Privacy Policy

Effective: September 2026

Privacy is important. We respect yours. This policy explains how Good4work Inc. ("Good4work," "us," "we") handles information we collect when you visit and use our sites, services, and products (the "Services").

WHO WE ARE

Good4work provides an AI-assisted, human-confirmed skill validation and credentialing platform. Employers use Good4work to help employees demonstrate skills through structured manager and peer confirmation, and to issue verifiable, portable credentials. Good4work Inc. is a Delaware C-Corp headquartered in San Francisco, California, with an additional presence in France.

WHAT THIS POLICY APPLIES TO

This policy applies to the Good4work website (including subdomains) and to the Services offered through it, including for employer customers ("Customers") and their employees, managers, and other end users ("End Users") who use the Services through a Customer account. It does not apply to third-party websites or services, even where linked from our Site.

WHO THIS POLICY COVERS

Good4work processes personal information in two roles:

- As a business/controller, for our own Site visitors, prospects, and Customer account administrators.

- As a service provider/processor, for personal information about a Customer's employees (End Users) that we process on the Customer's behalf and instructions to deliver the Services.

DATA WE COLLECT

Account and profile data: name, business email, employer/organization, role, password, and related account setup information.

Skill validation signals: structured scorecard responses; manager, peer, and client confirmations submitted through web forms tied to a specific validation request.

[Currently: signal capture is form-based — a reviewer receives a link and answers fixed questions in text. We do not currently record or process audio/voice data as part of skill validation. If voice-based check-ins are introduced in the future, this policy will be updated before that feature goes live, and a separate recording-consent disclosure will be added at that time.]

Credential data: skill certifications issued, their validation history, and status information (including credentials pending or intended for blockchain issuance).

[Currently: credential records are stored in our database. Some credentials may show a pending or in-progress blockchain status as this capability is developed. We do not currently store personal information on a public blockchain. When on-chain issuance goes live, this policy will be updated to describe what is stored on-chain (expected to be limited to a non-identifying reference) versus what remains in our off-chain database, consistent with data minimization principles.]

Integration data: data from connected systems, including Workday (for pushing validated credentials to employee profiles and, where configured, pulling competency framework data) and, where a Customer opts in, Slack or Microsoft Teams (add-on integrations, priced and configured separately from the base Service, not enabled by default).

Usage, device, and cookie data: as described in the Cookie Policy section below.

HOW WE USE AI

Good4work uses automated processing to help structure and evaluate skill-validation signals submitted by reviewers, and to support consistency and bias-reduction across evaluations. A skill credential is never issued on the basis of an employee's own self-reported input alone; issuance requires confirmation from at least one other person (a manager, peer, or client).

Some uses of validated skill data by a Customer may influence employment-related decisions such as promotion or work assignment, at the Customer's discretion. Where automated processing is used in connection with such decisions:

- We design the workflow to keep a human reviewer meaningfully involved (not simply a formality) before a decision affecting an individual is finalized, where applicable.

CALIFORNIA PRIVACY RIGHTS

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, use, and disclose; the right to delete; the right to correct inaccurate information; the right to opt out of the sale or sharing of personal information (Good4work does not sell personal information); and the right to limit the use of sensitive personal information.

Where Good4work uses automated decision-making technology (ADMT) for a significant decision (as defined under CCPA regulations, including certain employment-related decisions), and where required by law, we will provide a pre-use notice describing the technology, the personal information used, the decision it informs, and your rights, including an opt-out or a meaningful human-review path where offered, and a right to request an explanation of the logic and role of the ADMT output in the decision.

To exercise these rights, contact us at [support@good4work.com].

EU / UK DATA SUBJECT RIGHTS

If you are located in the European Economic Area, the UK, or Switzerland, you have rights under the GDPR (and UK GDPR, where applicable), including the right to access, rectify, erase, restrict, or object to our processing of your personal data, and the right to data portability.

Where a decision about you is based solely on automated processing and produces a legal or similarly significant effect, you have the right not to be subject to that decision without meaningful human involvement, subject to applicable exceptions. Good4work's credentialing workflow is designed to require confirmation from a human reviewer before a credential is issued.

We process personal data on the following legal bases, depending on the purpose: performance of a contract with the Customer, our legitimate interests (including providing and improving the Services), and, where required, consent.

International transfers: personal data processed by Good4work may be transferred to and processed in the United States.

To contact us about EU/UK data protection matters, including to reach our data protection contact, email [support@good4work.com].

RESPONSIBLE AI AND TRANSPARENCY

Good4work is designed with responsible AI principles in mind: credentials require independent human confirmation rather than self-declaration, and we aim to build toward auditable, well-documented AI processing as our systems and customer base grow.

Where Good4work's skill-validation system is used in a way that affects employment decisions for workers in the European Union, and where applicable EU AI Act transparency obligations apply, we are committed to working with our Customers to ensure affected workers are informed of the AI system's use, consistent with Article 26(7) of the EU AI Act.

DATA SECURITY

We use industry-standard measures to protect data, including encryption in transit (TLS 1.2+) and at rest (AES-256). We have initiated a SOC 2 Type I certification process; that process is in progress and not yet complete. We do not claim SOC 2 certification or GDPR compliance until each is actually true and confirmed by qualified review.

DATA RETENTION

We retain account data for as long as an account is active and as necessary to provide the Services. We retain skill validation signals, reviewer responses, and credential records until their renewal obligation ends, to support the credential's validity period and any applicable audit or compliance requirements. You may request deletion of your personal information as described in the rights sections above, subject to legal retention obligations.

COOKIE POLICY

We use cookies and similar technologies to recognize returning visitors, remember preferences, and understand Site usage, including via Google Analytics. You may opt out of Google Analytics using Google's browser add-on. This policy covers Good4work's own use of cookies, not the practices of third parties whose cookies may also be present.

CHILDREN

Good4work is not directed to children, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact [support@good4work.com] and we will delete it.

DATA STORAGE AND DISCLOSURE

We use third-party hosting and infrastructure vendors (including cloud hosting providers) to operate the Services. We do not sell your information. We may share information with vendors who meet our data protection standards, with your consent, or where required by law, consistent with the process described in our prior policy.

CHANGES TO THIS POLICY

We will update this policy as our practices evolve, including as new features (such as real blockchain issuance or voice-based validation) move from development into live use, and will note the effective date of material changes.

QUESTIONS