Privacy Policy

1. Who we are

This Privacy Policy explains how [Organisation legal name] ("we", "us" or "MeritCoin") collects and uses information when your organisation uses the MeritCoin workspace.

MeritCoin is a private, organisation-managed workspace for work items, approvals, documents, feedback, recognition and appraisal evidence. Replace the bracketed organisation details and have your privacy counsel confirm the final controller, processor and contact arrangements before publishing this policy.

2. Information we collect

The records we handle depend on how your organisation configures the workspace. They may include:

• Identity and contact details, such as your name, work email, staff ID, department, role, supervisor, profile image and biography.
• Work records, including agreements, tasks, assignments, due dates, status updates, approvals, comments, outcomes and value created.
• Documents and file metadata uploaded by authorised workspace members, including version history and access records.
• Recognition activity, including MeritCoins sent or received, core values, notes and the recognition ledger.
• Technical information needed to operate the service, such as session identifiers, browser details, security events and approximate request timestamps.

3. How we use information

We use information to provide and protect the workspace and to make work easier to understand. This includes to:

• Create accounts, authenticate users and enforce organisation permissions.
• Coordinate work, route approvals, keep an update and document trail, and show relevant dashboards and reports.
• Send operational messages such as invitations, approval updates, recognition receipts and security notices.
• Generate employee-facing proof-of-work and manager appraisal evidence from records the viewer is authorised to access.
• Detect misuse, investigate incidents, troubleshoot issues and improve reliability. Optional product analytics are only used when enabled and consented to where required.

4. Why we may process information

Where applicable law requires a legal basis, the organisation using MeritCoin determines the appropriate basis for its processing. Depending on the activity, this may include performing an employment or service arrangement, legitimate organisational interests, complying with a legal obligation, or your consent. Your organisation should document the basis that applies to its people and jurisdiction.

5. When information is shared

MeritCoin is designed around least-privilege access. Information may be visible to:

• People in your organisation who are authorised by role, reporting line or workspace permission, such as you, your manager and administrators.
• Service providers that host, store, secure, email or support the service, acting under appropriate contractual and security controls.
• Professional advisers, regulators, law enforcement or other parties where disclosure is required by law or needed to protect people, rights or the service.

6. Assisted writing and AI features

When enabled by your organisation, MeritCoin may use an AI provider to organise authorised work evidence into a private, cited draft. The assistant is limited by server-side permissions and should not receive records the requesting user cannot access. AI output can be incomplete or wrong, so a person must review it before it is used in a recognition, appraisal, employment or legal decision.

MeritCoin should not be configured to use workspace records to train a general model unless your organisation has separately approved that arrangement. Confirm the selected provider, retention settings, processing locations and contractual terms before enabling this feature in production.

7. Retention and security

Your organisation sets retention periods for accounts, work evidence, messages, documents, recognition records and audit events. We retain records for as long as needed to provide the service, meet documented organisational requirements, resolve disputes and comply with law. Security measures include authenticated sessions, role-aware access checks, audit trails and protected storage; no online service can guarantee absolute security.

8. Cookies and local storage

MeritCoin uses essential browser storage to keep you signed in securely and remember choices such as cookie preferences. Essential storage is required for the workspace to function. Optional analytics or similar technologies are off by default in this release and should only be enabled after the required consent is collected.

The cookie banner records your choice in this browser under a versioned preference key. Clearing browser storage, using a different browser or using a different device may require you to choose again. You can reopen the preference controls at any time:

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict or receive a copy of personal information, and to object to certain processing or withdraw consent. Requests should normally be sent to your organisation first because it controls the employee and work records in the workspace. Contact: [privacy email]. We will not retaliate for a privacy request.

10. Changes and contact

We may update this policy when the service or processing changes. We will publish the new version with a revised date and, where appropriate, notify your organisation. This template was last updated 6 September 2026. Questions: [privacy email] or [organisation postal address].