1. Introduction
Welcome to ProvenPath ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our career performance tracking platform at provenpath.app (the "Platform").
By using ProvenPath, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Platform.
2. Information We Collect
2.1 Information You Provide to Us
Account Information:
- Name, email address, phone number
- Professional title, company name, employment history
- Profile photo and biographical information
- Login credentials (encrypted)
Career Performance Data:
- Self-assessment responses
- Peer and manager review feedback
- Interview scores and evaluations
- Skill assessments and ratings
- Career goals and development plans
- Performance review history
- Promotion readiness indicators
Identity Verification Data:
- Information collected through our Clear.me integration for background checks
- Government-issued identification (processed by Clear.me, not stored by ProvenPath)
- Employment verification documents
Communication Data:
- Messages sent through our Platform
- Support requests and correspondence
- Feedback and survey responses
2.2 Information Collected Automatically
Usage Data:
- IP address, browser type, device information
- Pages visited, time spent on pages, click data
- Referring/exit pages and URLs
- Date and time stamps of Platform usage
Cookies and Tracking Technologies:
- We use cookies, web beacons, and similar technologies to enhance your experience
- You can control cookie preferences through your browser settings
2.3 Information from Third Parties
Employer-Provided Data:
- Performance review data shared by your employer
- Organizational structure and reporting relationships
- Company-specific skill matrices and career levels
Integration Data:
- Information from HRIS systems (BambooHR, Workday, Gusto, etc.) if your employer uses our integrations
- LinkedIn profile data (if you choose to connect your account)
3. How We Use Your Information
We use your information for the following purposes:
3.1 Platform Services
- Provide, maintain, and improve our Platform
- Create and manage your Proven Path
- Generate AI-powered development plans and career insights
- Facilitate performance reviews and feedback collection
- Track career progression and skill development
- Enable identity verification through Clear.me
- Generate verified references and career documentation
3.2 Communication
- Send you service-related notifications and updates
- Respond to your inquiries and support requests
- Send promotional communications (with your consent)
- Notify you of performance review cycles and deadlines
3.3 Analytics and Improvement
- Analyze Platform usage to improve features and user experience
- Conduct research and development for new features
- Generate aggregated, anonymized analytics for employers
- Monitor and prevent fraud, abuse, and security incidents
3.4 Legal and Compliance
- Comply with legal obligations and regulatory requirements
- Enforce our Terms of Service and other policies
- Protect our rights, privacy, safety, and property
- Resolve disputes and enforce agreements
5. Data Ownership and Portability
5.1 Your Data Ownership
You own your Proven Path data. This includes:
- Your performance reviews and feedback
- Skill assessments and career progression history
- AI-generated development plans
- Verified references and achievements
5.2 Employer License
Your employer licenses access to your performance data during your employment. Upon termination of employment:
- Your employer retains historical performance data for their records
- You retain full ownership and control of your Proven Path
- You can export and transfer your data to new employers
5.3 Data Portability
You have the right to:
- Export your Proven Path in standard formats (JSON, PDF)
- Transfer your verified performance history to new employers
- Download all your personal data at any time
- Request deletion of your data (subject to legal retention requirements)
6. Data Security
We implement industry-standard security measures to protect your information:
6.1 Technical Safeguards
- Encryption of data in transit (TLS/SSL) and at rest (AES-256)
- Secure authentication and password hashing
- Regular security audits and penetration testing
- Intrusion detection and prevention systems
- Secure backup and disaster recovery procedures
6.2 Organizational Safeguards
- Access controls and role-based permissions
- Employee training on data protection and privacy
- Confidentiality agreements with all personnel
- Incident response and breach notification procedures
6.3 Third-Party Security
- All service providers undergo security assessments
- Compliance with SOC 2 Type II standards (in progress)
- Regular vendor security reviews
Note: No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
7. Data Retention
7.1 Active Accounts
We retain your information for as long as your account is active or as needed to provide services.
7.2 Inactive Accounts
If your account is inactive for 3 years, we will:
- Send you a notification before deletion
- Provide 90 days to reactivate or export your data
- Delete your account and associated data after the grace period
7.3 Legal Retention
We may retain certain information for longer periods when required by:
- Legal obligations (tax, employment, or regulatory requirements)
- Dispute resolution and legal proceedings
- Fraud prevention and security purposes
7.4 Employer Data
Employers may retain historical performance data according to their own retention policies and legal requirements.
8. Your Privacy Rights
Depending on your location, you may have the following rights:
8.1 Access and Correction
- Access your personal information
- Correct inaccurate or incomplete data
- Update your profile and preferences
8.2 Data Portability
- Export your Proven Path in machine-readable formats
- Transfer your data to other services
8.3 Deletion
- Request deletion of your personal information
- Close your account permanently
- Note: Some data may be retained for legal compliance
8.4 Objection and Restriction
- Object to certain data processing activities
- Restrict how we use your information
- Opt out of marketing communications
8.5 Withdraw Consent
- Withdraw consent for data processing at any time
- Disconnect third-party integrations
- Revoke access permissions
8.6 Lodge a Complaint
- File a complaint with your local data protection authority
- Contact us directly with privacy concerns
To exercise your rights, contact us at: privacy@provenpath.app
9. International Data Transfers
ProvenPath is based in Canada. If you access our Platform from outside Canada:
- Your information may be transferred to and processed in Canada
- We comply with applicable data protection laws for international transfers
- We use standard contractual clauses and other safeguards as required
10. Children's Privacy
ProvenPath is not intended for individuals under 16 years of age. We do not knowingly collect personal information from children. If we discover we have collected information from a child, we will delete it immediately.
11. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act:
11.1 Right to Know
- Categories of personal information collected
- Sources of personal information
- Business purposes for collection
- Categories of third parties with whom we share information
11.2 Right to Delete
- Request deletion of your personal information (subject to exceptions)
11.3 Right to Opt-Out
- Opt out of the "sale" of personal information (Note: We do not sell personal information)
11.4 Right to Non-Discrimination
- We will not discriminate against you for exercising your CCPA rights
To exercise your CCPA rights, contact us at: privacy@provenpath.app
12. European Privacy Rights (GDPR)
If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation:
12.1 Legal Basis for Processing
We process your data based on:
- Consent: When you provide explicit consent
- Contract: To fulfill our contractual obligations
- Legitimate Interests: For business operations and improvements
- Legal Obligations: To comply with laws and regulations
12.2 Data Protection Officer
For GDPR-related inquiries, contact our Data Protection Officer at: privacy@provenpath.app
12.3 EU Representative
[To be appointed when serving EU customers]
14. Third-Party Links
Our Platform may contain links to third-party websites and services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.
15. AI and Automated Decision-Making
15.1 AI-Generated Development Plans
We use artificial intelligence to analyze your performance data and generate personalized career development recommendations. These AI-generated insights are:
- Based on your performance history, skill assessments, and career goals
- Intended as guidance, not definitive career advice
- Subject to human review and your discretion
15.2 Promotion Readiness Predictions
Our AI predicts promotion readiness based on historical patterns and performance data. These predictions:
- Are probabilistic estimates, not guarantees
- Should be considered alongside human judgment
- Do not make final promotion decisions (humans do)
15.3 Your Rights
You have the right to:
- Understand how AI decisions are made
- Contest AI-generated recommendations
- Request human review of automated decisions
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make changes:
- We will update the "Last Updated" date at the top
- We will notify you via email or Platform notification for material changes
- Continued use of the Platform after changes constitutes acceptance
We encourage you to review this Privacy Policy periodically.
17. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices:
ProvenPath — Email: privacy@provenpath.app