Privacy policy

1. Who is responsible for what

For account data (your name, work email, sign-in), the controller is ZENTHORIA LLC (Limited Liability Company), 30 N GOULD ST STE R SHERIDAN, WY 82801, EIN 98-1940299. Contact for any personal-data question: contact@zenthoria.tech.

For the workforce data a customer imports (information about its employees), the customer — the employer — is the controller and ZENTHORIA LLC acts as its processor: we process this data only on the customer's behalf and instructions, to provide the Service.

2. Data processed

• Account: name, work email, password (stored only as a scrypt hash, never in clear text) and role in the workspace (owner, admin, HR analyst, viewer).
• Workspace: organization name, settings (proficiency scale, thresholds), members and invitations.
• Workforce data you import: employee identifier and name, department, team, role, location, manager, hire date, status, skills with their level, assessment date and source, role requirements and planned future needs.
• Audit log: user, action performed (sign-in, import, opening of an individual profile, export, report, setting or member change), object concerned and timestamp. IP addresses are not recorded in it.
• Technical data: a session cookie and a language cookie (see the Cookies page). IP addresses are used in memory, temporarily, to limit abusive sign-in, sign-up and import attempts; they are not stored.

Imported files are validated and read, then not kept: the staged copy of an import is deleted as soon as you confirm or discard it, and an abandoned one is purged after 24 hours. Demo workspaces contain synthetic data only.

Please do not import special categories of data (health, union membership, beliefs, origin…) or evaluations of personal character: Competivora only needs skills, levels and role requirements.

3. Purposes and legal bases

• Provide the Service (account management, skill-gap analysis, reports) — performance of the contract with you or your organization; for workforce data, the legal basis is determined by the customer as controller.
• Secure the Service (access control, audit log, abuse limitation) — legitimate interest.
• Answer your requests and those of the authorities — legitimate interest and legal obligations.

We do not sell data, do not use it for advertising and do not use your workforce data to train artificial-intelligence models.

4. No automated decisions about people

Competivora compares skills with role requirements to show operational gaps. It makes no decision with legal or similarly significant effects on a person and does not assess anyone's overall value: individual views speak of strengths and development opportunities, and organisation-level views speak of skill concentration and operational dependency. Recommendations are suggestions to review by a human.

• Individual employee profiles are visible only to HR analysts, admins and owners; viewers see aggregated results only.
• Each opening of an individual profile is recorded in the audit log.
• Data exports and the executive report contain aggregated figures only.

5. Customer responsibilities (employer)

As controller of the workforce data, the customer is responsible in particular for:

• having a valid legal basis and a legitimate purpose for the analysis;
• informing the people concerned and, where the law requires it, consulting staff representatives;
• carrying out an impact assessment when the law requires it;
• importing only the data needed (data minimisation) and keeping it accurate;
• answering the requests of its employees to exercise their rights.

6. Our commitments as processor

• process workforce data only on the customer's documented instructions (the use of the Service);
• ensure that the people authorised to access it are bound by confidentiality;
• apply the security measures described below and notify the customer of a personal-data breach without undue delay;
• help the customer answer data-subject requests and meet its obligations, as far as the Service allows;
• delete the data at the end of the Service, as described under retention;
• make available the information needed to demonstrate compliance and allow reasonable audits.

A data-processing agreement can be requested at contact@zenthoria.tech.

7. Artificial intelligence

By default the AI Workforce Skill Analyst is deterministic: answers are built only from the stored data and no data leaves the server.

If the operator of the Service enables the optional wording layer with a third-party language model (Anthropic), the question and the aggregated findings already computed for the answer (skill, role and team names, counts and percentages — not employee records) may be sent to it to rephrase the headline; the result is discarded if it adds a figure that is not in the findings. It is off by default.

8. Recipients, sub-processors and transfers

Data is accessible to the members of your organization according to their role and, for technical operation, to the publisher's authorised staff.

• Hosting: the infrastructure chosen by the operator of the Service.
• Language-model provider (Anthropic): only if the optional function described above is enabled.

ZENTHORIA LLC is established in the United States. When data is processed outside the European Economic Area, the transfers are framed in accordance with the applicable regulation (for example standard contractual clauses).

9. Retention

• Account, workforce data and audit log: kept as long as the workspace exists.
• Workspace owners and admins can delete all workforce data at any time from Settings; owners can delete the whole workspace, including members and the audit log.
• Sign-in sessions: 14 days. Invitation links: 7 days. Password-reset links: 60 minutes. Email-confirmation links: 24 hours.
• Demo workspaces: deleted automatically after 6 hours.
• Backups: the database is copied regularly for disaster recovery. Data you delete disappears from the live service immediately and from backups within 14 days.

10. Security

• Strict isolation of each organization's data on every request.
• Role-based access control and an audit log of sensitive actions.
• Passwords hashed with scrypt, HTTP-only SameSite session cookies, rate limiting of sign-in attempts, strict content-security policy.
• Uploaded files are validated by content (type, size, macros, compression bombs) before being read.

No system is infallible: we recommend unique passwords and sharing access only with authorised people.

11. Your rights

Where the applicable regulation (in particular the GDPR) applies, you have the right to access, rectify, erase, restrict, object to and port your data. For account data, write to contact@zenthoria.tech. For workforce data, contact your employer, who is the controller; we will help them answer you.

You may lodge a complaint with the competent data-protection authority (in France: the CNIL, www.cnil.fr).

12. Audience

The Service is intended for professionals. It is not intended for minors.

13. Changes

This policy may change; the date of the last update is shown at the top of the page. Important changes are announced in the application.