Privacy policy

This policy explains how My 360 Review processes information when an account owner creates and manages a 360 degree feedback review. It is written in plain language and should be read alongside our terms.

Information we process

We process account information such as an owner’s email address; review information such as a subject’s name, email and job title; rater names and email addresses supplied by the owner; survey responses; email delivery records; and basic technical logs needed to keep the service secure and reliable.

Why we process it

We use this information to authenticate owners, operate reviews, send invitations and reminders, collect responses, generate protected reports, prevent abuse and diagnose service problems. We do not sell personal information or use survey responses for advertising.

Roles and responsibilities

The account owner decides who participates in a review and why their information is collected. In that context, the owner is generally responsible for providing appropriate notice and establishing a lawful basis. My 360 Review processes the data to provide the service.

Feedback confidentiality

Raw responses are not made available to the review owner. Reports apply minimum-response rules to non-self rater groups. Groups below the configured threshold have scores, comments and identifying counts suppressed. Self feedback is shown separately. Because secure links can be forwarded and writing style can sometimes be recognisable, we describe feedback as anonymity-protected rather than guaranteeing perfect anonymity.

Service providers

We use specialist providers to operate the service, including Supabase for authentication, database and file storage; Vercel for application hosting; and Resend for transactional email. These providers process limited information on our behalf under their own security and contractual controls.

Retention and deletion

Information is retained while it is needed to provide the review and maintain the service. Account owners should not retain review data longer than necessary for their stated purpose. Account and review deletion controls will be expanded before general production launch; until then, deletion requests can be sent to privacy@my360review.com.

Security

We use row-level database controls, server-only privileged credentials, hashed survey tokens, private report storage, signed downloads and rate limiting. No online service can promise absolute security.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, and to complain to a data-protection authority. Some requests relating to a review should first be directed to the organisation or person who invited you.

International processing

Our service providers may process information in countries other than your own. Appropriate safeguards depend on the owner’s location and selected provider regions and should be assessed before production use.

Contact

Privacy questions and requests may be sent to privacy@my360review.com.