Privacy policy

Who does what

When an organization uses this service to collect feedback about its people, it is the controller: it decides who is reviewed, who is asked, and why. We act as processor, on its instructions.

For running the service itself — accounts, authentication, security logs, backups — we are controller for a limited set of data.

The platform's super administrators manage every organization that uses it: campaigns, members and settings. They never access individual answers, and their actions appear in each organization's audit trail.

If you were asked to give feedback and want to exercise your rights over what you wrote, ask the organization that invited you first. We will help you reach them.

Purposes

• Feedback: collecting professional feedback about a person, combining it anonymously and giving them a summary, for their professional development. It is not a rating or a ranking.
• Running the service: creating and managing accounts, authentication, sending invitations and reminders, protecting the service against abuse, backing up data.

Legal basis

Your answers to a questionnaire are processed on the basis of your consent (GDPR article 6(1)(a)). Before your first answer you are asked to confirm that you have read this page and agree to your answers being used for this feedback. Nothing is stored before that. The date of your consent and the version of the text you agreed to are kept with your answers, so that it can be demonstrated.

You can withdraw this consent while the campaign is open, with the “Withdraw my response” button: your answers are then deleted. After the campaign closes your answers can no longer be changed; you can still ask for them to be erased (see “Your rights”). Withdrawal does not affect what was already processed, in particular the aggregated figures of a report already published.

Declining, or not answering, has no consequence: nobody in the organization learns who has not replied.

Accounts, security and backups are based on legitimate interest (article 6(1)(f)): running the service an organization chose, and protecting it.

What is processed

• Identity: display name and email address. The name is the one you choose.
• Membership: the organization, your role, when you joined and left.
• Responses: what you write or rate in a questionnaire, with the date of your consent. Confidential.
• Audit trail: administrative actions, timestamped to the hour.
• Technical: IP address and request headers, used to limit abuse, held in server logs.
• Access request: until 14 October 2026 the site offered a request to join the workspace (first name, last name, email address, link to a LinkedIn profile). That form is no longer offered; the requests already received are still read by the administrators of the workspace that receives them, only to decide on access.
• Contact, information or quotation request: if you write to us from the contact form or from “Let's talk about your feedback needs”, your name, your company (for an Enterprise request), your email address and your message. They are used only to answer you and to follow up your request (basis: your consent, by sending the form). They are sent as one email to the operator; a request for information or an Enterprise request is also kept for 12 months, in a list read only by the platform's administrators, then deleted. You can ask for it to be erased before then. A support request is not stored on the platform; when it is opened from the payment screen it carries your purchase reference, so that your payment can be found.

We collect no browsing data for advertising or analytics. There are no third-party trackers and no audience measurement.

What your employer does not see

This is the point of the service, and it is enforced by the database rather than by policy:

• An individual response is never shown to the recipient or to an administrator.
• Averages appear only where at least three people in a group answered that particular question. Below that, nothing is shown — no average, no count, no distribution.
• A written comment follows the same rule.
• A group too small to be shown on its own is pooled with others under “Other responses”: its answers cannot be worked out by subtracting the groups shown from the total.
• An administrator sees how many people answered, never who.
• Deadline reminders are sent by the system: nobody in the organization learns who has not replied.

Automated feedback review by a language model

Optional, and decided by the organization. A coach reviewing a campaign can, if the organization has switched this on, have a language model group the recurring themes of the free-text comments. The result is an automated review that the coach reads, corrects or rewrites before anything is published: no decision is taken by automated processing, and nothing is published without the coach's approval.

For an individual client, with no coach, the report is published without review. In that case, and only in that case, the language model produces the themes, a written synthesis and a reworded version of the comments, and the report is published to the person concerned before any person has read them. The report says so at the top. What limits the risk: the anonymity thresholds apply before any automated step; the model sees only comments already cleared to be shown; your words are never published as written — a comment is reworded to remove names, places, dates, projects and recognisable turns of phrase, and is dropped if it keeps a run of its words; the synthesis contains no figure; and if a step fails, the report is published with the figures alone.

• What is sent: the text of the comments, the questions and group averages. Never your name, your address, a response identifier or the date you answered: none of it is in the data processed.
• Before it is sent, e-mail addresses, phone numbers and the names the platform knows for that campaign (the beneficiary, the organization's members, the people asked) are removed, along with common first names. This is done as far as possible: no automatic method removes every name (a surname the platform does not know, a nickname or a typo can get through). The coach's review is the last check.
• Where: the provider (OpenAI) is established in the United States; the text may be processed there, outside the European Union, under a data-processing agreement and transfer safeguards (see the Sub-processors page).
• Retention by the provider: under the provider's terms, which we do not control: up to 30 days for abuse-monitoring logs, longer where law or security requires it (details on the Sub-processors page). We ask it not to keep the request, but that is a request, not a guarantee.
• A limit on erasure: once a comment has been sent, an erasure of your answers requested afterwards cannot reach the provider's copy.

For this review of comments, we keep neither the text sent nor the model's answer: only the provider, the model, the token counts, the cost and the outcome of the call are recorded. The translation of questionnaires, described below, works differently: its result is kept.

Translation of questionnaires by a language model

Automatic, when a questionnaire is published. When a version of a questionnaire is published, the same provider (OpenAI) generates its other language (French or English), so that each respondent reads it in their own language. The author has nothing to validate: the translation is generated by AI and may be imperfect.

• What is sent: only the text of the questionnaire, written by the organization: section titles, questions, help texts, answer options and scale labels. That text contains no respondent data. An answer, a comment, a name, an e-mail address or an identifier is never sent to be translated.
• What we keep: unlike the review of comments, we keep the translation, with the questionnaire, to show it to respondents. The call ledger still records only the provider, the model, the token counts, the cost and the outcome.
• Independent of the automated review: the translation depends neither on the organization's choice about the review of comments nor on that review's monthly budget.
• Where, and for how long at the provider: the same terms as above (see the Sub-processors page).

Writing a questionnaire from a description

On an administrator's request. When an administrator chooses to create a questionnaire “from a prompt”, the description they typed is sent to the same provider (OpenAI), which writes a first draft. The draft is an ordinary questionnaire that the administrator reads, edits and publishes themselves: it is generated by AI and may be imperfect.

• What is sent: only the text of the description, after removal as far as possible of e-mail addresses, phone numbers and secret keys. It must contain no respondent data, and the screen says so. An answer, a comment or an identifier is never sent.
• What we keep: the questionnaire created, like one typed by hand. The description is erased as soon as the writing is done, whether it succeeded or not. The call ledger records only the provider, the model, the token counts, the cost and the outcome.
• Independent of the automated review: it depends neither on the organization's choice about the review of comments nor on its budget. It is limited to ten requests per organization per day.
• Where, and for how long at the provider: the same terms as above (see the Sub-processors page).

An individual buying a credit

An individual can buy a credit, which lets them create a feedback campaign. We then process their first name, last name and e-mail address, and the amount of the purchase, to carry out the order, invite them to create their access, give them their credit, and keep our accounts.

• Payment: it is made on the payment provider's own secure page. We never see or keep the card number: we only receive the confirmation of the payment and its amount. The page also asks for your billing address, to work out the VAT: it stays with the provider, we do not keep it.
• Right of withdrawal: the box you tick before paying, and the date you ticked it, are kept.
• Retention: your first name, last name and e-mail address are erased from the order as soon as your credit is yours (when you accept the invitation), or after seven days if the payment did not go through, or when the credit expires. A paid purchase is kept as an accounting record, for as long as the law requires, without your name or address.
• Validity: a bought credit is valid for six months from the payment; after that it expires. The date is shown on your credits page.
• Account: the purchase does not create an account. You receive an invitation by e-mail, like any invited person, and choose your password from that link.

A coach buying a pack

A coach can buy a pack of campaigns to create their organization. We then process their first name, last name, e-mail address and the organization name they give, and the pack and amount of the purchase, to carry out the order, create the organization, invite them, and keep our accounts.

• Payment: it is made on the payment provider's own secure page. We never see or keep the card number: we only receive the confirmation of the payment and its amount. The page also asks for your billing address and, if you wish, your business name and VAT number, for the invoice: they stay with the provider, we do not keep them.
• Retention: a purchase that was never paid is deleted after seven days. A paid purchase is kept as an accounting record, for as long as the law requires.
• Account: the purchase does not create an account. The coach receives an invitation by e-mail, like any invited person, and chooses their password from that link.
• What does not change: the coach has no access to a campaign's raw feedback unless the organization has decided so, and every reading is recorded.

Recipients and sub-processors

Data is hosted and transmitted by the providers listed on the Sub-processors page. No other third party has access.

Someone on our team can reach an organization's raw responses only through an exceptional, recorded, time-limited procedure — and that organization is told, in its own audit trail, thirty days later.

Retention

• Raw responses are kept for the period the organization chooses — 365 days by default, at least 7 and at most 10 years — then deleted automatically by a daily job. A campaign can set its own period: 3, 6 or 12 months after the report is published. The organization’s administrators are emailed 14 days before the deletion.
• Answers started but not submitted are deleted after 7 days without activity. The invitation stays valid: you can start again.
• Published reports hold aggregated figures and are kept until the workspace is deleted.
• Personal data of someone who no longer belongs to any organization is erased 90 days after they leave.
• Access requests are erased 90 days after the decision (approval or refusal), or 180 days after they were filed if nobody decided.
• Requests for information and Enterprise requests (“prospects”) are erased 12 months after they were received, or sooner at your request.
• Encrypted backups are kept in rotation: a daily backup for 30 days and a monthly backup for 12 months. Deleted data can therefore remain in a backup, inaccessible, for up to 12 months before it leaves them.

Your rights

You have rights of access, rectification, erasure, restriction, portability and objection. Write to the address in the legal notice.

You can delete your account from the “Your account” page. Your access to workspaces ends, your development plans and notes are deleted, and your name and address are erased at once; your sign-in is removed by the operator within a month. The feedback you gave stays anonymous.

If you have an account, the “Your account” page lets you download as one file (JSON) all the data tied to it: profile, workspaces, campaigns about you and development plans, answers given while signed in, respondents you proposed and actions you took.

One limit worth knowing about erasure. Your responses can be erased: we delete your address, your invitation and the content of your answers. Aggregated figures already published in a report are not recalculated — they do not identify you, and removing them would retroactively change a document its recipient has already read.

You may complain to the CNIL (www.cnil.fr).

Contact

See the address in the Legal notice.