Welcome to M360 Compass. Your privacy is of paramount importance to us. This Privacy Policy aims to inform you in full transparency about how we collect, use, share and protect your personal information when you use our platform and services.
1. Collection of information
We collect different types of information to ensure the proper functioning and continuous improvement of our services:
- Account and profile information: name, first name, email address, position, department and others professional details required to create and manage your account.
- Evaluation data: responses, comments, notes and self-assessments within the processes performance evaluation. This data is essential to the operation of M360 Compass.
- Usage data: information about how you interact with the platform (pages visited, duration of sessions, features used).
- Technical information: IP address, browser type, operating system and other necessary metadata to safety and performance.
2. Use of your information
The information collected is used to:
- Providing the service: operate and maintain platform functionality, generate reports and ensure evaluation management.
- HR analyzes and summaries: produce analysis reports, identify strengths and areas of development, and support professional growth within your organization.
- Communication: send you notifications, reminders or updates related to your account and your reviews.
- Improvement and customization: understand user needs to optimize the experience and develop new relevant features.
- Security: prevent fraud, abuse and security incidents, and ensure regulatory compliance.
3. Sharing and disclosure of information
We treat your data with the highest level of confidentiality. Sharing is limited to the following cases:
- Within your organization: Assessment results are shared only with authorized individuals (managers, HR, etc.) according to the parameters defined by your company.
- Service Providers: hosts, analysis tools and infrastructure providers, all subject to contractual agreements confidentiality and comply with applicable security standards.
- Legal requirements: disclosure in the event of a legal obligation or valid request from a competent governmental authority.
We never sell, rent or monetize your personal data to third parties.
4. Security of your data
We apply enterprise-level security standards:
- Encryption of data in transit (HTTPS/TLS 1.2+) and at rest (AES-256).
- Restricted access policies (Row-Level Security) and multi-factor authentication for administrators.
- Regular security audits and continuous monitoring of our systems.
- Application data hosted at Canada via Supabase; application layer and diffusion via Vercel (distributed network) with geographic firewall (Canada/United States).
Accommodation and infrastructure
M360 Compass is operated on Vercel, a distributed network known for its reliability and security (TLS 1.2+). Firewalls limit access to traffic from the Canada and United States. Application data (profiles, evaluations, permissions) are stored at Supabase at Canada with policies Row Level Security (RLS).
Statistical data and cookies
Audience analyzes of the main site (m360compass.com) are carried out via Google Analytics, configured to limit collection and apply IP address anonymization when available. For the application we use Umami, an analysis solution cookieless which does not place any cookies or collect any personal identifiers.
4.1 Data localization
All personal data and application metadata are stored on servers located at Canada. Certain technical metadata (aggregated logs, telemetry, network security) may temporarily pass through servers at United States to ensure performance and availability. No personal data is transferred to other jurisdictions without an adequate legal framework.
5. Data retention
Data is retained for as long as necessary to achieve the purposes described above, or as required by your organization and applicable legislation. When the data is no longer needed, it is securely deleted or anonymized.
Continuity of data protection
M360 Compass provides mechanisms to ensure continuity of data protection, including during significant changes affecting the organization or its activities. Data remains subject to the same confidentiality, integrity and security requirements during any transition period. Depending on the situation, particularly during a sale, acquisition, closure or insolvency, they may be returned to the customer, transferred securely subject to maintaining equivalent protections, or destroyed securely in accordance with applicable obligations.
6. Your rights and controls (Compliance Law 25)
You have the following rights:
- Right of access: obtain a copy of the information we hold about you.
- Right of rectification: correct inaccurate or incomplete data.
- Right to withdraw consent: withdraw your consent at any time, subject to legal or contractual obligations.
- Right to portability: obtain your data in a structured and readable format.
To exercise these rights, contact our Privacy Officer (see section 9).
7. Cookies and similar technologies
M360 Compass only uses cookies essential to the security and proper functioning of the platform (authentication, session maintenance). No advertising cookies or third-party tracking tools are used in the application.
8. Changes to this policy
We may update this policy at any time. In the event of a substantial modification, a notice will be published on the platform or sent by email. The last update date is always at the top of this page.
9. Contact us
For any questions or requests regarding this Privacy Policy:
10. Use of artificial intelligence (AI)
Some M360 Compass features rely on artificial intelligence to analyze, summarize and generate reports from evaluation data. This technology is used within a strictly regulated framework and complies with Canadian laws on protection of personal information.
- Data sources: the data used by our models comes exclusively from information that you or your organization provide as part of HR assessments.
- Absolute confidentiality: data transmitted to OpenAI models (via secure API) is not never used to train models, never resold and never shared with other customers.
- Temporary storage: Requests may be retained for up to 30 days for abuse detection purposes, after which they are automatically deleted.
- Encryption and security: all communications with AI servers are encrypted (TLS 1.2+), and processing is carried out in environments that comply with the highest security standards.
- Purpose: The sole objective of AI is to help understand, synthesize and promote evaluation results. It is never used to make automated decisions without human intervention.
By using M360 Compass, you benefit from intelligent analyzes while maintaining full control over your data. Our commitment is clear: no secondary use, no hidden profiling and no unsupervised automated decisions.
Suppliers and technology partners
To ensure the proper functioning of its services, M360 Compass relies on different suppliers. For transparency purposes, here are the details:
- Accommodation: Vercel (distributed network, TLS 1.2+, Canada/US geographic firewall)
- Database: Supabase (hosting in Canada, EPIRB, encryption at rest and in transit)
- Payments: Stripe (PCI DSS certified; no card data is stored on our servers)
- Application analyses: Umami (cookie-free, privacy-friendly solution)
- Monitoring and diagnosis: Sentry.io (for log analysis without personal data)
- Main site analytics: Google Analytics (limited collection and IP anonymization where available)
- AI: OpenAI (secure API; no use of data for training purposes)
- Versioning: GitHub (access control and code change history)
These suppliers have been selected for their compliance with Canadian and international standards for the protection of personal information (Law 25, PIPEDA, GDPR).