Privacy Policy

Effective August 26, 2026. Last updated August 26, 2026.

The short version

Change First Studio is a planning workspace for people leading change inside organizations. It holds two different kinds of information: information about you, our customer, and information you write about other people at your organization. The second kind is the one that deserves your attention, and a good part of this policy is about it.

We keep your data in Canada. We do not sell it. We do not use it to train AI models, and neither does the AI provider we send it to. You can export it or delete it at any time.

Who we are

Change First Studio is operated by Ohad Eliyahu, sole proprietor, Edmonton, Alberta, trading as Change First Studio.

• Privacy questions, access requests and complaints: ohad@innovativeedge.ca
• Mailing address: [[MAILING ADDRESS]]
• Person accountable for privacy: Ohad Eliyahu

Alberta's *Personal Information Protection Act* (PIPA) applies to us. For customers and personal information outside Alberta, the federal *Personal Information Protection and Electronic Documents Act* (PIPEDA) applies. Where both could apply, we follow whichever gives the individual more protection.

What we collect

1. Information about you, our customer

• Account. Your email address, your name if you give us one, and either a password (stored as a hash we cannot reverse) or the fact that you chose to sign in with Google. If you sign in with Google we receive your email address and basic profile information from Google, and nothing else from your Google account.
• Billing. Handled by our payment processor. We receive a customer reference, which plan you are on, and whether a payment succeeded. We never see or store your full card number.
• What you tell us. Anything you write in a support message, a scorecard submission, or an email to us.
• How you use the service. Which pages you opened, when you generated or edited a plan, and technical error logs. We use this to keep the service working, to find bugs, and to enforce our usage limits.

There are no advertising trackers, no advertising pixels, and no third-party analytics on the site today. If we add analytics later, we will update this policy before we do, not after.

2. What you write about other people

This is the part that matters most, and it is unusual enough to be worth stating plainly.

Change First Studio is built to hold, among other things:

• The names or role titles of people at your organization.
• Your assessment of how much influence they have over a change, and how much the change affects them.
• Their current stance toward the change, and how that stance has moved over time.
• Notes about conversations you have had with them, which everyone working on that initiative can read unless you mark a note private.
• Notes, decisions and open questions written in an initiative's notebook, which everyone working on that initiative can read.
• Actions assigned to named owners, with due dates and status.

That is personal information about identifiable people who are not our customers and who have not agreed to anything with us. Read "Your responsibilities for information about other people" below before you type a real person's name into it.

3. What must not go in

Do not enter into Change First Studio:

• Any information about a patient, client or service user, including health information. In Alberta, health information about an identifiable individual is governed by the *Health Information Act* and creates custodian obligations that this service is not built to meet. This is a hard limit, not a preference.
• Formal human resources records: performance reviews, discipline, complaints, investigations, medical or accommodation information, or anything forming part of a grievance.
• Government-issued identifiers, financial account numbers, passwords, or access credentials.
• Anything you are contractually or legally barred from putting into a third-party service.

We do not scan your content for these things, so this is a boundary you enforce rather than one we police. If you tell us that information like this has ended up in your workspace, we will help you remove it.

Why we use what we collect

We use personal information only for these purposes:

We do not sell personal information, we do not rent it, and we do not disclose it to anyone for their own marketing.

Consent, and how to take it back

For information about you, we rely on your consent, given when you create an account and when you choose to give us optional information. You can withdraw consent at any time by closing your account, subject to any legal or contractual records we must keep.

For marketing email, we ask for express consent separately and we honour an unsubscribe request within ten business days at no cost to you, as Canada's Anti-Spam Legislation requires. Every marketing email carries our business name, our mailing address, and a working unsubscribe link. Emails the product itself depends on, such as a sign-in code, a password reset, or a receipt, are not marketing and will keep arriving while your account is open.

Your responsibilities for information about other people

When you enter information about a colleague, a manager, a physician or anyone else, you are the one deciding to collect it. We hold and process it on your instructions, as a service provider to you. That split has practical consequences, and they are yours to manage:

1. You confirm you have the authority to enter it. That may come from your role, your organization's own privacy policy, a collective agreement, or the individual's knowledge and agreement. We do not assess this for you. 2. Record only what a reasonable person would consider appropriate. That is the standard Alberta's PIPA applies, and it is a good working test. An assessment of a colleague's influence over a decision is ordinary change management. A note about their personal life is not. 3. Write it as though they may read it, because they may be entitled to. Individuals generally have a right to ask an organization for the personal information it holds about them. 4. If one of those individuals contacts us directly asking to see, correct or delete what is held about them, we will not answer for you. We will confirm we hold information on behalf of a customer, refer them to you, and tell you within five business days so you can respond. Where the law requires us to act ourselves, we will, and we will tell you first. 5. Your organization's own policies still apply. Using this service does not displace them.

If you would rather not hold named individuals at all, the product works with role titles instead of names. That is a legitimate way to use it and, for many teams, the better one.

Where your data lives, and who else touches it

Stored in Canada. Your account, your plans, your registers and your notes are stored in a database hosted in Canada (Canada Central region). Backups stay in the same region.

Some processing happens outside Canada. Being honest about this matters more than sounding reassuring: our web hosting runs on global infrastructure, and generating a plan sends your content to an AI provider whose processing occurs in the United States. Personal information processed outside Canada may be accessible to foreign courts and law enforcement under the laws of that country. If that is unacceptable for your organization, this is the point at which to raise it with us, before you put real names in.

We use these service providers, and only these, to deliver the service:

Each is bound by its own contract with us to protect the information and to use it only to provide their service to us.

What the AI provider does and does not do with your content

The product calls the thing that writes for you the Change Agent. It is an AI model, run by the provider named above, and this section is about that provider. The name is what the buttons say; the sentences below are what actually happens.

When you generate or regenerate part of a plan, the content of your intake and the relevant plan sections are sent to Anthropic's API and the generated result comes back to us. As of the date of this policy, and confirmed against Anthropic's published policies:

• Inputs and outputs are not used to train models without express permission, which we have not given and will not give.
• Anthropic automatically deletes inputs and outputs within 30 days of receiving or generating them.
• Content flagged by Anthropic's automated trust and safety systems as violating their usage policy may be retained for up to two years.

We do not send your stakeholder names, stance notes or engagement notes to the AI provider except where they form part of the content you have asked us to generate or regenerate. Notes written in an initiative's notebook are never sent to it.

How long we keep things

• Your account and your workspace: for as long as your account is open.
• After you delete your account: removed from our live systems within 30 days, and from backups within 90 days.
• After you delete a single initiative: the same 30 and 90 day windows.
• Billing and tax records: kept as long as Canadian tax law requires, currently six years, regardless of account deletion.
• Security and error logs: 90 days.
• Marketing list: until you unsubscribe, plus a suppression record so we do not email you again by mistake.

How we protect it

Encryption in transit and at rest. Row-level access rules in the database so one account cannot read another's data, enforced by the database itself rather than only by application code. Access to production data limited to those who need it. Multi-factor authentication on the administrative accounts that can reach it. We test the access rules automatically on every change we ship.

No system is perfectly secure, and we will not claim otherwise.

If there is a breach

If personal information in our care is lost or accessed without authorization, and there is a real risk of significant harm to an individual, we will notify the affected individuals and the relevant privacy commissioner as the law requires, and we will tell the customer whose workspace was involved. We will tell you what happened, what information was involved, what we have done, and what you should do.

Your rights

You can:

• See the personal information we hold about you.
• Correct it if it is wrong.
• Export your workspace in a usable format.
• Delete your account and its contents.
• Withdraw consent to anything optional.
• Complain, to us first at ohad@innovativeedge.ca, and if you are not satisfied, to the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.

We respond to a request within 30 days, or tell you why we need longer. There is no charge for a reasonable request.

Children

Change First Studio is a workplace product and is not for anyone under 18. We do not knowingly collect information from children.

Changes to this policy

If we change this policy in a way that materially affects you, we will email account holders at least 14 days before it takes effect, and post the change here. Minor corrections will simply be posted with an updated date.

Contact

ohad@innovativeedge.ca [[MAILING ADDRESS]]