Privacy policy

Data controller

The service is published by the author of PMM Skillmap, who can be reached at mthsgpro@gmail.com for any question about your data.

Data we collect

We only collect what the service needs to work:

• Account: your email address, plus the name and avatar Google sends when you sign in. We do not access anything else in your Google account.
• Profile: the display name, role and seniority you enter, and your interface language.
• Assessment: your answers, the evidence and notes you write, your snapshots, badges, quests and XP.
• Team: if you join or create a team workspace, your membership in that workspace and the comments exchanged with your manager.
• Usage: clicks on recommended resources and aggregated audience metrics (page views, events), with no advertising tracking cookie.

Purposes

• Signing you in and keeping your account secure.
• Computing and displaying your skills map, your progress and your recommendations.
• Letting you share a map publicly when you create a share link, and with your manager inside a team workspace.
• Sending transactional emails: welcome, invitations, reminders, and one progress digest after six months of inactivity.
• Producing usage statistics and anonymised benchmarks (no individual data is exposed below a threshold of 25 users).

Legal basis

Processing relies on the performance of the service you requested by creating your account, and on our legitimate interest in improving the product and measuring its audience. You can withdraw at any time by deleting your account.

Processors and hosting

Your data is processed by providers acting on our behalf:

• Supabase: database and authentication.
• Vercel: application hosting and audience metrics.
• Google: authentication through "Sign in with Google".
• Resend: transactional email delivery.

Sharing and visibility

• By default, your map is visible only to you.
• If you create a public share link, anyone with the link can see that map. You can revoke the link at any time.
• If you join a team workspace, your manager and the authorised members of that workspace can see your map and your progress.
• We never sell or rent your data to third parties.

Retention

Your data is kept as long as your account exists. Deleting your account, available in settings, permanently erases your answers, snapshots, badges, share links and profile. Revoked share links and expired invitations are disabled immediately.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, and the right to object. Most of these rights can be exercised directly in the app (settings, account deletion). For anything else, write to the address above. You may also lodge a complaint with your data protection authority.

Cookies

We only use strictly necessary cookies: the ones that keep you signed in. Audience metrics are collected without cookies or persistent identifiers.

Security

Data is encrypted in transit and at rest. Database access is isolated per user (row level security): each person can only read their own data or what has been explicitly shared with them.

Changes

This policy may evolve with the product. The last update date is shown at the top of the page; for significant changes we will let you know by email or in the app.