Privacy Policy — AuthenticTeamz

Last updated: 8 October 2026

This Privacy Policy explains how AuthenticTeamz ("we", "us", "our") collects, uses, stores, and protects personal data when you use our platform and services (the "Service"). By using the Service, you acknowledge this policy.

If you do not agree with this policy, please discontinue use of the Service.

1. Data Controller and Processor

Which role we hold depends on how you came to be in our systems.

If you use the Service through an organisation — your employer or contracting entity — that organisation is the data controller and AuthenticTeamz is a data processor acting on its instructions.
If you are a candidate invited to apply for a job opening, the organisation considering your application is the controller and AuthenticTeamz is its processor. The invitation page names that organisation and the person accountable for the assessment.
If you contacted us directly through our website enquiry form, there is no client organisation involved and AuthenticTeamz is the controller for that data.
If you created an account yourself, without an organisation or an invitation (for example by signing in with Google or LinkedIn, or with an email address), AuthenticTeamz is the controller for that account. If you later join an organisation, that organisation becomes the controller for your use of the Service from that point on, and AuthenticTeamz becomes its processor. Your existing assessment results do not stay private to you when this happens: they become visible to that organisation's managers and administrators within their scope, in the same way as the results of any other member. Your raw questionnaire answers remain visible only to you. [[OWNER TO CONFIRM: legal basis and wording for AuthenticTeamz as controller of self-serve accounts, and for the change of controller when a self-serve user joins an organisation (Section 3 has no row for self-serve accounts yet)]]

If you have questions about how your data is used within an organisation, contact its account administrator; candidates should use the rights options on their candidacy page. For questions about this policy or AuthenticTeamz's own role, contact us at team@authenticteamz.com.

2. Information We Collect

We collect the following categories of personal data:

Account data: name, email address, authentication credentials, role, team assignment, and profile details you or your administrator provide.
Assessment data: responses you submit to questionnaires, derived personality and behavioural scores, consent records, and completion metadata (e.g. timestamps).
360 peer evaluation data: peer ratings submitted about you or by you as part of 360-degree assessments. Individual peer responses are never disclosed to the person being rated; only aggregated results from a minimum of three respondents are shown.
Manager notes: optional notes added by authorised administrators about your profile or development.
Skills data: hard skills and experience summaries extracted from CVs you choose to upload. The PDF file itself is processed in memory and is not stored; its text content is transmitted once to our AI sub-processor for extraction (see Section 5) and only the extracted skill list and experience summaries are retained.
AI-generated data (only where AI features are enabled): conversation history with the AI assistant, and AI-generated content stored so it can be shown again without re-processing — your Worker DNA summary, and per-team discussion guides and composition risk analyses generated for managers. These features are not active by default. Section 5 describes exactly what data each AI feature processes and why.
Candidate data (where your organisation uses the hiring features): if you are invited to apply for a job opening, we process your name and email address, the CV evidence you provide, your responses to any assessment you are asked to complete, the fit readings derived from them, and the record of the decision taken on your candidacy including the job-related reason given. Before you answer anything, the invitation page sets out who is deciding, what is measured, how long it is kept, and how to object. We do not rank candidates against one another.
Enquiry data: if you contact us through the website enquiry form, we process the email address, company, role, company size, reason for contact and any notes you submit, together with a hashed record of your IP address used to prevent abuse of the form. For this data we are the controller, not a processor acting for a client.
Sign-in data from Google or LinkedIn: if you sign in with Google or LinkedIn, we receive your name, email address and an account identifier (held by our authentication provider, Supabase Auth). Google sign-in uses Google's own button and returns a signed identity token with your name and email address; for LinkedIn we request the openid profile email scopes. We do not use or display your contacts, posts or profile photo. The provider may include a link to your profile picture in what it sends, and our authentication provider may store that link.
Operational data: error logs and performance traces collected via our monitoring tools to maintain and improve the Service.

We do not intentionally collect special categories of personal data (such as health data, political opinions, or biometric data) unless explicitly required for a specific assessment and supported by a clear legal basis.

3. Legal Bases for Processing (GDPR Article 6)

We process personal data only where we have a valid legal basis. The table below sets out the primary legal basis for each category of processing activity.

Processing Activity	Legal Basis (GDPR Art. 6)	Notes
User authentication and account management	Art. 6(1)(b) — Performance of a contract	Necessary to provide access to the Service
Delivery of assessments and generation of reports	Art. 6(1)(b) — Performance of a contract	Core service functionality
Sending transactional communications (invitations, notifications)	Art. 6(1)(b) — Performance of a contract	Required to operate the Service
Access control and role-based data visibility	Art. 6(1)(f) — Legitimate interests	Protecting data subjects and service integrity
Security monitoring and error logging	Art. 6(1)(f) — Legitimate interests	Ensuring platform security and stability
Compliance with legal obligations	Art. 6(1)(c) — Legal obligation	Where required by EU or Portuguese law
AI-assisted features	Art. 6(1)(a) — Consent	Where the feature is enabled for the account; see Section 5, which states per feature what is optional and what is part of the hiring product
Assessing candidates against a job opening	Art. 6(1)(f) — Legitimate interests	Consent is deliberately not used: in a hiring context it would not be freely given. The counterpart is an unconditional right to object, which routes to the prospective employer. See Section 11
Responding to enquiries submitted through the website	Art. 6(1)(f) — Legitimate interests	Answering a request you made to us. We are the controller for this data
Bot protection on public forms	Art. 6(1)(f) — Legitimate interests	Preventing automated abuse of forms open to the public internet

Where we rely on legitimate interests (Art. 6(1)(f)), we have assessed that our interests do not override the fundamental rights and freedoms of data subjects. If you wish to understand more about this assessment, contact us at team@authenticteamz.com.

4. How We Use Your Information

We use personal data to:

Deliver the Service, including generating individual reports and team insights.
Authenticate users and maintain account security.
Send transactional communications such as invitations and system notifications.
Monitor and resolve technical errors and performance issues.
Comply with legal obligations and enforce our contractual terms.

Access within the platform is role-based. Managers and administrators see derived scores and insights — not individual raw questionnaire answers. Raw answers are accessible only to the person who submitted them.

5. Artificial Intelligence Features

Some features of the Service use a large language model to generate text. Each generation happens when a user explicitly requests it (opening the assistant, requesting a summary, pressing "Generate") — no feature runs in the background or on a schedule.

Most of these features are optional and run only where your organisation has enabled AI features for its account. Two are part of the hiring product and run whenever that product is used, because the feature cannot be delivered without them: extracting the requirements from a job description, and reading a candidate's CV to produce a Skills Fit. The table below marks which is which in the "Available to" column.

AI inference is provided by Google (Gemini API), acting as a sub-processor under contractual data protection obligations. Prompts and generated responses are processed to produce the requested output; we use the Gemini API under terms that do not permit the use of data submitted through the API to train Google's models.

What the AI can and cannot access

The platform enforces the following rules for every AI feature, without exception:

Raw questionnaire answers are never sent to any AI model. Prompts are built exclusively from derived results (trait levels, scores, interpretive guides) and aggregates — the same data already visible in the product to the person using the feature.
Individual peer ratings and individual survey responses are never sent to any AI model. Where survey or engagement data is used, only averages that meet the minimum-respondent anonymity threshold (three or more respondents) are included; averages below the threshold are withheld from the prompt entirely.
The AI cannot choose whose data it reads. All data access happens through server-side functions bound to the authenticated user's identity, role, and team, with authorisation re-checked at the point of access. A request made on your behalf can only reach data you are already authorised to see in the product.
AI features are read-only. No AI feature can create, modify, or delete assessment data; the model only produces text.
AI outputs are protected like any other personal data. Stored AI content is subject to the same row-level security and role-based access controls as the rest of the platform, and is deleted together with your account (see Section 8).

The AI features, the data they process, and why

Feature	Available to	Personal data sent to the model	Purpose
AI assistant (chat)	All users, where enabled	Your name, team name, and role; and, only when needed to answer your question: your own derived assessment results, your extracted skills list, the names of your team's members, and derived collaboration guides for your teammates. For managers additionally: aggregate team compatibility summaries and engagement summaries (team averages and per-member averages that meet the anonymity threshold).	Answer your questions about your own results, profile, skills, and team.
Report insights (chat on team reports)	Managers and administrators	The derived team report data displayed on the page being viewed: member names with pair compatibility scores, team role distributions, culture fit percentages, leadership 360 aggregates, or organisation-level health aggregates (individual turnover risk is aggregated before it reaches the prompt).	Summarise the report being viewed and answer follow-up questions about it.
Worker DNA	Each user, about themselves only	Your own derived personality trait levels, top team roles, best-fit task types, and skill names. Never numeric raw scores, never anyone else's data.	Generate a short personal summary of your work style.
Team composition risk analysis	Managers and administrators, for teams in their scope	Team aggregates: average and weakest pair compatibility (with member names), team role coverage and redundancies, culture fit averages, and which members have not completed assessments.	Highlight composition risks in a team the manager already oversees.
Team effectiveness discussion guide	Managers and administrators, for teams in their scope	Anonymised monthly survey averages per effectiveness pillar and participation counts. No individual survey responses, ever.	Produce a guide the manager can use to discuss survey results with the team.
Team Lab (simulations, suggestions, and team builder)	Managers and administrators	Derived compatibility and team role data for people within the manager's authorised scope, as selected in the simulation.	Explain hypothetical team compositions and reassignment trade-offs.
CV skill extraction	Each user, for their own CV; optional	The text content of the CV you choose to upload, transmitted once for extraction. Neither the PDF nor its text is stored by us; only the extracted skills and experience summaries are retained.	Extract your hard skills and experience so they can appear on your profile.
Job requirements extraction	Hiring product; not optional	The text of the job description written by the hiring organisation. No candidate data and no assessment data.	Turn a job posting into a list of requirements the hiring team then reviews, corrects and must justify before the opening accepts applications.
Candidate CV reading	Hiring product; not optional	The text content of the CV a candidate provides for a specific job opening, transmitted once for extraction. Neither the file nor its text is stored; only the extracted skills and experience summaries are retained, and they are used solely for that opening.	Produce the Skills Fit reading for that candidacy.

Stored AI content

Chat conversations, your Worker DNA summary, and per-team discussion guides and risk analyses are stored so they can be shown again without repeated processing. Each item is visible only to the people authorised for the underlying data: your chat history and Worker DNA only to you, and team guides and risk analyses only to that team's managers and administrators. All stored AI content is deleted in accordance with Section 8.

6. Sharing of Information

We share personal data with the following categories of third parties:

Infrastructure and service providers (sub-processors) who help us deliver the Service, under contractual data protection obligations. Our current sub-processors include:
- Supabase — database and authentication (Frankfurt, Germany)
- Vercel — application hosting and compute (Frankfurt, Germany)
- Resend — transactional email delivery
- Sentry — error monitoring and performance tracking
- Google (Gemini API) — AI inference; Section 5 details exactly what data is sent and which features are optional
- Cloudflare — bot protection on our public website forms. Where the challenge is active, your IP address and browser user agent reach Cloudflare. It sets no tracking cookies and performs no cross-site profiling
- Cal.com — meeting scheduling, used only if you choose to book a call with us from our website. The booking page receives the name, email address and any notes carried over from the enquiry form
Sign-in providers you choose — Google (Google Sign-In) and LinkedIn, if you choose to sign in with them. The provider receives the fact that you are signing in to AuthenticTeamz and, under its own privacy policy, may process that information; we receive only your name, email address and an account identifier (see Section 2). On pages that show the Google button, Google's script is loaded from Google, so Google receives your IP address and may use its own cookies to show the button. Signing in with an email address and password, or through your organisation's single sign-on, involves neither provider. [[OWNER TO CONFIRM: whether Google and LinkedIn are described correctly as independent controllers for their own sign-in processing, and the international-transfer position for them in Section 7]]
Your organisation — account administrators and team managers can access derived scores and insights as configured in the product.
Competent authorities — where required by law, court order, or to protect the safety and rights of individuals.

A full sub-processor list is maintained and available on request at team@authenticteamz.com.

We do not sell your personal data.

7. International Transfers

Our primary data infrastructure is hosted in Frankfurt, Germany (EU). Certain sub-processors (Resend, Sentry, Google Gemini, Cloudflare, and Cal.com) may process data in the United States or other regions outside the European Economic Area (EEA). Where such transfers occur, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) as required under GDPR Chapter V (European Commission Decision 2021/914/EU). Transfer Impact Assessments have been completed for US-based sub-processors where required.

8. Retention

We retain personal data for the duration of your organisation's active contract with AuthenticTeamz, plus a post-termination period as specified in the Data Processing Agreement (DPA). Operational logs are retained for up to 90 days. Database backups are managed by Supabase in accordance with the applicable plan.

Upon contract termination or a verified erasure request, we delete account data, assessment responses, derived scores, notes, skill profiles, and AI conversations within 30 days (standard clients) or 7 business days (enterprise clients).

Self-serve accounts

If you created your account yourself, without an organisation, we keep it [[OWNER TO DECIDE: retention period for self-serve accounts, e.g. until deletion by the user or N months of inactivity]]. You can ask us to delete it at any time (see Section 10). If you join an organisation, the retention terms above for that organisation apply from then on.

Candidate data

Candidate data follows a different and stricter clock, because a job application is a closed event rather than an ongoing relationship. Two separate periods run from the moment the opening is closed:

Raw evidence — the CV you provided and your individual assessment answers — is deleted at the end of the shorter period.
Assessment evidence — the fit readings, the inputs they were computed from, and the record of the decision — is deleted at the end of the longer period.

Both periods are set by the law of the country the opening was posted in, are fixed when the opening closes, and are shown to you on the invitation page before you answer anything.

One consequence deserves to be stated plainly. If you ask us to erase your data, the raw evidence goes, but a record of the assessment survives for the remainder of the second period with your name and contact details removed. That record exists so that a later claim of discrimination — yours or anyone else's — can still be answered. It is retained under Art. 17(3)(e) GDPR for the establishment, exercise or defence of legal claims. It cannot be used to contact you or to assess you again, and it is deleted when the period expires.

Enquiry data

An enquiry that does not lead to a business relationship is deleted once it is no longer needed to answer you.

9. Security

We implement technical and organisational measures to protect personal data, including:

Encryption in transit: TLS 1.2+ for all connections between users, our application, and the database.
Encryption at rest: AES-256 encryption managed by Supabase's infrastructure.
Database access controls: Row Level Security (RLS) is enabled on all tables. The browser never connects directly to the database; all reads and writes go through the application server.
Role-based access: data visibility is enforced at account, team, and user levels.
Authentication controls: accounts are created through invitations, shareable links or self-serve sign-up (with email and password, Google or LinkedIn); an optional second factor (two-step verification) is available; organisations can require single sign-on (SSO) through their own identity provider; session cookies are httpOnly, Secure, and SameSite=Lax.

No method of transmission over the internet is completely secure. In the event of a personal data breach, we will notify the relevant controller in accordance with our obligations under GDPR Article 33 (within 72 hours of becoming aware). Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay in accordance with GDPR Article 34, unless an exception applies (e.g. the data was encrypted).

10. Your Rights

Depending on your jurisdiction and circumstances, you may have the following rights under the GDPR and applicable Portuguese law:

Right	Description
Access	Request a copy of the personal data we hold about you (Art. 15)
Rectification	Request correction of inaccurate or incomplete data (Art. 16)
Erasure	Request deletion of your data ("right to be forgotten") (Art. 17)
Restriction	Request that we restrict processing of your data (Art. 18)
Data portability	Receive your data in a structured, machine-readable format (Art. 20)
Objection	Object to processing based on legitimate interests (Art. 21)
Withdraw consent	Where processing is based on consent, withdraw it at any time (Art. 7(3))

Because AuthenticTeamz operates as a data processor in B2B contexts, some rights should be directed to your organisation (the data controller) in the first instance. Where AuthenticTeamz can assist directly, contact us at team@authenticteamz.com. We target a response within 30 days (extendable by a further 60 days for complex requests, with notice).

If you are a candidate, do not rely on email: your candidacy page carries the rights options directly, and a request made there is logged, routed to the organisation considering your application, tracked to completion and escalated if it goes unanswered. Section 8 explains which parts of a candidate record survive an erasure request, and why. Section 11 covers the right to contest a fit reading and to require human intervention.

Right to lodge a complaint: If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Portuguese Data Protection Authority:

Comissão Nacional de Proteção de Dados (CNPD) Av. D. Carlos I, 134 – 1.º, 1200-651 Lisboa, Portugal Website: www.cnpd.pt Email: geral@cnpd.pt

You also have the right to lodge a complaint with the supervisory authority in your country of habitual residence or place of work within the EU/EEA.

11. Automated Decision-Making

AuthenticTeamz does not itself decide anything about you. Every output of the Platform is a decision-support tool, intended to supplement rather than replace human judgment, and the decisions that matter — employment, promotion, team composition — are taken by people at your organisation or the organisation considering your application.

Assessment and team features

Scores, reports, AI summaries, guides and analyses described in Section 5 are produced for a manager or administrator to read and interpret. Nothing in the Platform acts on them.

Candidate assessment

Where an organisation uses the hiring features, the Platform produces fit readings about you in a recruitment context. We treat this as an area requiring safeguards regardless of how Art. 22 is ultimately construed for a given decision, and the following are built into the product rather than promised in this policy:

No ranking. The Platform does not order candidates against one another, does not produce a shortlist, and does not recommend or reject anyone. It produces separate readings a human must weigh.
A named accountable human. Every job opening carries a named person responsible for oversight of the assessment. An opening cannot accept applications without one, and if that person's role lapses the opening's assessment is suspended.
Disclosure before, not after. The full information set, and a separate notice that a high-risk AI system is in use, is served before the first question rather than buried in a policy you would have to seek out.
No consent theatre. We do not ask a candidate to tick a consent box, because in a hiring situation that would not be a free choice. We rely on legitimate interests, and the counterpart is an unconditional right to object, routed to the prospective employer.
A route to contest. You can obtain the reading made about you, contest it, and require human intervention. These requests are tracked to completion and escalate if unanswered.
Monitoring for disparate impact. Outcomes are monitored for patterns that disadvantage a group, with results reported to the organisation running the opening.

If you disagree

If you are a candidate, use the rights options on your candidacy page, which reach both the prospective employer and us. If you are an employee, contact your account administrator. Either way you can also write to team@authenticteamz.com, and you have the right to complain to your national supervisory authority.

12. Cookies and Session Management

The Service uses the following cookies. None of them is used for advertising or tracking.

Session cookie (auth_session) — authenticates and maintains your login session. It is:

httpOnly — not accessible by client-side scripts.
SameSite=Lax — protected against cross-site request forgery.
Secure — transmitted only over HTTPS in production.
Valid for a maximum of 30 days, and invalidated immediately upon logout.

Preference cookies

Language cookie — remembers your interface language. Kept for 1 year.
last_auth_method — remembers only which sign-in method this browser used last (email, SSO, Google or LinkedIn), so we can show it on the sign-in page. It holds no personal data. Kept for 1 year.
theme — remembers whether you chose the light or dark display, or to follow your system setting. Kept for 1 year.

Short-lived sign-in cookies — set only while you are signing in with Google, LinkedIn or your organisation's single sign-on, to complete and protect that sign-in:

g_nonce and social_tx — valid for at most 10 minutes.
sso_tx — set only during enterprise SSO sign-in; valid for at most 10 minutes; httpOnly and SameSite=Lax.
pending_social — holds a temporary sign-in token for up to 15 minutes, while you complete the welcome screen for a new social account.

On pages that show the Google button, Google's script is loaded from Google, which receives your IP address and may use its own cookies to show the button (see Section 6). [[OWNER TO CONFIRM: whether the language, last-used-method and theme cookies need to be classed as strictly necessary / functional for ePrivacy purposes, and whether a consent banner is required for the Google script]]

We do not use third-party advertising or tracking cookies.

13. Children's Privacy

The Service is intended for use in professional B2B contexts and is not directed at individuals under 16 years of age (or the applicable minimum age under local law). We do not knowingly collect personal data from minors.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date and, where changes are material, notify affected parties in accordance with our contractual obligations. Continued use of the Service after such changes constitutes acceptance where permitted by law.

15. Contact

For all privacy-related enquiries, requests, or complaints, please contact us:

Purpose	Contact
General enquiries & privacy requests	team@authenticteamz.com
Data breach notifications (to AuthenticTeamz)	team@authenticteamz.com
Sub-processor list requests	team@authenticteamz.com
Supervisory authority (CNPD)	geral@cnpd.pt / www.cnpd.pt

Privacy policy