Privacy Policy

1. Introduction

Welcome to Metronic Skills Assessment Platform ("we," "our," or "the Platform"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our skills assessment and employee management services.

2. Information We Collect

2.1 Information You Provide

• Account Information: Full name, work email address, company name, and password
• Employee Data: Names, email addresses, departments, positions, and assessment results
• Program Data: Program details, questions, answers, scores, and progress tracking
• Communication Data: Messages, notifications, and support inquiries

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent, and interaction patterns
• Device Information: IP address, browser type, operating system, and device identifiers
• Log Data: Access times, error logs, and system activity

2.3 Identity Verification Data (External Candidates)

When an external candidate is invited by an organization to take a skills assessment, we may collect additional information solely for identity verification:

• Phone Number: Used only when the candidate or inviting organization chooses SMS-based verification, to deliver a one-time 6-digit code
• One-Time Verification Codes: Hashed and stored temporarily; the plaintext code is never persisted
• Consent Record: The exact wording of the SMS consent shown to the candidate, the consent version, a timestamp, a one-way hash of the candidate's IP address, and a truncated user-agent string — kept as an immutable audit trail

Phone numbers are never used for marketing or promotional messaging. They are used exclusively to deliver the verification code and, where the inviting organization has opted in, transactional notifications related to the candidate's assessment.

2A. SMS Identity Verification & Consent

When SMS verification is offered, the candidate must explicitly accept the following before any text message is sent:

"I agree to receive SMS messages from Metronic at the phone number on file for the purpose of identity verification and assessment-related notifications. Message and data rates may apply. Reply STOP to opt out at any time. Consent is not a condition of taking the assessment — contact your administrator for an alternative method."

• SMS Provider: Twilio, Inc. acts as our sub-processor for SMS delivery. See Twilio's Privacy Notice.
• Frequency: One verification SMS per request, with a maximum of three send attempts per ten-minute window.
• Opt-Out: Reply STOP to any message to immediately revoke consent and stop all SMS. You may also email privacy@metronic.ai.
• HELP: Reply HELP for assistance, or contact support@metronic.ai.
• Carriers: Carriers are not liable for delayed or undelivered messages.
• Cost: Standard message and data rates from your carrier may apply.
• Supported Regions: SMS verification is currently available in the US, Canada, and most of Western Europe.
• Legal Basis (GDPR): Article 6(1)(a) — explicit consent. The candidate may withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
• Retention: Verification codes are purged within 1 hour of issue. Consent records (audit trail) are retained for up to 7 years to evidence compliance with TCPA, CAN-SPAM, and GDPR. Phone numbers remain associated with the candidate's enrollment for the lifetime of that record and are deleted when the enrollment or organization is removed.

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: Provide skills assessments, program management, and employee tracking
• Account Management: Create and maintain user accounts, verify identities, and manage access
• Communication: Send notifications, program invitations, reminders, and updates
• Analytics: Analyze usage patterns, improve features, and optimize performance
• Security: Detect fraud, prevent abuse, and protect against security threats
• Compliance: Meet legal obligations and enforce our Terms of Service
• Support: Respond to inquiries, resolve issues, and provide customer assistance

4. Data Storage and Security

4.1 Security Measures

We implement industry-standard security measures to protect your data:

• Encryption: Data is encrypted in transit using TLS/SSL and at rest using AES-256 encryption
• Access Controls: Role-based access control (RBAC) with row-level security policies
• Authentication: Secure password requirements with breach detection using HaveIBeenPwned API
• Email Verification: Mandatory email verification for all new accounts
• Audit Logs: Comprehensive logging of data access and system activities

4.2 Data Location

Your data is stored on secure cloud infrastructure provided by our hosting partners. We use Supabase (built on PostgreSQL) for database management, which employs enterprise-grade security measures and regular backups.

5. Data Sharing and Disclosure

5.1 Within Your Organization

Data is shared within your organization based on user roles:

• Administrators: Full access to all organization data
• Managers: Access to employees they created and their assessment results
• Editors: Access to questions from assigned managers
• Employees: Access only to their own assessment data

5.2 Third-Party Service Providers

We may share information with trusted third-party providers who assist in:

• Cloud hosting and infrastructure (Supabase, AWS)
• Email delivery services (Resend)
• SMS delivery services (Twilio) — used solely for identity verification codes when SMS verification is selected
• AI-powered question generation (OpenAI, Anthropic, Google)
• Password security validation (HaveIBeenPwned API)

All third-party providers are contractually bound to protect your data and use it only for specified purposes.

5.3 Legal Requirements

We may disclose information when required by law, legal process, or government request, or to protect our rights, property, or safety.

6. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and associated data
• Portability: Receive your data in a machine-readable format
• Object: Object to certain processing activities
• Restrict: Request restriction of data processing
• Withdraw Consent: Withdraw previously given consent at any time

To exercise these rights, please contact us at privacy@metronic.ai

7. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations:

• Active Accounts: Data retained while account is active
• Deleted Accounts: Data deleted within 30 days of account deletion request
• Audit Logs: Retained for 90 days for security and compliance purposes
• Backups: May remain in backups for up to 90 days after deletion

8. Cookies and Tracking

We use essential cookies and local storage to maintain user sessions and preferences. We do not use third-party advertising or analytics cookies. You can control cookie settings through your browser preferences.

9. Children's Privacy

Our Platform is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we become aware of such collection, we will promptly delete the information.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable laws.

11. GDPR Compliance (EU Users)

For users in the European Union, we comply with GDPR requirements:

• Legal Basis: We process data based on contract performance, legitimate interests, and consent
• Data Protection Officer: Contact at dpo@metronic.ai
• Supervisory Authority: You have the right to lodge complaints with your local data protection authority
• Data Transfers: We use Standard Contractual Clauses for international transfers

12. CCPA Compliance (California Users)

For California residents, additional rights under CCPA:

• Right to Know: Categories and specific pieces of personal information collected
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt-out of sale of personal information (Note: We do not sell personal information)
• Non-Discrimination: We will not discriminate against you for exercising your rights

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Platform. Continued use after changes indicates acceptance of the updated policy.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data: