Privacy Policy

1. Scope

This describes what ProbieTrack does with personal information. Most of the personal information in the service is about your department's members, and your department decides what goes in and why. For that information your department is the controller and we are the processor — see the Data Processing Addendum.

2. What is held

• Account holders. Name, email address, rank or title, role, password (hashed, never recoverable), optional two-factor secret, sign-in times, and the IP address and browser of sign-in attempts.
• Members being evaluated. Name, employee identifier, contact details, employment type, hire and certification dates, probationary status and dates, and the evaluation records your people write about them.
• Records. Evaluations, ratings, comments, narratives, acknowledgements, written responses, remedial plans and practical evaluations.
• Documents. Guideline files your department uploads.
• Audit trail. An append-only log of who did what and when, including support sessions.
• Operational logs. Request logs carrying a request identifier and a department identifier, kept [retention period].

3. Why it is held

Only to provide the service to your department: to show your people their records, to produce documents from them, to send the notifications you have turned on, to keep the service secure, and to bill you.

We do not sell personal information, we do not share it between departments, we do not use it for advertising, and we do not use it to train machine learning models.

4. Separation between departments

Every record belongs to exactly one department, and that boundary is enforced in the software rather than by convention: a query that does not name a department fails rather than returning everything. One department cannot see another's members, records or configuration.

5. Who else sees it

• Stripe processes payments. It receives billing contact details, not personnel records.
• [Email provider] delivers notifications. It receives the content of those messages.
• [Hosting provider] runs the servers.
• Us, when helping with a problem, under the read-only, audited support-session rules in the Terms.

[Note any of these that are outside the customer's country.]

6. Security

Transport is encrypted. Passwords are hashed with a current key-derivation function and are not recoverable. Two-factor authentication is available and can be required for administrative tiers. Sign-in attempts are rate limited and accounts lock after repeated failures. Sessions expire on idle and have an absolute ceiling. Uploaded files are private and reachable only through short-lived signed links. Backups run daily and are retained [retention period].

7. How long it is kept

For as long as your department's account exists. When an account is deleted, a 30-day window runs during which nothing is destroyed; after it, the data is permanently removed. Your department's own records-retention schedule governs what you should keep and for how long — we do not enforce it for you.

8. Rights

If you are a member of a department using ProbieTrack, ask your department: they control the records about you. If they need our help to answer you, we will provide it. [Add the specific rights and response times required by applicable law.]

9. Contact

[Privacy contact address.]

Last updated: 2026-09-11