Privacy Policy

The controller for the processing described in this policy, unless stated otherwise, is:

Email: team@thepeopleopsmanager.com. Further details are in the Imprint.

We have not appointed a data protection officer, as there is no legal obligation to do so. For all data protection questions please write to team@thepeopleopsmanager.com.

3.1 Processing as controller

We are the controller for: visits to the website and the blog (server logs), user accounts of the web app (name, email, password, workspace membership), the access-code signup, emails you send us, comments on the blog, and the technical security of the service.

3.2 Processing on behalf of customers (Art. 28 GDPR)

The People Ops Manager is used by organizations (our customers) to coordinate onboarding and offboarding. Inside a workspace, customers store and process data about their employees and new starters, for example: name, role or job title, department, location, work mode (office, hybrid, remote), manager, HR contact, start date or last working day, an internal employee reference, the systems a person needs, tasks with owners, due dates and completion evidence, approval requests and decisions, and an activity log of who changed what. Customers may also import this data from their HR system or check directory accounts through the integrations listed in section 7.

For this data the customer is the controller. We process it only to provide the service and only on the customer's documented instructions, as a processor under Art. 28 GDPR. We do not use it for our own purposes, do not sell it and do not use it to train AI models. A data processing agreement (DPA) is available on request at team@thepeopleopsmanager.com.

The product is designed to store only what coordination needs. It is not meant for compensation, bank details, identity documents, health data, family information or other special categories of personal data, and customers should not enter such data.

If you are an employee of one of our customers and want to exercise your data protection rights regarding your onboarding or offboarding data, please contact your employer. If you contact us, we will forward your request to the customer concerned.

The website and the web app are built with Bolt.new (StackBlitz, Inc., USA) and delivered by Netlify, Inc., USA, through its content delivery network. Requests to /blog/ are passed through Netlify to the blog server (section 9).

When you open a page, your browser automatically sends technical data that the host records in server logs: IP address, date and time of the request, requested URL, referrer URL, HTTP status, transferred data volume, browser type and version (user agent) and operating system.

Purpose and legal basis: delivering the website, ensuring stability and security and defending against attacks. Our legitimate interest under Art. 6(1)(f) GDPR lies in a secure and reliable website. We do not merge these logs with other data. Netlify stores the logs for a limited period under its own retention rules; we do not keep separate copies.

Accounts, authentication, the database and the server functions of the web app run on Supabase (Supabase, Inc., USA): Supabase Auth, a Postgres database and Supabase Edge Functions. Supabase's servers may be located in the EU or the USA.

We process the following data of account holders:

• Account data: name, email address, password (stored only as a cryptographic hash by Supabase Auth), account creation and sign-in times.
• Workspace data: workspace name, time zone, optional company size, your membership and role (owner, admin, operator or viewer), and the content you create, such as cases, tasks, approvals and activity log entries attributed to you.
• Security data: Supabase Auth records technical data such as IP address, user agent and time of sign-ins and token refreshes to protect accounts.

Supabase also sends the transactional emails of the app on our behalf: email confirmation after signup, password reset links and invitations to a workspace.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract and pre-contractual steps) for the account and workspace; Art. 6(1)(f) GDPR for security data, based on our legitimate interest in protecting accounts against misuse. Supabase acts as our processor under a data processing agreement. For employee data in workspaces, Supabase acts as our sub-processor (section 3.2).

Signup is currently invite-only. When you sign up, you enter an access code. We store the code with your account and keep a redemption record (code, user ID, email address and time of redemption) to check that codes are valid, to limit how often a code can be used and to understand which invitation led to a signup.

Legal basis: Art. 6(1)(b) GDPR and our legitimate interest in controlling access to the service (Art. 6(1)(f) GDPR).

A workspace owner or admin can connect the following tools with credentials from their own account at that provider:

• BambooHR (HR system, read-only): reads upcoming starters, including name, job title, department, location, manager, hire date, employment status, employee ID and work email.
• Personio (HR system, read-only): reads persons and employments for the same purpose.
• Slack: posts reminders to one channel chosen by the customer, only after a person in the workspace has approved the message.
• Jira Cloud (Atlassian): creates IT and manager tickets for approved steps and reads their status back as evidence.
• Microsoft Entra ID (read-only): checks whether a starter's directory account exists and is enabled, looked up by work email. Accounts are never created, changed or disabled.

API keys and tokens are sent once to our server functions and stored server-side in a database table that the browser cannot read. The app only shows a masked hint (the last four characters). Data is fetched from or sent to a provider only when a user of the workspace triggers it or approves it.

For all data exchanged through these integrations we act as a processor for the customer (section 3.2). The customer uses these tools under its own contracts with the respective providers, who are responsible for the data held in their systems.

Customers can connect an AI assistant that supports the Model Context Protocol (MCP), for example Claude, ChatGPT or Cursor, to their workspace. A user creates a personal MCP token in the web app. We store only a SHA-256 hash of the token and a short prefix for display, together with the time it was last used. The token acts with the current role of the user who created it, read tools return only the fields that role may see, and every change to an external system becomes an approval request that a person decides in the web app.

When the assistant calls a tool, the requested workspace data is returned to that AI client. The AI provider then processes it under the customer's own agreement with that provider. We do not send workspace data to AI providers on our own initiative.

The "Open in AI Agent" button opens claude.ai or chatgpt.com in a new tab with a prefilled prompt. The prompt contains the workspace name and the context of the current page, which can include an employee's name. This happens only when you click the button, and the AI provider's own privacy terms apply from then on.

Legal basis: Art. 6(1)(b) GDPR for the token management; for workspace data, processing on behalf of the customer (section 3.2).

The blog at thepeopleopsmanager.com/blog/ runs on WordPress and is hosted by ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Requests are passed through Netlify (section 4) to this server. All-Inkl records server logs with the same kind of technical data as described in section 4 (IP address, time, requested URL, referrer, user agent). Legal basis: Art. 6(1)(f) GDPR. All-Inkl acts as our processor.

If comments are open and you write a comment, we store your name, email address, optional website, the comment text, the time and your IP address. The email address is not published. Comments are checked for spam by the plugin Antispam Bee, which runs locally on our server and does not transfer data to third parties. We do not use Gravatar; avatars are disabled. Legal basis: Art. 6(1)(f) GDPR, based on our interest in enabling discussion and in being able to trace and prevent abuse such as spam or unlawful content. Comments stay online until you ask us to remove them or the post is deleted.

We do not use analytics, tracking, advertising or social media plugins, and we do not set marketing cookies. Fonts (Inter and JetBrains Mono) are hosted on our own server, so no font provider receives your IP address.

The web app stores the following strictly necessary entries in your browser's local storage:

• Your Supabase sign-in session, so that you stay signed in (removed when you sign out).
• The workspace you selected last, so that the app opens it again.
• Which notifications you have already read.
• In the demo mode only: the fictional demo workspace and your changes to it.

These entries never leave your browser except the session token, which is sent to Supabase to authenticate your requests. Storing and reading them is strictly necessary to provide the service you request (§ 25 (2) no. 2 TDDDG), so no consent is required. Any further processing is based on Art. 6(1)(b) GDPR. You can delete the entries at any time in your browser settings.

If you write to team@thepeopleopsmanager.com, we process your email address, your name if given, and the content of your message to answer your request. Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract or its preparation, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). We delete the correspondence when it is no longer needed, unless statutory retention obligations apply (for example 6 years for business letters under § 257 HGB).

We share personal data only with the following recipients, and only to the extent described above:

Netlify, Inc., USA

Hosting and content delivery of the website and web app (via Bolt.new by StackBlitz, Inc., USA).

Supabase, Inc., USA

Authentication, database, server functions and transactional emails. Servers may be located in the EU or the USA.

ALL-INKL.COM - Neue Medien Münnich, Germany

Hosting of the WordPress blog.

Providers connected by the customer

BambooHR, Personio, Slack, Atlassian (Jira Cloud) and Microsoft (Entra ID), only when a customer connects them and only on the customer's instruction.

AI providers chosen by the customer

For example Anthropic (Claude), OpenAI (ChatGPT) or Anysphere (Cursor), only when a customer connects an AI assistant through MCP or a user clicks "Open in AI Agent".

We do not sell personal data. We may disclose data to authorities where we are legally obliged to do so.

Netlify, StackBlitz and Supabase are based in the USA, and data may be processed there. For transfers to the USA we rely on an adequacy decision of the European Commission (EU-US Data Privacy Framework, Art. 45 GDPR) where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) that these providers include in their data processing agreements.

• Server logs: kept by Netlify and All-Inkl for a limited period under their own retention rules; we do not store copies.
• Account and workspace data: as long as your account or the workspace exists. When an account is deleted, we delete the account data, unless statutory retention obligations apply (for example 6 or 10 years for business letters and accounting records under § 257 HGB and § 147 AO).
• Access-code redemption records: as long as the account exists.
• Workspace invitations: until they are accepted or expire.
• MCP tokens: until they are revoked or the account or workspace is deleted. Revoked tokens remain as a record without the token itself.
• Integration credentials: until the integration is disconnected or the workspace is deleted.
• Employee data in workspaces: as long as the customer keeps it, and deleted at the end of the contract on the customer's instruction, as set out in the DPA.
• Emails and blog comments: see sections 9 and 11.

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR),
• have incorrect data corrected (Art. 16 GDPR),
• have your data deleted (Art. 17 GDPR),
• restrict processing (Art. 18 GDPR),
• receive your data in a structured, commonly used and machine-readable format (Art. 20 GDPR),
• object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
• withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

To exercise these rights, write to team@thepeopleopsmanager.com. For employee data in a customer workspace, see section 3.2.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner) in Dresden, www.datenschutz.sachsen.de.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. The product makes no employment decisions and does not score employees. Readiness is calculated as the share of verified tasks. Actions proposed by an AI agent, such as access requests, equipment orders or messages, are executed only after a person in the workspace has approved them.

You can read the website and the blog without providing any personal data beyond the technical data your browser sends. To create an account you must provide your name, email address and a password; without them we cannot provide the web app.

We update this policy when the service or the law changes. The current version is always available on this page.