myBench Privacy Policy

Version 1.0 (revised draft) Publication date: to be set when this reviewed notice is actually published. Last updated: October 22, 2026. Draft for attorney and operational review; not yet in effect.

This notice explains how Z6 Mgmt Consulting, LLC, a Wyoming limited liability company doing business as Z6 Advisory and operated from Lake Forest, California ("Z6", "we", "us"), handles personal information for the myBench website at getmybench.com, usemybench.com when it redirects there, and the myBench application at app.getmybench.com. It does not cover separate sites or consulting engagements with their own notices. This notice describes information handled through features that are actually enabled; a planned feature does not collect information merely because it appears on a roadmap.

1. Main points

  • We use information to provide, secure and support myBench, communicate with you, and meet legal obligations.
  • We do not sell personal information or share it for cross-context behavioral advertising.
  • We do not use company content to train AI models. AI-provider retention is separate from training; see section 8.
  • A company's authorized users may see workplace records according to access permissions. myBench is not an anonymous reporting channel.
  • Do not submit patient information, passwords outside sign-in, financial account numbers, government identification numbers or other prohibited sensitive information.
  • Contact azahran@z6advisory.com or (949) 818-7994 about privacy.

2. Z6's role and the company's role

For website inquiries, direct communications, account administration, billing and our own security and legal records, Z6 determines the relevant purposes of processing, subject to applicable law. For information handled on a customer company's behalf, such as its workplace records, guides, answers and history, the company determines the purposes and we process under its instructions and our Data Processing Addendum. The role depends on the particular processing, not merely on which database holds a field.

For requests about information in a company's account, contact that company first. We will direct requests to it and assist as required. If Z6 independently controls the requested information, we will handle that part ourselves.

3. Website information

Forms and communications. We collect the information you submit, such as your email, name, company, industry, team size, question, booking details or correspondence. Required fields are identified on the form. We use inquiry information to answer you, booking information to arrange the requested call, and early-list information to send the myBench updates you requested. GoHighLevel may process forms, contact records and booking information where that website integration is enabled. We do not use an inquiry or workplace invitation alone as permission to send unrelated marketing or text messages.

Technical information. Hosting and security services process request and device information, which can include IP address, time, requested page, browser and security events. Anti-spam controls may use submission timing, hidden fields and rate counters. Website analytics, when enabled, measure page views and form events; we do not intentionally include form text, names or email addresses in analytics events. We do not use advertising pixels or cross-site advertising tracking for myBench. Browser storage and third-party technical processing are described in section 9.

4. Application information

4.1 Accounts and authentication. We process email addresses, names entered in myBench, account identifiers, memberships, access permissions and sign-in/security records. Supabase Auth handles passwords and identity verification; Z6 does not store readable passwords. Authentication and hosting providers may retain technical security records. Optional social sign-in is described in section 5.

4.2 Company content. Depending on enabled features and what the company submits, workplace information may include names, job titles, work contact details, departments, reporting lines, employee or contractor status, start and departure dates, leave status without its reason, functions and backups, training and performance sign-offs, guides and their versions, interview answers, quiz work, notes, and records of changes. Customer relationship, software access, incentive or attachment records are processed only if those features are made available and used. Company content can contain personal information even if the form is not specifically asking for it.

Authorized company users and consultants may see records according to their permissions. Change history can identify who did what and when. myBench measures business-function coverage rather than creating individual employee scores. Ordinary company exports exclude per-person question pace, manager check-ins, email-send logs and walkthrough-seen records. Other workplace records, such as authorship, assignments and approved performance reports, can still identify individuals. Statutory access rights are assessed separately from ordinary exports.

4.3 Pictures and attachments. The reviewed text-editor build does not offer picture uploads. Before enabling them, we will update this notice to describe processing, metadata handling, storage, deletion and any AI use. Do not submit patient screenshots or secrets through any channel.

4.4 Help and feedback. Direct support and product feedback may include your contact/account details, company context, the screen or app version, messages and correspondence needed to investigate and reply. We do not promise anonymous feedback or automatic removal of all identifiers. A separate in-app AI help assistant and feedback-credit program are not active in the reviewed build. Their data flows and retention must be disclosed before activation. Existing AI text-processing features are described in section 8.

4.5 Support requests and calls. The current in-app request form stores the signed-in user's account reference, screen, chosen channel, and either callback phone and preferred time or message. The external GoHighLevel delivery connection is not active in the reviewed build; saving a request does not establish external delivery. Calling or emailing Z6 directly uses our communications providers. If automated screening, recording or transcription is enabled for calls, we will disclose that and obtain legally required consent before it begins, explain the applicable retention, and offer email or an available unrecorded alternative. This policy itself is not consent to recording.

4.6 Company creation and CRM. Creating a company stores its setup information in myBench. Automatic copying of new-company contacts to GoHighLevel is not active in the reviewed build. We will disclose its fields and purpose before enabling it. Invited employees are not automatically placed on a marketing list merely because they were invited.

4.7 Billing. Paid billing is not active in the reviewed build. When offered, Stripe will collect payment and billing information directly, and Z6 will retain customer/subscription references, transaction and invoice information rather than full card numbers. The checkout will identify the information and recurring charges you authorize.

4.8 Service emails. We use Resend for invitations and enabled service messages, including daily questions. The reviewed email templates contain no tracking pixel. Provider-side open and click tracking settings must be verified before publication. Users may turn off optional daily-question emails in available settings. Essential account, security, legal and billing messages may still be sent.

4.9 Operations and abuse prevention. We process access and security records, sensitive-action audits and rate-limit counters to control abuse and separate company data. Application logging is designed to exclude submitted guide text, answers and other content; this does not mean hosting or authentication providers keep no logs. Rate-limit keys are pseudonymous technical identifiers, not a promise of irreversible anonymity.

4.10 Agreement records. The acceptance mechanism specified for release will record the user, the company represented where applicable, document version, exact-text hash, time, affirmative action and presentation method, plus the privacy notice version shown. It will not store an IP address or raw user-agent string in the acceptance table. That mechanism is not yet implemented in the reviewed build. Hosting/security logs are separate and may contain IP addresses. A privacy notice being shown is not consent to every processing activity.

5. Optional Google or Microsoft sign-in

These options apply only when enabled, and run on the myBench app at app.getmybench.com. The identity provider may supply Supabase Auth with an account identifier, email and verification status and, under basic profile permissions, name or picture information. Provider consent screens describe the requested permissions. The reviewed account-verification code checks allowed identity providers and email verification; the production provider settings must be checked before activation.

We use sign-in identity information for authentication, account matching and security, and the name you enter in myBench for your display name. We do not request mailbox, file, calendar or contact access for basic sign-in. Supabase may retain the provider identity record even when a profile field is not displayed in myBench. Removing myBench from the provider's connected-app settings stops future authorization but does not automatically delete workplace records held by your company. Contact us to request disconnection or account deletion; a usable alternate sign-in method may be needed first.

If Google API data is received, myBench's use and transfer of it will comply with the Google API Services User Data Policy, including Limited Use requirements where applicable.

6. Purposes

We use information to create accounts and companies, authenticate users, apply permissions, provide enabled documentation and training features, send requested and necessary communications, run the AI tasks described below, respond to feedback, process approved billing, maintain security and reliability, address abuse, and comply with law and enforce agreements. Customer Personal Information processed on a company's behalf is limited by the DPA. Service improvement does not authorize selling company content, advertising use or model training.

7. Recipients and service providers

  • Vercel: App/website hosting, request handling and technical logs; website analytics where enabled
  • Supabase: Application database and authentication; storage only for enabled storage features
  • Anthropic: Commercial API for enabled AI text tasks
  • Resend: Application service emails
  • Cloudflare Turnstile: Browser/device checks on authentication screens where enabled
  • GoHighLevel: Website CRM, bookings or communications where connected; app delivery and company-contact synchronization are pending
  • Stripe: Payment processing when paid checkout is enabled
  • Google or Microsoft: Optional identity provider when enabled and chosen; subject to its own notice
  • Authorized company users and consultants: Company-directed access within granted permissions
  • Authorized Z6 personnel and professional advisers: Support, security, accounting or legal work on a need-to-know basis

We require appropriate written confidentiality, security and processing restrictions for service providers handling data on our behalf. Identity providers and payment processors may also process information for their own legally permitted purposes under their notices; they are not automatically processors for every activity. Subprocessor changes for company-directed processing follow the DPA.

We may disclose information as required by law or reasonably necessary to protect legal rights, security or safety, subject to applicable law and the DPA, and to a successor in a business sale or reorganization under appropriate confidentiality and continuing data-protection obligations. We do not sell personal information or share it for cross-context behavioral advertising.

8. AI processing and provider retention

Enabled AI tasks send the needed text to Anthropic's commercial API. That can include a guide, answer or task context; information written in that text can identify a person even if no separate name or email field is sent. The current integration is text based and does not transmit pictures. AI-generated text saved as a guide or other company record is retained with that record.

The application's AI-call ledger stores operational fields such as tenant, purpose, model, prompt version, token counts, cost, status, attempts and timing, without the full prompt/response or a requesting-user field. That ledger design does not prevent identifying information from appearing in the text sent to the provider or in saved task results.

Z6 does not use company content to train models. Anthropic's commercial terms prohibit training on customer content. Its published standard API retention is deletion of inputs and outputs within 30 days, with exceptions for an agreed arrangement, particular services or models, safety/usage-policy enforcement and legal requirements. Flagged usage-policy content may be retained for up to two years and associated safety classifications for up to seven years; other legal or covered-model requirements may apply. We do not promise zero retention. See Anthropic's commercial terms and commercial retention explanation. We will reassess this notice before changing the provider, data types or applicable retention arrangement. We do not voluntarily submit company content through provider feedback tools for training.

9. Cookies and browser storage

Authentication uses session and sign-in cookies. The app may use local or session storage for drafts, interface preferences and dismissed notices. Signing out clears the storage items the app controls; it does not guarantee erasure of downloads, browser backups or all third-party storage. Shared-device users should sign out and use their organization's device controls.

Turnstile and hosting services process device/network information for security and may use browser mechanisms described in their notices. See Cloudflare's Turnstile privacy addendum. We do not label all third-party technical processing cookie-free. Website analytics, where enabled, are used for site measurement rather than advertising. We do not use advertising cookies or cross-context tracking for myBench. We treat Global Privacy Control as an opt-out signal for sale/sharing; we do neither. Other Do Not Track browser signals do not change processing needed to provide or secure the service.

10. Retention and deletion

The following is the proposed release retention schedule; it must be operationally implemented and verified before this draft is published. Limited exceptions apply to legal holds, legal obligations, disputes and security investigations; retained exceptions must be restricted to that purpose and reviewed for deletion when no longer needed.

  • Early-list and inquiry contacts: Delete or de-identify within [24] months after the last meaningful contact, or earlier on a valid request; retain a minimal suppression record to honor an opt-out
  • Company content and ordinary guide history: While the account remains open and the information is needed for the agreed service; subject to lawful correction/deletion requests and security remediation
  • Closed company accounts: A [90]-day retrieval period after confirmed closure, during which the account holder can sign in and export available data, then deletion/de-identification from active systems. Warning emails may be sent before deletion; they do not include an export link
  • Routine backups of deleted company content: Expire within [30] further days; isolated from normal use, with pending deletion reapplied after restoration
  • User profile and sign-in identities after the last membership/grant ends: Delete or de-identify within [12] months unless the user remains actively using an account-creation flow or another documented exception applies; necessary evidence may be retained separately
  • Support requests and correspondence: Resolve and retain only as needed for support, security or disputes; review for deletion within [24] months after resolution
  • Company AI operational ledger: While needed to operate, secure and account for the company service, then the company closure schedule; legally required billing evidence may be retained separately
  • EULA/Terms acceptance evidence: While needed for the agreement and [six] years after the relevant agreement ends, subject to a documented legal hold
  • App rate-limit counters: Expire after the applicable rate window and the short cleanup period needed to enforce it; do not retain as a user-activity history
  • Provider hosting, authentication and security logs: Limited by provider settings and security needs; the exact provider-specific periods must be confirmed in the release inventory before publication
  • Tax, invoice and accounting records: The period required by applicable tax and accounting obligations, isolated from routine company content
  • AI-provider inputs/outputs: The provider rules and exceptions in section 8, separately from myBench's application records

Leaving an employer or cancelling paid renewal does not automatically delete a company account. Ordinary archive behavior does not override a lawful privacy request. Exact production log settings and any enabled recording retention remain publication requirements, not facts established by this repository review.

11. Security

We use reasonable safeguards appropriate to the information and risk, including authentication, access controls, tenant isolation, encryption supported by our infrastructure providers, and sensitive-action audit records. The reviewed application includes database and application permission controls. This is not a certification of production settings, an absolute security guarantee, or a claim that no incident can occur. We will provide incident notices as required by law and our applicable customer agreements.

12. Sensitive information

myBench is not offered for patient records or protected health information. Patient data is not permitted in myBench, and Z6 does not offer a HIPAA business associate agreement for myBench. Do not enter patient identifiers, health details, credentials outside sign-in, full payment/bank numbers, government identifiers, biometrics or other prohibited sensitive information. Use fictitious demo records for procedure examples. When a guide is saved, myBench runs a lightweight automatic check and shows a warning if the text looks like it may contain a password, an account number or patient details. That check is a warning, not a guarantee; it will miss some information, and the person entering the text remains responsible for it. myBench does not offer a tool for users to redact earlier versions of a guide. Contractual prohibitions and automated checks do not replace the legal duties that may arise if regulated information is actually received; contact us promptly if that occurs, without sending the sensitive text again.

Sign-in credentials are used to authenticate and secure the account. We do not intentionally use sensitive personal information to infer personal characteristics or for unrelated advertising. Information voluntarily included in a guide, message or report may still be sensitive even if it was not requested.

13. Choices, requests and California disclosures

13.1 Requests. You may contact us to request access, a copy, correction or deletion, and unsubscribe from optional marketing. We will consider requests under the law that applies, verify identity proportionately, and explain applicable limits. We do not require government identification by default. We may retain minimal verification evidence without retaining unnecessary identity documents. Essential service notices may continue after a marketing opt-out.

13.2 California. Where the CCPA applies, rights can include access to categories and specific pieces, correction, deletion, portability, opt-out of sale/sharing, limitation of certain sensitive-information uses, and nondiscrimination. We do not sell/share for cross-context behavioral advertising or use sensitive information for purposes that require an offered right to limit. Applicable exceptions and verification requirements still apply. Whether Z6 or a customer meets a CCPA threshold requires a separate factual assessment; this notice does not declare every business covered. We also consider reasonable requests from people not covered by the CCPA.

13.3 Company-held records. We forward company-directed requests to the relevant customer and assist under the DPA. A current or former employee who used myBench and is a California resident may ask to have their personal information removed. Removal must not break the integrity of the business records and procedures they entered while a user, so we and the customer will normally de-identify rather than delete: for example, replacing the person's name and contact details in guides and history with a neutral label, while keeping the guide, its versions and the record of what was done. Some information may be kept where the law allows an exception. A former employee does not automatically lose privacy rights, and the customer must assess any lawful retention exception instead of applying a blanket "history is never deleted" rule. Z6 will respond independently for records it controls and fulfill its own direct legal duties.

13.4 Contact and timing. Email azahran@z6advisory.com, call (949) 818-7994, or write to the address below. For verifiable CCPA access, correction or deletion requests, we acknowledge receipt within 10 business days and respond within 45 calendar days, with any lawful extension explained before the initial deadline. Other requests follow the timelines required by applicable law. An authorized agent may act with appropriate proof of authority; direct verification may still be required where lawful. We do not charge a fee except as law allows and with advance explanation.

13.5 Categories and notice at collection. Depending on actual use, we collect identifiers and contact details; customer/account and billing records; professional/workplace information; internet, device and security activity; user-submitted text and other enabled content; and sensitive sign-in credentials. Sources include you, your company and authorized users, your device/browser, identity providers, and payment or communication services. Purposes, recipients and retention are described in sections 3 to 10. We do not intentionally generate individual employee profiles or scores. A form or workflow collecting additional categories must provide an appropriate notice before collection. Before publication, the preceding 12 months of actual collection/disclosure must be reconciled with these categories; planned features are not historical collection.

14. Children

myBench is a business service intended for users aged 18 or older. We do not knowingly collect personal information from children under 18 through their own accounts. Contact us if you believe a child's information has been submitted so we can investigate and take appropriate action. We do not knowingly sell or share children's information for advertising.

15. Locations and international use

Z6 operates myBench from the United States. Our infrastructure and providers may process information in the United States and other locations under their applicable arrangements; this notice makes no promise of exclusive residency in a particular region. The actual database, authentication, hosting, support and subprocessor locations must be recorded and reviewed before release. myBench is offered only to businesses operating in the United States. Do not submit information requiring additional international-transfer agreements or local safeguards until those are arranged in writing; agreeing to this policy alone is not a transfer safeguard.

16. Changes

We will date and publish changes and give account holders advance email or in-app notice of material changes. We will obtain separate consent where legally required rather than treating notice or continued use as blanket permission. The policy applicable to previously collected information and customer-contract limits remain subject to law.

17. Contact

Z6 Mgmt Consulting, LLC, doing business as Z6 Advisory

Mailing address supplied for legal and privacy correspondence: 30 N Gould St, Ste R Sheridan, WY 82801

Email: azahran@z6advisory.com Phone: (949) 818-7994