Privacy at the core
We build privacy and transparency into Team-Buddy, with clear choices over profile sharing and AI preferences. Here is how we manage your data and apply safeguards informed by GDPR and EU AI Act guidance where relevant.
Know what you share, how it is used and which choices are yours. We explain the controls available in the app, the scope of each safeguard and the reasons some records may need to be kept—so you can make informed decisions.
Reviewed 26 October 2026
See the safeguards in place, where each one applies and any further review needed for particular uses. The status labels make that scope clear.
| Framework | Action | What this means | Status |
|---|---|---|---|
| GDPR | Restrict profile access | Ownership and permitted sharing govern profile and Team Space access; you can hide profile sections. Authorised account administrators can see names, surnames and email addresses for account management. Private performance reviews remain subject to team-role permissions; service-admin status alone does not grant access. | In place |
| GDPR | Export account data | The authenticated Account control downloads a JSON copy that includes owned Journeys, coaching and action plans, authorised projects, calendar events and milestones, and readable performance reviews. Availability does not depend on plan tier. | In place |
| GDPR | Record terms and honour AI choices | Account terms acceptance is recorded. A Declined AI preference blocks processing; an unset preference may allow it after terms acceptance. Some features require additional consent. | In place |
| GDPR | Reduce identifiers sent to AI | Shared outbound checks remove common identifiers, and supported workflows use request-scoped person references. New Personal Journey and Team Manager Journey summaries store references with authenticated, encrypted local name mappings; authorised responses restore names. Older analyses have not been retroactively rewritten. Pseudonymisation reduces exposure but does not guarantee anonymity. | Applied with a defined scope |
| GDPR | Provide confirmed account erasure | Account deletion requires explicit confirmation. Shared-work and lawful audit records may remain; purpose-limited post-deletion abuse-prevention records have a three-year expiry. Legacy records await a reviewed migration. Access and portability processes remain subject to operational review. | Applied with a defined scope |
| GDPR | Limit post-deletion abuse records | New records use purpose-separated keyed matches for email or phone, not copied names or raw contact details, and retain the existing three-year expiry. Legacy rows remain until a reviewed migration; pseudonymous matching data is still personal data. | Applied with a defined scope |
| GDPR | Protect data sent to service providers | Hosting, payment, email and AI services can process data needed to operate Team-Buddy. We do not sell personal data or share it for third-party advertising. AI workflows reduce common identifiers. This status covers technical safeguards, not a completed legal review of provider agreements, retention or international transfers. | In place |
| EU AI Act | Record human review of AI results | In Role Fit, job matching, Match Lab, Team Match and team analysis, people can record whether they used a result as one input, changed it before use, or did not use it. AI does not make the app’s final decision. This record supports transparency; it does not establish the system’s legal classification or compliance. | In place |
| EU AI Act | Human-led scoring with AI assistance | Scoring draws on information provided by users and human-defined calculation rules. In some workflows, AI also assesses evidence or contributes a score to support complex analysis. Supported AI workflows minimise direct identifying details before processing. Results support people's judgement: users review the information and retain the final choice. This status covers the safeguards described here, rather than a blanket legal compliance claim. | Applied — defined scope |
| Assessment quality | Document AI governance and human oversight | Team-Buddy documents AI and privacy safeguards and expects human review of consequential decisions. This describes internal governance, not an external certification, business associate agreement or conformity assessment. | Applied with a defined scope |
Ownership and permitted sharing govern profile and Team Space access; you can hide profile sections. Authorised account administrators can see names, surnames and email addresses for account management. Private performance reviews remain subject to team-role permissions; service-admin status alone does not grant access.
The authenticated Account control downloads a JSON copy that includes owned Journeys, coaching and action plans, authorised projects, calendar events and milestones, and readable performance reviews. Availability does not depend on plan tier.
Account terms acceptance is recorded. A Declined AI preference blocks processing; an unset preference may allow it after terms acceptance. Some features require additional consent.
Shared outbound checks remove common identifiers, and supported workflows use request-scoped person references. New Personal Journey and Team Manager Journey summaries store references with authenticated, encrypted local name mappings; authorised responses restore names. Older analyses have not been retroactively rewritten. Pseudonymisation reduces exposure but does not guarantee anonymity.
Account deletion requires explicit confirmation. Shared-work and lawful audit records may remain; purpose-limited post-deletion abuse-prevention records have a three-year expiry. Legacy records await a reviewed migration. Access and portability processes remain subject to operational review.
New records use purpose-separated keyed matches for email or phone, not copied names or raw contact details, and retain the existing three-year expiry. Legacy rows remain until a reviewed migration; pseudonymous matching data is still personal data.
Hosting, payment, email and AI services can process data needed to operate Team-Buddy. We do not sell personal data or share it for third-party advertising. AI workflows reduce common identifiers. This status covers technical safeguards, not a completed legal review of provider agreements, retention or international transfers.
In Role Fit, job matching, Match Lab, Team Match and team analysis, people can record whether they used a result as one input, changed it before use, or did not use it. AI does not make the app’s final decision. This record supports transparency; it does not establish the system’s legal classification or compliance.
Scoring draws on information provided by users and human-defined calculation rules. In some workflows, AI also assesses evidence or contributes a score to support complex analysis. Supported AI workflows minimise direct identifying details before processing. Results support people's judgement: users review the information and retain the final choice. This status covers the safeguards described here, rather than a blanket legal compliance claim.
Team-Buddy documents AI and privacy safeguards and expects human review of consequential decisions. This describes internal governance, not an external certification, business associate agreement or conformity assessment.
These official references inform our approach. This is a practical guide to safeguards, not independent certification or legal advice. Applicable requirements depend on intended use, agreements and operating practices.