ClientHub Privacy Policy
Version: 2.0 | Effective date: 2026-07-10
Profit Shapers ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal and business information when you use ClientHub and the connected applications launched from it — including PlaybookPro, Engage, TheFORGE, Scoreboards, Rock Manager, BizVal, Scout, Sessions, Seat Optimizer, and any future or successor applications made available through ClientHub (collectively, the "Service"). It applies to information about authenticated users of the Service and to information about organizations and people whose information is submitted into the Service by an organization that uses ClientHub. This version (2.0) introduces expanded language describing how aggregated and de-identified business data may be used to produce industry insights, how identified business profiles may — only with separate, explicit opt-in by an authorized signer of the organization — be made available to qualified third parties through the optional ProfitShapers Marketplace program, and how the platform's AI features (including the TerraSage AI assistant) process organization data. The AI features, the categories of data they send to our AI provider, the full list of sub-processors, and our related data-processing commitments are described in the accompanying ClientHub AI & Data-Processing Disclosure, which supplements this Policy.
1. Scope & Roles
ClientHub is provided to organizations (each, a "Customer") whose administrators invite users — coaches, advisors, leaders, and team members — into the platform. From ClientHub, users may launch the connected applications listed in the introduction (the "Connected Applications"). This Privacy Policy applies uniformly to ClientHub and to each Connected Application as part of the Service.
Identity & single sign-on. ClientHub is the identity hub for the Connected Applications. When you launch a Connected Application from ClientHub, ClientHub passes identity, role, organization, plan, entitlement, and basic profile information (such as your name, email, avatar, organization, and the list of applications you may use) to that application so it can recognize you and scope your access. The Connected Applications process personal information under the same Privacy Policy and the same controller/processor relationships described below.
When we host data on behalf of a Customer (for example, assessment responses, member profiles, KPIs, rocks, playbooks, valuations, financials, or session notes — whether stored in ClientHub or in a Connected Application), the Customer is the controller of that data and Profit Shapers acts as a processor or service provider, handling the data in accordance with the Customer's instructions and our agreement with the Customer.
When we collect information directly from you for our own account, billing, security, or product-improvement purposes, Profit Shapers is the controller of that information. When we use aggregated and de-identified business data to produce industry insights, benchmarks, and Marketplace listings (as described in Section 4), Profit Shapers is the controller of that derivative data.
2. Information We Collect
Account information. Name, email address, username, role, organization affiliation, phone, mailing address, profile photo, password (stored as a salted hash), and authentication settings such as two-factor enrollment.
Organization & engagement information. Organization profile, industry, headcount, team and seat structure, financials your organization chooses to record (including revenue, EBITDA, margins, and growth trends), planning data, strategic priorities, and any other content your organization configures in the Service.
Assessment & valuation information. Assessment definitions, assignments, responses, ratings, narrative answers, scores, reports, enterprise-value calculations, valuation drivers, strengths and weaknesses summaries, leadership scorecards, and talent classifications.
Communications. Messages you send through in-app help, support requests, email correspondence with us, and notifications you elect to receive.
Usage information. Pages viewed, features used, actions taken, timestamps, referrers, and similar telemetry that helps us operate, secure, and improve the Service.
Device & log information. IP address, browser type, operating system, device identifiers, language preference, and standard server log data.
Cookies & similar technologies. Session cookies for authentication, preference cookies (for example, light/dark theme), and limited analytics or performance cookies.
Payment information. If your organization pays for the Service, our payment processor collects payment-method information directly. We receive limited transaction metadata (such as the last four digits of a card and billing status) but do not store full card numbers.
3. How We Use Information
Provide and operate the Service, including authentication, multi-organization access controls, dashboards, assessments, reporting, and notifications.
Personalize the experience, such as remembering your active organization, preferences, and recently used features.
Communicate with you about the Service, including transactional messages, security alerts, billing notices, support responses, and — where you have opted in — newsletters or product updates.
Secure the Service, detect and prevent fraud, abuse, and unauthorized access, and enforce our Terms.
Improve the Service through analytics, debugging, A/B testing, and product research.
Comply with legal obligations, respond to lawful requests from public authorities, and protect the rights, property, and safety of Profit Shapers, our Customers, and the public.
4. Aggregated Business Data, Industry Insights & the Optional Marketplace Program
A central goal of the Profit Shapers ecosystem is to help organizations benchmark themselves and, for those who choose to participate, to connect them with qualified parties interested in growth capital, partnership, or acquisition. This section describes how data submitted into the Service may be used in that broader context.
Aggregated and de-identified data. We may compile, analyze, model, and benchmark Customer Data — including financial figures, valuation inputs, assessment results, leadership scoring, and operational data — to produce aggregated and de-identified industry insights (for example, "the typical EBITDA margin for $5M–$10M professional services firms in the South-Central United States"). This derivative data is stripped of identifiers that could reasonably be used to re-identify your organization, and Profit Shapers may use, publish, license, and retain such aggregated and de-identified data without further notice to your organization. We do not re-identify aggregated data, and we contractually require the same of any party with whom we share it.
Identifiable business profiles. We do not disclose your organization's identifiable business profile, financials, valuation summary, leadership scorecards, or contact information to any third party for marketing, matchmaking, acquisition, or investment purposes unless an authorized signer of your organization (typically the CEO, Owner, or designated executive seat) has separately and affirmatively enrolled the organization in the optional ProfitShapers Marketplace program and accepted the ProfitShapers Marketplace Listing Agreement that governs that program.
What the Marketplace program does. With your organization's separate opt-in, ProfitShapers may include your organization in a curated directory made available to qualified third parties — including private-equity sponsors, family offices, strategic acquirers, growth-capital providers, and licensed M&A intermediaries — who have been screened by ProfitShapers and who are bound by written non-disclosure obligations before viewing any organization-level information. Your organization controls the level of disclosure it permits (for example, anonymized profile only, anonymized profile plus financial summary, or fully identified profile with contact information).
Withdrawal. The authorized signer may withdraw the organization from the Marketplace program at any time. Upon withdrawal, ProfitShapers will remove the organization's identifiable profile from the active Marketplace directory within thirty (30) days. Aggregated and de-identified insights derived from the organization's data prior to withdrawal may be retained.
What we will not do. We will not sell your personal information. We will not share your organization's identifiable business data with any third party for advertising or for any purpose outside of (a) operating the Service, (b) sub-processors helping us deliver the Service, (c) the optional Marketplace program described above (only with separate opt-in), (d) legal and safety disclosures, or (e) a corporate transaction involving Profit Shapers itself. We do not engage in cross-context behavioral advertising.
5. AI Features & Your Information
Some features of the Service use artificial intelligence and large language models ("AI Features"). These currently include the TerraSage AI assistant (an advisory assistant with selectable personas), an AI financial-report generator, an in-app Help assistant, and Daily Focus work suggestions.
Data sent to the AI provider. When you use AI Features, prompts and supporting context are sent to a third-party AI provider (currently OpenAI), routed through our hosting platform's AI-integration gateway, so the provider can return a response that is then shown to you within the Service. Depending on the feature, the context may include your organization's profile (name, plan, industry, headcount), team composition (counts by role), recorded financial figures and general-ledger line items, assessment activity counts, your prompts, and the prior messages in the same conversation. For TerraSage, the financial data included is filtered to the categories the requesting user is permitted to see. Passwords, full payment-card numbers, and multi-factor-authentication secrets are never sent to the AI provider, and the substantive content of talent assessments is stored in the platform but is not included in the TerraSage context.
Storage and retention of AI conversations. TerraSage conversations and their messages are stored in the Service so you can revisit them; you may delete a conversation, which removes it from the active system. Records of AI usage (such as token counts) are retained for billing, audit, and usage-reporting purposes.
Metered billing. TerraSage AI usage is metered by counting input and output tokens, and where your organization has AI billing enabled, accumulated usage is invoiced through our payment processor. See the AI & Data-Processing Disclosure for details.
We configure third-party AI providers, where the option is available, so that your prompts and content are not used to train their general-purpose foundation models.
We do not sell your personal information, and we do not use your personal information to train our own AI models without separate, explicit consent.
Please do not submit information into AI Features that you are not authorized to share — including sensitive personal data, protected health information, payment card data, government-issued identifiers, or trade secrets of third parties — unless your organization has confirmed that doing so is permitted.
AI-generated content can be inaccurate or incomplete. You are responsible for reviewing AI outputs before relying on or sharing them. The AI features and the sub-processors involved are described more fully in the accompanying ClientHub AI & Data-Processing Disclosure.
6. How We Share Information
Within your organization. Information you submit into the Service is visible to other authorized users of your organization based on their roles and permissions.
Across the Connected Applications. Information you create in ClientHub or in any Connected Application — for example, your profile, organization membership, KPIs, rocks, playbooks, assessments, valuations, and session notes — may be made available to other Connected Applications belonging to the same organization so the products work together as one platform. Cross-application access is governed by the same role and permission model used elsewhere in the Service.
Across organizations. ClientHub and the Connected Applications host multiple organizations on shared infrastructure. We use access controls so that members of one organization cannot view another organization's data, except for users who have been explicitly granted cross-organization roles (for example, advisor or Profit Shapers staff with super-admin access for support).
Sub-processors. We share information with vetted third-party providers who help us operate the Service. These currently include OpenAI (AI model inference), Replit (application hosting, file/object storage, and the AI-integration gateway), Neon (managed PostgreSQL database hosting), Stripe (payment processing and metered AI billing), Twilio (SMS delivery for two-factor authentication), Resend (transactional email delivery), and Amazon Web Services (encrypted off-site backup mirror). These providers are bound by contract to use the information only to deliver services to us and to protect it. A current, detailed sub-processor list — with each provider's purpose, the categories of data involved, and its processing location — is maintained in the accompanying ClientHub AI & Data-Processing Disclosure.
Aggregated industry insights. As described in Section 4, we may share aggregated and de-identified data with third parties for benchmarking, research, and Marketplace insights without further notice.
Optional Marketplace program. As described in Section 4, identifiable business profiles are shared with qualified third parties only when your organization's authorized signer has separately enrolled in the Marketplace program and only at the disclosure level the organization has selected.
Legal & safety. We may disclose information when required by law, subpoena, or other legal process, or when we believe disclosure is necessary to protect rights, property, or safety.
Business transfers. If Profit Shapers is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality protections.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
7. Data Retention
We retain Customer Data for as long as the Customer's account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.
When a Customer deletes content within the Service, the content is removed from active systems but may persist temporarily in encrypted backups before being overwritten in the ordinary course of business.
When a Customer ends its relationship with Profit Shapers, we delete or de-identify Customer Data within a commercially reasonable period, except where retention is required by law.
If your organization has participated in the Marketplace program, withdrawal will remove the organization's identifiable profile from the active Marketplace directory within thirty (30) days. Aggregated and de-identified insights produced before withdrawal may be retained on an anonymized basis.
8. Security
We use technical and organizational safeguards designed to protect personal and business information, including encryption in transit, encrypted password storage, role-based access controls, scheduled backups, and routine monitoring. Marketplace directory access by qualified third parties is gated, logged, and bound by written non-disclosure obligations.
No system is perfectly secure. You are responsible for keeping your account credentials confidential and for promptly notifying us of any suspected unauthorized access to your account.
9. Your Choices & Rights
Access & update. You can review and update most of your account information from within the Service. For information your organization manages on your behalf, please contact your organization administrator.
Notifications. You can adjust which non-essential emails you receive (for example, weekly digests) in your profile settings. We will continue to send transactional and security messages necessary to operate the Service.
Cookies. You can configure your browser to refuse some cookies, but doing so may impact the Service.
Marketplace participation. The authorized signer of your organization may enroll the organization in the optional Marketplace program at any time, choose the level of disclosure permitted, view a log of qualified third parties who have viewed the organization's profile, and withdraw the organization from the program at any time.
Privacy rights. Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, or to object to certain processing. To exercise these rights, contact us using the information below or, if your information is held on behalf of a Customer, contact your organization administrator.
We will not discriminate against you or your organization for exercising your privacy rights or for declining (or withdrawing from) the Marketplace program.
10. International Transfers
We are based in the United States, and our service providers may process information in the United States and in other countries. By using the Service, you understand that your information may be transferred to and processed in jurisdictions whose data-protection laws may differ from those in your country.
11. Children's Privacy
The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice (for example, by email or through the Service) before they take effect. Your continued use of the Service after the effective date of an updated policy constitutes acceptance of the changes. Material changes that broaden how identifiable Customer Data is used or shared will, where required by law, also require a fresh affirmative opt-in.
13. Contact Us
Questions about this Privacy Policy or our handling of personal information? Contact Profit Shapers at the email address provided to your organization administrator, or through the in-app help channel.
Acknowledgement
I have reviewed the ClientHub Privacy Policy, including the description of how aggregated and de-identified data may be used for industry insights and how the optional ProfitShapers Marketplace program works. I understand that my organization will not be enrolled in the Marketplace program unless an authorized signer separately and affirmatively opts in, and that withdrawal is available at any time.