless mode, which captures anonymous traffic patterns and cannot be linked to any individual. No advertising cookies, no cross-site trackers, no third-party tags.

We do not intentionally collect or store, in the assessment database

• IP addresses, precise geolocation, browser fingerprints, or device identifiers
• Passwords, financial information, identity documents, or health data
• Analytics cookies, advertising cookies, or any third-party tracking technology
• Full referrer URLs (only the UTM parameters you arrive with from our own campaign links, as described above)
• Anything else not listed above

Our hosting and infrastructure providers (see Where your data is stored, below) may process limited technical logs required to deliver and protect the service. These logs are held by those providers under their own privacy policies, and we do not draw on them for the assessment.

The submission endpoint also accepts a hidden anti-spam field (a “honeypot”). This field is invisible to real users; if it arrives populated, the submission is silently discarded and is not written to our records.

How we use it

Your data is used for the following purposes only:

1. Generating your personal Index dashboard at the point of submission
2. Sending you a confirmation link to verify the email address you provided, and, once you click that link, sending you a copy of your SP Optima AI Capability Index™ summary by email
3. Showing you a personal progress timeline if you re-submit later from the same email address
4. Contributing your responses, in de-identified and aggregated form, to global AI capability research
5. Informing SP Optima's research outputs, content, and partner engagements
6. Understanding which dashboard outputs people find useful enough to share or save (via the event log described above)

Email is used to deliver your results and as a personal identifier only. We send a one-time confirmation link to the address you provide. Once you click it, we send your AI Capability Index summary to the same address. We do not use your email address for marketing, newsletters, or other unsolicited messages. If we want to contact you about anything other than your results or a privacy request you have made, we will ask for separate consent.

We do not use your submissions to train AI models. Your responses are stored as structured data in Google's cloud, with our Google Workspace data region set to the European Union, and analysed using standard aggregation methods. We do not pass them to any third-party model provider for training, fine-tuning, or other model-development purposes. Where we use third-party AI tools in our own work, we select providers whose terms preclude training on customer content where reasonably possible.

Who sees your data

• Your individual submission: visible only to SP Optima staff with authorised access to the master submission store.
• Aggregate statistics: may be published in SP Optima research, marketing, or shared with clients. Aggregates are constructed so that no individual is reasonably identifiable.
• We do not sell your data to third parties.
• We do not share your individual response with your employer, your manager, your organisation, or any third party unless you choose to share it, or disclosure is required by law.
• We may disclose your data if required to do so by Australian law, court order, or by a regulator with lawful authority.

Small-cohort protection. We do not publish or share aggregate results for cohorts small enough to make an individual reasonably identifiable. Where a category contains too few submissions to safely report, we suppress, combine, or generalise it. This applies in the dashboard you see, in any external research we publish, and in any client engagement we deliver based on the data.

Where your data is stored

The tool relies on the following third-party processors:

• Google Workspace (including Google Apps Script and the Google data store that holds your submission), on Google's servers. We have set our Google Workspace data region to the European Union, so that data held in covered Google services, including the store that holds your submission, is stored and processed in the EU. Limited technical processing by Google may occur in other regions.
• Our hosting provider, for hosting the application itself and for cookieless aggregate site analytics. It processes your IP address transiently to derive country-level geography and to count unique visitors, but does not store IP addresses or identifiers we can link back to you.
• Google Workspace (Gmail), for sending the confirmation and summary emails associated with your submission. Gmail is a covered Google service under the EU data region setting above. Outbound transactional email transits Google infrastructure. Google does not use the contents of these emails for advertising, and we do not use this address for any non-transactional purpose.
• A customer relationship management (CRM) provider (based in the United Kingdom). The confirmation and summary emails are sent from an SP Optima Google Workspace mailbox that is connected to this CRM. Because of that connection, the email address you provide and the related contact metadata (including the participants and timestamps of those emails) are also recorded as a contact in the CRM. Its access is currently set to metadata only: it does not receive the subject lines or the contents of your confirmation or summary emails, and it does not receive your assessment responses or your Index results. The CRM provider acts as our processor and handles this metadata only on our instructions.

These providers operate under their own privacy policies and security certifications, and process data on our behalf as our agents under data processing agreements. The assessment data you submit is stored in the European Union, as described above. The limited contact metadata recorded in our CRM (your email address and the participants and timestamps of your results emails) is held by that provider in the United Kingdom. This means some of your personal information may be stored or processed outside Australia, including in the United Kingdom, the European Economic Area or the United States. Where any processing takes place outside its region of origin, including transient processing by our hosting provider, we rely on recognised transfer safeguards such as Standard Contractual Clauses or the EU-US Data Privacy Framework and its UK extension.

We take reasonable steps to protect personal information handled by these providers, including using reputable service providers, applying access controls, reviewing the privacy and security documentation they publish, and relying on contractual terms or platform settings where available.

Confirmation tokens are stored alongside your submission in the same Google data store for up to 24 hours and then expire. Expired tokens are swept daily and retained in an audit log for a further 7 days before deletion. Unconfirmed submissions are not promoted to the main records and are discarded when their token expires.

Cookies and local storage

The tool uses your browser's localStorage to remember your in-progress answer selections and chosen assessment track, so they survive a page refresh on the same device. Keys are prefixed with aisc_. The personal details you enter (such as your name, email, organisation and the optional profile fields) are not retained between sessions. They are cleared whenever the form is opened fresh, so they neither linger on the device nor pre-fill for anyone who uses the same browser afterwards. None of this data is transmitted to SP Optima or any third party before you submit, and you can clear all of it at any time via your browser's site-data controls.

We do not use tracking cookies, analytics cookies, or advertising cookies. We use a cookieless web analytics service, which collects no personally identifying data. We do not deploy third-party advertising or marketing trackers on the assessment pages.

When you click the confirmation link in your results email, a one-time token appears briefly in the page URL. The token is consumed on first use and is not stored in your browser. If you click an expired or already-used link, the dashboard will not render and you will be invited to start a new submission.

Transactional email

When you submit the assessment, SP Optima sends two automated emails to the address you provided:

1. A short confirmation email with a single-use link that you click to view your results.
2. A summary email with your SP Optima AI Capability Index™, your persona, and your dimension breakdown, sent automatically after you click the confirmation link.

Both emails are transactional. They are direct responses to your submission, sent only to fulfil your request to receive your results. We do not add you to a mailing list. We do not send marketing email from this address. If you have not submitted, you will not receive these emails. If you do receive an unexpected confirmation email, you can safely ignore it. The link will expire unused after 24 hours and no further messages will be sent.

You may request that any pending confirmation token tied to your email address be deleted before it expires by writing to enquiries@spoptima.com.

How long we keep it

We retain identifiable submissions for 24 months from the date of submission. After that, we either delete the row or de-identify it (removing name, email, and company name). We retain de-identified data for longitudinal research, and aggregate it so that no individual is reasonably identifiable before we publish or share it.

You can request earlier deletion at any time (see Your rights, below).

How we protect it

• We verify that you control the email address you provided before sending you a summary email or displaying the results tied to that address. This prevents another party from triggering emails to your inbox or viewing your results
• Access to the master submission store is restricted to authorised SP Optima staff
• Two-factor authentication is enforced on accounts with data access
• Submissions travel over HTTPS
• The submission and event endpoints are rate-limited (1,000 requests per hour per Sheet) to deter abuse
• A honeypot field filters automated submissions before they reach our records
• We do not store passwords or financial information

No system can guarantee absolute security. While we take reasonable steps to protect your data, you accept that any transmission of information over the internet carries inherent risk.

Data breach notification

If we become aware of an unauthorised access to, or disclosure of, your personal information that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), where applicable.

Your rights

Under the Australian Privacy Principles (where applicable), you have the right to:

1. Ask us what data we hold about you
2. Request correction of inaccurate data
3. Request deletion of your data
4. Request deletion of any pending confirmation token tied to your email address before that token expires
5. Object to specific uses of your data
6. Withdraw consent at any time (subject to records we are required by law to retain)
7. Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your data

To exercise any of these, email enquiries@spoptima.com with the subject line “Privacy request”. To help us locate your record quickly, please include the work email address you used to submit and an approximate date of submission. We aim to respond within 30 days.

For users in the EEA, the UK, and Canada

This notice is written primarily for Australia. If you are in the European Economic Area, the United Kingdom or Canada, the following also applies.

Lawful basis (EEA/UK). We process your data on these bases: to generate and deliver your results, performance of a contract or steps taken at your request; to send your confirmation and summary emails, the same; for de-identified research and benchmarking, our legitimate interest in understanding how AI capability is evolving, balanced against your interests; and where we ask for it separately, your consent. You can withdraw consent at any time without affecting processing already carried out.

Your additional rights (EEA/UK). Alongside the rights listed above, you may request a copy of your data in a portable format, ask us to restrict processing, and object to processing based on legitimate interests. You may lodge a complaint with your local data protection authority as well as, or instead of, the OAIC.

Automated processing. Your Index, persona and Future Fit results are produced by automated processing of your responses (profiling). They are indicative only and are not used to make decisions producing legal or similarly significant effects about you, and should not be used as the sole basis for employment, promotion or similar decisions.

International transfer. Your assessment data is stored and processed within the European Union, and the limited contact metadata in our CRM is held in the United Kingdom, as described in Where your data is stored. Where any processing takes place outside the EEA or UK, we rely on Standard Contractual Clauses or the EU-US Data Privacy Framework and its UK extension.

Canada. We handle your data consistently with PIPEDA, and you may complain to the Office of the Privacy Commissioner of Canada. If you are in Quebec, additional requirements under Law 25 may apply to cross-border transfers; contact us for details.

Children and minors

The tool is intended for adult workplace assessment and is not designed for, marketed to, or intended to be used by people under 18. We do not knowingly collect submissions from minors. If we identify a submission from a person under 18, we will delete it. If you believe a minor has submitted, please contact us at enquiries@spoptima.com.

Changes to this notice

We may update this notice from time to time as the tool evolves or as legal requirements change. The “last updated” date at the bottom reflects the current version. We flag material changes via the SP Optima website. Where a change materially affects how we use personal data and we rely on your consent, we seek fresh consent before that change applies to you.

Complaints

If you believe SP Optima has breached your privacy rights, please email enquiries@spoptima.com in the first instance. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or by calling 1300 363 992.

SP Optima Pty Ltd  ·  ABN 39 697 333 850  ·  enquiries@spoptima.com  ·  Last updated 8 July 2026