Privacy Policy

Overview

Competrace (“we”, “our”, or “us”) is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your personal data when you use our competence-tracking platform.

Our role

We act in two capacities. For your account and login details, we are the data controller. For the employee evaluation data your organization records in Competrace (skill ratings, review notes), your employer is the controller and we act as a data processor on their behalf, handling that data only on their instructions. Requests about evaluation data may need to be directed to your employer.

Data we collect

• Account information: Name, surname, and email address
• Sign in with Google: If you sign in with Google, we receive your name, email address, a link to your profile picture where Google has one, and Google’s ID for you. We never receive your password for that account.
• Evaluation data (as processor): Skill ratings, assessment records, and free-text assessor notes entered by your organization
• Self-check marks: The skill ratings and certifications you enter about yourself in Self-check. Only you can see them, not administrators. They are not used by the AI assistant, and they do not count toward your skill mastery or promotion readiness.
• Authentication data: Session cookies to keep you signed in
• Activity records: Entries in your organization’s activity log, the date you accepted our Terms and Privacy Policy, and short-lived records of sign-up, login, password-reset and in-product feedback attempts — your email address and IP address — used for rate-limiting.
• Feedback you send us: Your message, plus the page you sent it from, your browser (user-agent) and screen size, and your organization, role and plan — so we can understand and reproduce what you report
• Usage analytics: The pages you visit on our website and, once you are signed in, in the app, and which features you use, such as the AI assistant — linked to a pseudonymous user ID. In the app, the page address keeps your workspace’s web name, which is based on your organization’s name (for a sole trader that can be your own name); the names and IDs of people, departments and records are removed. Collected with Seline (EU-hosted, no cookies). No email addresses or evaluation data are sent, and no other names. Seline uses your IP address and browser details to count daily unique visits and to record your country and your browser, operating system and device type; it does not store your IP address or full browser string.
• Sign-up source (only if you allow it): The site or campaign that sent you to us, such as google.com or chatgpt.com — never the full address you came from. A banner asks first. If you allow it and then sign up, it is saved with your account so we can see which channels bring customers.
• AI assistant (administrators only): When an administrator asks the in-app assistant a question, the question and the internal data needed to answer it (such as employee names, roles, levels and departments, skill ratings, assessment status and history, and the names of people invited to join) are sent to our AI hosting providers in the United States for processing and are not retained, except as a provider needs for abuse monitoring. We keep only a record that a question was asked — who asked it, in which organization and when, but not the question text — for 40 days.

Lawful basis

• Contract (Art. 6(1)(b)): Creating and operating your account to deliver the service you or your employer signed up for.
• Legitimate interests (Art. 6(1)(f)): Keeping the service secure and preventing abuse (for example, login rate-limiting), keeping an activity log so your organization can show who made which decision, handling feedback you send us, and pseudonymous usage analytics that show us how the product is used so we can improve it.
• Consent (Art. 6(1)(a)): Remembering your sign-up source. You can withdraw it at any time with “Cookie choices” at the bottom of our public website pages, which deletes the cookie and asks again, or by writing to us to remove the source from your account.

Employee evaluation data is processed on the lawful basis established by your employer as controller.

Data storage & security

Your data is stored in the European Union (Frankfurt, Germany). Questions to the AI assistant, and the data needed to answer them, are processed in the United States and not stored there (see below). We use industry-standard encryption for data in transit and at rest, row-level access controls that isolate each organization’s data, and rate-limiting on authentication. Access to personal data is restricted to authorized personnel only.

Sub-processors & international transfers

We do not sell your data. We rely on a small number of trusted sub-processors to run the service. Some are based in the United States, so personal data may be transferred there — for example email addresses for sending invitations, and, when an administrator uses the AI assistant, the employee names, roles, levels, departments, skill ratings, assessment status and history, and invitee names needed to answer the question. These transfers rely on appropriate safeguards (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework). The current list is on our sub-processors page.

Payments & billing

Paid subscriptions are processed by Paddle.com Market Ltd (“Paddle”), which acts as our Merchant of Record and as an independent controller for payment and tax processing. When you subscribe, billing-related personal data — such as your name, billing address, and VAT ID — is shared with Paddle so it can process payments and collect and remit tax. Paddle handles your payment details directly, whether you pay by card or bank transfer; Competrace does not receive or store your full card number or bank account details. Paddle is listed on our sub-processors page, and its own handling of your data is governed by Paddle’s privacy policy.

Data retention

We retain your account data for as long as you are a member of an organization on Competrace. Your membership is controlled by your employer: when they remove you, your membership and the evaluation records about you are permanently deleted, and your login account is deleted once you no longer belong to any organization. An account that uses Google sign-in and does not belong to any organization is deleted 7 days after Google sign-in was added to it, unless an invitation to an organization is still waiting for it. Removal is permanent and cannot be undone. Assessments and reviews you wrote about colleagues are retained for your employer as controller, but are no longer linked to you. Your self-check marks are deleted when your membership or account is deleted. Deleted data may persist in encrypted backups until those backups rotate out on their normal cycle.

Separately, your organization keeps an activity log of actions taken in Competrace — for example inviting or removing a member, changing someone’s role, level, or department, starting or finalizing an assessment, editing the competency framework, or changing the subscription plan. It also records three things you do to your own account: changing your password, adding sign-in with Google, and exporting your data. Each entry records the name of the person who acted and the person affected as those names stood at the time, the action, the date, and the before-and-after value of the single field that changed. It contains no ratings and no free text, and it is visible only to your organization’s administrators.

We do not delete activity log entries on a schedule. They are kept for as long as your organization’s account exists and are deleted with it. Removing a member does not remove the entries that name them.

Your rights

Under GDPR and applicable privacy laws, you have the right to access, rectify, erase, and export your personal data, and to restrict or object to its processing. Export is self-service in your account:

• Access & export: Download your data as JSON from Settings → Your data & privacy.
• Erasure: Ask your organization’s administrator to remove you — removal permanently deletes your membership and the evaluation records about you, except entries in your organization’s activity log. Those are retained under Art. 6(1)(f) and Art. 17(3)(e), so the record of who made which decision survives the departure of the people involved. If you believe an entry about you should not be kept, email us at the address below. Where we cannot rely on Art. 17(3)(e), we replace your name with “Erased user” wherever the entry names you — as the person who acted and as the person affected — and unlink the entry from you. The other person’s name and the record of the action itself remain. You can also address a deletion request to us rather than to your administrator.
• Rectification, restriction & objection: Email us using the address below.

For anything not available in-app, or to correct evaluation data held by your employer, email support@competrace.com. We will verify your identity and respond within one month, as required by GDPR Article 12.

Contact us

For privacy inquiries, data requests, or questions about this policy, contact us at support@competrace.com.