Privacy Policy

1. Introduction

Impact Plan ("we", "us") provides software that helps managers record what they expect from the people who report to them, keep evidence of what those people have done, and maintain growth plans and performance records. This policy explains what personal data we collect, why, and what rights you have over it.

The data controller is [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS]. You can reach us at [email protected].

Where your employer has an account and has added you to it, your employer is the controller of the records they keep about you inside the service, and we act as their processor. This policy still describes how we handle that data, but requests about the content of your records are best directed to your employer in the first instance.

2. Information we collect

We collect only what the service needs to work.

• Account data. Your name, email address, and — if you sign in with Google — your Google account identifier. We never receive your Google password.
• Company data. Your company's name, its offices, roles, teams and reporting relationships.
• Work records. Achievements, expectations and assessments, growth plans, skills, check-ins, agreements, goals, praise and timeline entries — written by you, by your manager, or by your colleagues.
• Technical data. IP address, browser type and timestamps, kept in server logs for security and troubleshooting.
• Audit records. A log of write actions with the acting account and a timestamp, which is what makes a record explainable after the fact.

We do not track activity, working hours, keystrokes, screen contents or location. Nothing in the service is collected automatically from your work — every record was written by a person.

3. How we use your information

• To provide the service: rendering your records, computing growth plans, and routing approvals.
• To authenticate you and keep accounts and companies isolated from one another.
• To send transactional email you have asked for, such as password resets.
• To generate AI suggestions, as described in section 5.
• To diagnose faults and protect the service against abuse.

We do not sell personal data, and we do not use your content to train our own models or anybody else's.

4. How we share your information

Within your company, visibility follows the permissions your company has set. As a rule:

• Your manager can see your expectations, assessments, growth plan, evidence and check-ins.
• You can see everything your manager records about you. There is no hidden file.
• Colleagues see only what is explicitly shared, such as praise marked visible to everybody.
• Data is never shared between companies. Company isolation is enforced in every query.

Outside your company, we share data only with service providers that are necessary to run the product: our hosting provider, our email provider, and the AI provider described below. Each is bound by a data processing agreement. We will also disclose data if legally compelled, and will tell you unless we are forbidden from doing so.

5. AI processing

Some features send text you have written to a third-party language model: drafting expected behaviours for a role, and suggesting which skills and behaviours a piece of evidence relates to.

• Only the text needed for that request is sent, and it is sent at the moment you ask for a suggestion.
• Our providers are contractually prohibited from training on the content we send them.
• AI output is always a suggestion. It never rates, ranks or assesses a person, and no decision about anybody is made automatically.

6. Data retention

We keep your records for as long as your company's account is active, because a growth record loses most of its value if it is truncated. When an account is closed we delete or anonymise personal data within 90 days, except where we must keep it longer to meet a legal obligation. Server logs are kept for 30 days.

7. Security

Data is encrypted in transit with TLS and at rest. Passwords are hashed and never stored in a recoverable form. Access to production data is limited to the people who need it to operate the service, and every write action is recorded in an audit log. Backups are encrypted and stored separately from the primary database.

No system is perfectly secure. If a breach affects your data we will tell you and the relevant supervisory authority without undue delay.

8. Your rights

Under the GDPR and comparable laws you have the right to:

• Access the personal data we hold about you, and receive a copy of it.
• Have inaccurate data corrected.
• Have your data erased, where we are not required to keep it.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent, where processing relies on consent.
• Complain to your local supervisory authority.

Write to [email protected] and we will respond within 30 days. Where your employer is the controller, we will pass the request on to them.

9. Cookies

We use cookies that are strictly necessary for the service to function: keeping you signed in, and remembering which company you are currently working in. We do not use advertising cookies or third-party trackers.

10. International transfers

Our infrastructure is hosted in the European Union. Where a service provider processes data outside the EEA, the transfer is covered by the European Commission's standard contractual clauses.

11. Children's privacy

The service is for use by people in employment and is not directed at children. We do not knowingly collect data from anyone under 16.

12. Changes to this policy

We will update this page when our practices change, and will change the date at the top. If a change materially affects your rights we will tell account holders by email before it takes effect.

13. Contact us

Questions about this policy or about your data: [email protected].