Privacy Policy

Pivotal Learn is an internal training platform operated by [Pivotal legal entity](“Pivotal”, “we”, “us”). This notice explains how we handle the personal data of the people who use it — our staff and authorised team members. Pivotal is the data controller.

1. What we collect

• Account details: your name, work email, team, and role.
• Sign-in credentials: your password, stored only in encrypted (hashed) form.
• Training activity: courses assigned to you, lesson progress, quiz answers and scores, completions, and a log of related actions with timestamps.
• Technical data: IP address and basic device/browser information, collected by our hosting and video providers to deliver the service securely.

2. Why we use it, and our legal basis

We use your data to give you access to training, track completion and mandatory-training compliance, and administer accounts. Our legal basis is our legitimate interests in running Pivotal and keeping our team trained, our relationship with you as a member of the Pivotal team, and — for required training — compliance with our legal obligations.

3. Who we share it with

We use a small number of trusted providers who process data on our behalf:

• Supabase — database and authentication (EU region).
• Cloudflare Stream — secure video hosting and playback.
• Resend — sending account and password emails.
• Vercel — application hosting.

We do not sell your data or use it for advertising.

4. Where your data is stored

Your account and training records are hosted in the European region (London). Where a provider processes data outside the UK/EU, appropriate safeguards (such as Standard Contractual Clauses) apply.

5. How long we keep it

We keep your data for as long as you have an account, and for up to [24 months] afterwards for training and compliance records, after which it is deleted or anonymised.

6. Your rights

You can ask us to access, correct, delete, restrict, or port your data, or object to our use of it. To exercise any of these, contact [privacy@pivotal.earth]. You also have the right to complain to the Information Commissioner’s Office or your local data protection authority.

7. Cookies

We use only strictly necessary cookies to keep you signed in. We do not use advertising, analytics, or tracking cookies, so no cookie banner is required.

8. Security

Data is encrypted in transit (HTTPS), passwords are hashed, and access is restricted by role-based controls, so you see only your own records and administrators see only what they need.

9. Contact

Questions about this notice or your data: [privacy@pivotal.earth], [Pivotal legal entity], [registered address].