Privacy Policy

1. Data Controller

When the Human Bridge application is used by an organization, that organization is the data controller. PARTNER TRACK SASU acts as a data processor. A Data Processing Agreement (DPA) is available upon request.

2. Data Collected

Website

• Browsing data — pages visited, visit duration (via PostHog)
• Cookies — navigation preferences, consent (via Axeptio)

Application

• Identity data — first name, last name, email, profile photo, job title
• Professional data — team, role, objectives (OKRs), performance indicators (KPIs)
• Learning data — progress, skill levels, training sessions
• Reflection data — debrief contents, managerial feedback
• Conversation data — exchanges with the AI assistant
• Technical data — connection logs, application usage

3. Purposes of Processing

• Service operation — managing objectives, skills, and debriefs on behalf of the client organization
• Service improvement — analyzing site and application usage
• Communication — responding to contact requests
• Legal compliance — meeting regulatory obligations

4. Legal Basis

• Contractual performance — for application operation under the contract with the client organization
• Consent — for non-essential cookies and site analytics
• Legitimate interest — for service improvement

5. Sub-processors

• Railway — infrastructure hosting (Google Cloud Platform, Europe region)
• PostHog — site and application usage analytics
• Mistral AI — language model for the AI assistant (hosted in Europe)

No data is transferred outside the European Union.

6. Hosting and Security

• Hosted in Europe — Railway infrastructure on Google Cloud Platform, EU region
• Data isolation — each organization has an isolated data space
• Encryption — secure connections (HTTPS), encrypted integration tokens
• Limited access — only authorized personnel can access data

7. Data Retention

• Application data — retained for the duration of the contract with the client organization, then deleted within 30 days of termination
• Analytics data — 25 months maximum
• Contact data — 3 years after last contact

8. Your Rights

Under the GDPR, you have the following rights:

• Right of access — obtain a copy of your data
• Right to rectification — correct inaccurate data
• Right to erasure — delete your data
• Right to portability — retrieve your data
• Right to object — object to processing
• Right to restriction — restrict processing

To exercise these rights, contact us at: [email protected]

You may also lodge a complaint with the CNIL (French data protection authority).

9. Cookies

This site uses cookies to improve your experience:

• Essential cookies — required for site operation
• Analytics cookies — PostHog to understand site usage
• Preference cookies — to remember your consent choices (Axeptio)

You can manage your preferences via the cookie management button.

10. Changes

This privacy policy may be updated. Any changes will be published on this page with a new update date.

11. Contact