Who is responsible
CXPR™ (Customer Experience Performance Review) is a measurement tool and structured review process provided by Science of Next, operated from Toronto, Canada. For privacy requests, contact Tara O’Doherty at hello@thecxpr.com. This policy covers TheCXPR.com, applications, correspondence, and review delivery. Updated 8 November 2026.
Applications, briefs, and payments
When you submit your checkout brief, we receive your contact name and email, business name, industry, online-sales answer, website URL, goals, selected review, and competitor URLs for CXPR+. We store these details, your terms acknowledgement, a brief reference, and submission time in our site database. A temporary hashed network identifier helps limit repeated submissions. The brief reference is passed to Stripe to match your brief to your checkout. Saving a brief does not confirm payment.
Stripe collects your payment information, billing details, and receipt email address. Your website and competitor URLs are collected in our brief. We can access the billing and transaction information needed to administer your order. Promo codes are entered on Stripe. Do not put card details in your brief. Stripe Privacy Policy.
A standard review uses public website pages. Do not submit passwords, customer lists, patient records, financial account details, or other sensitive personal information. Agree a separate scope and secure handling before sending non-public materials. We also hold correspondence and the resulting review report.
Why we use information
We use information to assess applications, agree, and deliver reviews, answer questions, manage invoices, and corrections, and protect our service. For UK personal data, our lawful bases are steps toward or performance of a contract with an individual customer; legitimate interests in managing business relationships and providing a secure service (including contacts acting for companies); legal obligations for required records; and consent for optional analytics and newsletter emails.
Newsletter permission is optional, unchecked by default and separate from applying. It is not required for acceptance. Withdraw it using an unsubscribe link in a marketing email or email hello@thecxpr.com with “Unsubscribe”. We may still send necessary application or service messages. We do not publish your confidential brief, report, or testimonial without separate permission.
Browser drafts and cookies
The checkout form temporarily saves your draft in this browser tab so you can return without retyping. Drafts are restored for up to 24 hours and are cleared when the browser session ends. Your contact email is passed to Stripe to prefill checkout. Submitted briefs are saved in our site database before payment; closing or refreshing the page does not erase a submitted brief. Contact us to request access or deletion.
Country and industry choices help carry your selections through the site. Country defaults may use the hosting service’s country estimate; we do not ask for precise location. Optional Google Analytics is described below. We honour Global Privacy Control and Do Not Track by keeping analytics off. Essential service and security processing continues.
Providers, AI, and global processing
ChatGPT Sites hosting and database infrastructure processes website requests and submitted applications. Email, document-storage, and payment providers process information needed for their services. Website requests include technical information such as IP address and browser details; hosting may keep security logs. Some pages request Google Fonts. Optional analytics uses Google.
Our reviewers may use AI to help with public website observations and selected research. A confidential brief is not automatically sent to an AI service by the application form. Any proposed use of non-public material with AI requires agreed scope and suitable provider arrangements. See our Responsible AI Policy.
Providers may process information in Canada, the US, or other countries. UK restricted transfers require an applicable adequacy decision or appropriate safeguards, such as approved contractual terms. Canada’s adequacy coverage is limited to processing subject to PIPEDA; it does not cover every provider or onward transfer automatically. Contact us for information about the safeguards relevant to your records.
Retention and security
Our retention review schedule is: enquiries and applications that do not become paid work, 12 months after the last substantive contact or final decision; paid-project briefs and reports, 24 months after completion; newsletter contact details, until withdrawal or a review after 24 months without engagement. We retain the minimum suppression record needed to honour an unsubscribe.
Billing records follow applicable tax and accounting retention requirements. A dispute, legal hold, or ongoing engagement may require longer retention. We review and remove or de-identify records that are no longer needed; this is a managed process, not a promise of immediate automatic deletion from every provider or backup. Hosting and provider logs follow their own service retention arrangements. Ask us about a specific record.
Application access is limited to the authenticated owner. We use access controls and avoid logging application bodies. No internet service is completely secure. Report suspected exposure to hello@thecxpr.com.
UK privacy rights
You can request access, correction, deletion, restriction or, where applicable, a portable copy of your personal information. You can object to processing based on legitimate interests, and object to direct marketing at any time. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. These rights have exceptions, including necessary legal records.
Contact our privacy contact below. We ask only for information reasonably needed to verify and handle a request; please do not send identity documents unless we agree a secure method. We normally respond to UK data-rights requests within one month, subject to lawful extensions. You may complain to the UK Information Commissioner’s Office (opens in a new tab).
California and other US visitors
We do not sell personal information or use this site’s analytics for cross-context behavioural advertising. Advertising personalisation and Google signals are disabled. We disclose information to service providers for the purposes explained above. We do not knowingly invite applications from children.
California privacy rights depend on the law’s applicability. Where applicable, you may request access, correction, or deletion, and exercise sale/sharing opt-out rights without discrimination. You or an authorised agent can contact hello@thecxpr.com; we may verify identity and the agent’s authority. We will explain any applicable exception. The privacy choices described here are available even where the CCPA does not apply to us.
Questions and policy changes
Contact hello@thecxpr.com for access, correction, deletion, consent withdrawal, or a complaint. You may also contact the Office of the Privacy Commissioner of Canada (opens in a new tab) or your applicable regulator. We update the date when practices change and give additional notice or obtain consent where required.