Privacy Policy

Your Talent Pipeline is a succession and promotion-readiness application used by companies to plan who is ready for the next role at each of their locations. This policy explains what personal data flows through it, who is responsible for it, who else processes it, how long it is kept, and how to exercise rights over it.

1. Two different relationships

Most of the personal data in Your Talent Pipeline is about a customer's employees, and the customer decides what goes in and who may see it. For that data the customer organization is the controller and GroupWork LLC is the processor: we hold and process it on the customer's documented instructions and for no other purpose. We do not use it to build profiles, we do not use it to train models, and we do not sell or share it.

A smaller set of data is about the person holding a login — their email address, their name, their sign-in activity. For that, GroupWork LLC is the controller.

If you are an employee whose record appears in Your Talent Pipeline and you want to see, correct or remove it, your employer is the right first contact. We will support them in answering you, and Section 9 explains what to do if that route is not available to you.

2. Who we are

Your Talent Pipeline is published by GroupWork LLC, a Michigan limited liability company (“we”, “us”).

GroupWork LLC
2222 W. Grand River Ave Ste A
Okemos, MI 48864
United States
privacy@groupwork.cloud

3. What the application holds about tracked people

The record is deliberately narrow. A person tracked in a pipeline has:

• Identity within work — first and last name, the location they are assigned to, their level on the customer's ladder, and optionally an employee identifier if the customer chooses to use one.
• Readiness and assessment — how ready they are for the next role, a rating on the customer's talent grid, whether anything on file would block a promotion and the detail behind that, notes on what is holding them back and what is being done about it, follow-up dates.
• Retention-risk assessment — where the customer uses it, an indication that the person may be at risk of leaving, and notes about it. This is treated as a separately permissioned category inside the application.
• Relocation willingness — which locations, if any, the person would move to.
• Optional attachments — a photograph, and assessment documents in PDF form, where the customer chooses to use them.
• Lifecycle events — promotions, transfers and removals, with the date.

It does not hold home addresses, personal phone numbers, personal email addresses, date of birth, government identifiers, compensation, benefits, disciplinary files or performance-review history. That is a design constraint of the product, not a setting.

What a customer actually enters is the customer's decision. Customers are responsible for having a lawful basis for the data they put in, for telling their employees about it, and for not entering categories of data the product is not designed to hold.

4. What we hold about people who sign in

• Account data — email address, display name, and a password handled by our authentication provider. We never store a readable password.
• Position in the organization — where an account sits in the customer's structure and which permission set it has, which is what determines what it can see.
• Activity record — edits are recorded with the account that made them, the time, and which fields changed, so a customer can answer “who changed this”. For the sensitive categories the record deliberately holds field names and not values. Read access is not currently recorded.
• Technical error reports — when the application hits an unexpected error, a technical report (the error, its stack trace and the addresses of the application's recent requests) is sent to Sentry so we can fix it. It carries your account identifier — a random ID, never your name or email — so we can tell whether one person or many hit the same problem. It carries no pipeline content.
• Support tickets — if you are signed in, you can send us a ticket from Support → Report a Problem. A ticket contains what you write, the category you pick, anything you attach, your account ID, and — if you leave them switched on — your name and email. It also carries a technical report about the application: its version and which update is running, your device model and operating system, screen and text size, light or dark setting, language and time zone, whether you were online, on Wi-Fi or mobile data and whether the internet was reachable, your last sign-in event and how long it has left, your last 50 requests to our servers and up to 50 from the application's previous run if it was within 6 hours (for each: which kind of record or service it reached, whether it succeeded, how long it took and a short error type — never the address, what was searched for, or what was sent or received; this list stays on your device until a ticket or an automatic crash report is sent), how many of your edits were waiting to save and how your last saves went (the kind of record and the outcome, never the person, the field or the value), how long the current session has lasted (a new one starts when a different person signs in) and a random ID for it, the names of the screens you visited recently (never what was on them), your organization's ID, what your role there lets you do and whether you are an application administrator, how many organizations you belong to and how many locations and people your Pipeline view covers (numbers, never names), recent error messages, and the ID of the last error report the application sent. Photos you attach are sent without their location or other embedded details, but what a screenshot shows is sent as it is — a screenshot of a Pipeline board carries the people on it. Videos and other files are sent exactly as they are, including any location they carry. To help us respond, each ticket is read by an AI assistant (Anthropic's Claude; see Section 6).
• Reports from the sign-in screen — if you cannot sign in, the sign-in screen can send us a report without an account: what you write, an email address for a reply (the one typed on the sign-in screen is filled in, and can be cleared), and the same technical report without the error-report ID, which then carries no account details. Our server uses your network address to limit how many reports it accepts; the report itself does not store it, though our hosting provider's request logs record it, as they do for every request. These reports are kept and handled like any other ticket.
• Automatic crash reports — if the application crashes while you are signed in, it files a support ticket on its own carrying the same technical details a ticket you send would (the error, the app version, and your device model and settings). When it can send the report straight away it tells you on screen; offline, it sends it later. You can turn this off under Settings → Automatic Diagnostic Reports. Error text is scrubbed of tokens and addresses, but a technical message can still contain an identifier a server sent back.
• Advanced Analytics — to troubleshoot a problem someone has reported, one of our support administrators can turn on Advanced Analytics for that person for a set window of up to 24 hours. While it is on, the person sees an indicator in the app and can turn it off themselves at any time. It records only while the app is open on their screen, for at most 30 minutes each time they open it, on every device they are signed in on. It records which part of the application each request reached, whether it worked, how long it took and how many records it returned or changed; which screens were visited; how much data a file transfer moved and how fast the connection was; how far each save got; whether the device was online and on Wi-Fi or mobile data; and, when something failed, the kind of failure and the error code. It never records the screen, anything typed, or the names, notes or ratings in your records. The recording is kept for 30 days and then deleted; a record that it was turned on — for whom, by whom and when it ended — is deleted 30 days after the window ends. It is read only by our support administrators and, when a ticket refers to it, by the support tools listed in Section 6. One of our support administrators can also record their own device the same way, for up to 24 hours; that only ever records the administrator’s own account, never yours.
• Invitations, including to people without an account — when an administrator invites someone, we email that address an invitation, and at most one reminder, from invites@yourtalentpipeline.com. It says who sent it, the organization, location and role, and when it expires, with a link to accept. Replies go to the person who sent it. Once the invitation is accepted, withdrawn or expires, the copy of the email and the sender’s reply address are cleared; the invitation itself stays in the organization’s history. Every invitation email has a link to stop them: using it stops invitation emails to that address from every organization. So that the request is honoured, we keep a one-way fingerprint of the address (not the address itself) from the first email we send to it, and the date it opted out, for as long as the service runs.
• Product analytics — the app records which features and screens are used, with your platform and app version, under your account identifier, and sends it to PostHog so we know what to improve. It never receives your name, your email, or anything in a pipeline — no names, ratings or notes. It is not used for advertising. On the web application it keeps its identifier in browser storage, not a cookie.
• Notifications on your phone — if you allow notifications, the app registers your device to receive them and we keep that device’s notification address until you sign out, delete your account, or it stops working. A notification says who it is about and what happened (for example, “Jordan Lee promoted”), and it can show on your lock screen; your phone’s settings control whether it does. It is delivered through Expo and through Apple or Google.
• Terms agreement — when you agree to our Terms of Service in any GroupWork app, we record which version you agreed to, in which app, and when. It is kept with your account so another GroupWork app does not ask you again, and it is deleted when you delete your account.

One sign-in across applications. Your Talent Pipeline uses the same account system as other applications published by GroupWork LLC, so one set of credentials works across them. Your email address and display name are shared by that account system; the data inside each application is not. Being able to sign in does not grant access — access to Your Talent Pipeline is entitled separately, per account. Because of that, deleting your account deletes it in every one of those applications (Section 7).

5. This website

This marketing website (yourtalentpipeline.com) sets no cookies, runs no analytics and loads no third-party scripts — it carries no JavaScript at all. Our hosting provider (Cloudflare) processes standard request metadata (IP address, user agent, requested URL) to serve pages and defend against attack, and its platform reports network-level connection errors back to itself. An IP address is personal data, and we are not pretending otherwise — the point is that none of it is joined to an account, used to identify or profile a visitor, or retained by us.

The application itself (app.yourtalentpipeline.com) sets no advertising cookies and carries no cross-site tracking. It stores your session, and the product-analytics identifier described in Section 4, in your browser so you stay signed in.

6. Who else processes the data

Personal data is processed only by the providers below, acting on our behalf. We do not sell data, and we do not share it for advertising. We disclose it otherwise only where legally required.

We will update this list before adding a sub-processor that processes customer personal data.

7. How long it is kept

• Active records are kept for as long as the customer's organization is active and the record is in the pipeline.
• Removed people are taken out of every view immediately and move to an archived list that an administrator can restore from, so an accidental removal is not final.
• Promotion counts survive the individual record as counts, without identifying anyone, so a location's history is not rewritten by turnover.
• The activity record is retained for the life of the customer organization, and entries survive the deletion of the person they refer to — an accountability record that vanishes with its subject is not one. A customer can ask us to purge it sooner.
• Account deletion is available from the account screen and carries a 30-day recoverable window before permanent erasure. One account works across GroupWork LLC’s applications, so this deletes it in all of them; to stop using only Your Talent Pipeline, ask your organization’s administrator to remove your access. Support tickets are the exception below.
• The invitation-email opt-out list keeps a one-way fingerprint of an address that asked not to be emailed, for as long as the service runs, because forgetting it would mean emailing that person again.
• Support tickets are kept while we work on them and as a history of what was reported and fixed. They are not deleted with your account: they keep what you wrote, anything you attached, the technical report, and the name and email they were sent with. Email privacy@groupwork.cloud to have yours deleted.
• Advanced Analytics recordings are deleted after 30 days, and the record that it was turned on — for whom, by whom, and when it ended — 30 days after that window ends.
• Backups are the exception, and we would rather say so than imply otherwise. A nightly database backup is taken and kept for 30 days; beyond that, one snapshot per calendar month is retained indefinitely for disaster recovery. A record deleted from the live database therefore persists in a monthly snapshot taken before the deletion. Backups are never used to serve the application or to restore a single record; they exist only to rebuild the whole database after a loss. If you need a deletion propagated into backups, ask us and we will tell you honestly what is possible.

When a customer organization ends its relationship with us, its data is deleted or returned on request, per the Terms.

8. If something goes wrong

If we become aware of a security incident affecting personal data we hold, we will notify the affected customer organization without undue delay and within 72 hours of becoming aware, with what we know at the time: what happened, which data and roughly how many people are affected, what we are doing about it, and what we recommend the customer do. We will keep the customer updated as we learn more, and we will support them in meeting their own notification obligations. We will not wait until an investigation is complete to make the first notification.

Report a suspected problem to questions@groupwork.cloud.

9. Rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, and to receive it in a portable form.

• If your record is in a customer's pipeline, ask your employer — they control that data. If you cannot reach them, or they do not respond, contact us at privacy@groupwork.cloud and we will route it and assist the controller.
• If it is about your login — your email, your name, your sign-in and activity record — contact privacy@groupwork.cloud directly.

We do not charge for this, and we do not require an account to ask. For requests about your own login data we will respond within 30 days. For a request about a record in a customer's pipeline, we will acknowledge you within 30 days and route it to that customer — the decision is theirs to make, because the data is theirs.

10. Security

Traffic runs over TLS; data at rest on our servers is encrypted by our providers; photographs and documents are served only through short-lived links re-checked against the requester's permissions; and who may see which categories of information is enforced in the database rather than in the interface. The Security page sets this out in full, including what we do not claim.

A copy is kept on your device. So that the application opens immediately and keeps working when you have no signal, it saves the most recent copy of the screens you have opened — which includes the names, readiness ratings and notes those screens show — into the application's own storage on your phone or browser. This is a copy of information the server has already sent you; it is not shared with anyone new.

That copy is protected by your device's own protection of application storage, and it is not separately encrypted by us. It is tied to the signed-in account and is erased when you sign out or switch organisations, and the next time the app opens after going unused for 30 days. One exception is deliberate: changes you have made that have not yet reached the server are kept until they do, because deleting them would throw away your work. On a shared device, sign out when you are finished.

11. International transfers

Data is stored and processed in the United States. If you are in a region whose law restricts transfers out of it, tell us before you load data — we would rather say what we can and cannot support than have you find out afterwards.

12. Children

This is a workplace application, not directed to children, and it should not be used to hold records about anyone under 16.

13. Changes

If this policy changes materially we will update the effective date above and notify customer organizations. Continued use after a change means the updated policy applies.

Last change, effective 2 October 2026: we now email invitations directly, including to people who do not yet have an account, and keep an opt-out list so anyone can stop them; error reports carry your account identifier; the app records which features are used (PostHog), never what is in a pipeline; the app can send notifications to your phone; deleting your account deletes it in every GroupWork LLC application; and the copy kept on your device is erased when the app next opens after 30 days unused. See sections 4–7 and 10.

14. Contact

Privacy questions and data requests: privacy@groupwork.cloud.
Everything else: questions@groupwork.cloud.
By post: GroupWork LLC, 2222 W. Grand River Ave Ste A, Okemos, MI 48864, USA.