Privacy Policy

We process data to help you create and share a credible Career Passport, compute trust signals, and keep the platform secure. We design for privacy-aware display: public passports omit email, phone, and internal account identifiers.

CPASS acts as the data controller for worker accounts unless we tell you otherwise in a separate agreement.

The data we collect depends on how you use CPASS. Categories include:

• Account data — name, email address, authentication identifiers, and preferences.
• Evidence you submit — work narratives, CV uploads, assessment responses, and confirmations or rejections of proposed skills.
• Derived data — AI-mapped skills, ESCO mappings, trust scores, tiers, and passport visibility settings.
• Usage data — device type, browser, approximate location from IP, pages viewed, and diagnostic logs.
• Communications — support messages and product notifications you receive or send to us.

We use personal data to operate and improve CPASS, including:

• Creating and authenticating your account.
• Extracting, mapping, and presenting skills you choose to confirm.
• Calculating trust scores and tiers with transparent sourcing.
• Rendering public passport pages according to your sharing settings.
• Preventing fraud, abuse, and security incidents.
• Sending service messages and, where permitted, product updates.

Skills appear on your passport only after you confirm them. Rejected proposals are not published as confirmed skills.

Public passport URLs are designed for employers and recruiters you share them with. They intentionally exclude direct contact details; viewers contact you through channels you provide outside CPASS.

You can adjust what appears on your passport where product controls allow. Some account metadata remains private even when a passport is public.

We do not sell your personal data. We share data only as needed to run CPASS:

• Infrastructure providers — hosting, authentication, analytics, and email delivery under contractual safeguards.
• Legal requirements — when required by law or to protect rights, safety, and integrity of users and CPASS.
• Business transfers — in connection with a merger, acquisition, or asset sale, subject to continued protection.
• With your direction — when you share a passport link or connect integrations you enable.

We retain account and passport data while your account is active and for a reasonable period afterward to comply with law, resolve disputes, and maintain security logs.

You may request deletion of your account subject to legal retention obligations. Some anonymized or aggregated data may remain for analytics and product improvement.

Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing.

To exercise these rights, contact privacy@cpass.ai. We will verify your request and respond within applicable timelines. You may also lodge a complaint with your local data protection authority.

We use administrative, technical, and organizational measures appropriate to the sensitivity of Career Passport data, including encryption in transit, access controls, and monitoring.

No online service is perfectly secure. Report suspected vulnerabilities to security@cpass.ai.

CPASS may process data in countries other than where you live. Where required, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms for cross-border transfers.

Privacy questions and requests: privacy@cpass.ai

Data Protection contact: legal@cpass.ai