Privacy Policy

1. Who we are

W&I Studio Ltd, a company registered in England and Wales and trading as TrainedTeam (“we”, “us”, “our”), operates the TrainedTeam platform and website. We are the data controller for the personal data we collect through our services.

When your organisation uses TrainedTeam to train and track its own staff, your organisation is the controller of that data and we process it on its behalf, as set out in section 11 of our Terms of Service.

If you have questions about this policy, contact us at privacy@trainedteam.com.

2. What data we collect

We collect and process the following categories of personal data:

• Account data: name, email address, password (hashed), organisation name, role
• Profile data: display name, avatar, department, job title (if provided)
• Usage data: training completions, quiz scores, run execution data, content created
• Compliance data: e-signature records including typed name, timestamp, IP address, and document version
• Technical data: IP address, browser type, device information, pages visited
• Analytics data (only if you allow analytics): a random device identifier kept in a cookie, the pages you visit and what you click, recordings of how you use our pages, and error reports. See section 9.
• Communication data: support requests, feedback

3. How we use your data

We process personal data for the following purposes and legal bases:

• Providing the service (contract): creating accounts, processing training completions, generating analytics, storing content
• E-signature records (legitimate interest): capturing typed name, timestamp, and IP address for compliance audit trails as requested by your organisation
• Service improvement (legitimate interest): understanding usage patterns, improving features, fixing issues. This includes a small number of account events recorded on our servers, such as a sign-up, an invitation sent, a training check submitted or a change of plan. They are linked to your account ID, not to your name or email address, and set no cookies.
• Analytics (consent): understanding how our website and app are used, replaying visits that went wrong, and tracking errors, using PostHog, Google Analytics (website only) and Vercel Analytics. These run only after you allow analytics, and you can withdraw at any time (section 9).
• Communication (legitimate interest / consent): sending service updates, responding to support requests, marketing communications (with consent only)
• Legal compliance (legal obligation): responding to legal requests, maintaining records as required by law

4. AI processing

When you use AI features (content generation, quiz creation, text transformation), the text you submit is sent to our AI provider, Anthropic, for processing. If you create an audio narration of an instruction, its title and steps are sent to OpenAI to make the audio. The content you submit may contain personal data (for example, employee names referenced in an SOP). Both act as sub-processors. Anthropic deletes the content it receives within 30 days, and neither provider uses it to train AI models. See section 6 on international transfers for the safeguards that apply.

5. Data sharing

We do not sell your personal data. We share data with:

• Your organisation: managers and owners in your organisation can see training completions, quiz scores, and e-signature records for their team members
• Sub-processors: hosting, database, authentication, email delivery, anti-bot, AI, payments, and analytics and session replay providers that process data on our behalf under contractual data processing terms (UK GDPR Article 28). The current list, with what each one does and where, is on our sub-processors page.
• Sign-in providers: if you choose to sign in with Google or Microsoft, they confirm who you are and share your name, email address and profile with us
• Embedded content: videos and documents embedded in your organisation's content (for example from YouTube, Loom or Google) load from those providers, which receive your IP address and browser details when you view them
• Law enforcement: if required by law, court order, or regulatory request

6. Data storage, security, and international transfers

Your training data, account data, and content are stored in European Union data centres. All data is encrypted at rest using AES-256 and in transit using TLS 1.3. We enforce row-level security at the database layer, ensuring users can only access data belonging to their organisation. See our security and data protection overview for the full picture.

Some of our sub-processors are based outside the UK and EU. The most material examples are Anthropic and OpenAI (United States), which process content you submit to AI features, and PostHog, a US company that stores our analytics data in the EU (Germany). Where personal data is transferred outside the UK, we rely on the following safeguards under UK GDPR Articles 44 to 49:

• UK International Data Transfer Addendum to the EU Standard Contractual Clauses (the “UK Addendum”), or
• An adequacy decision made by the UK Government in respect of the destination country (for example the UK-US Data Bridge for certified US recipients), or
• Other appropriate safeguards permitted under UK GDPR.

You can request a copy of the safeguards in place for any specific sub-processor by emailing privacy@trainedteam.com.

7. Data retention

• Account data: retained while your account is active. Deleted within 30 days of account deletion request.
• Training records and e-signatures: retained for the duration of the organisation's subscription plus 6 years, in line with UK Limitation Act 1980 guidelines for employment records.
• Technical logs: retained for up to 90 days for security and debugging purposes.
• Analytics data: kept only as long as we need it to understand how the service is used, within the retention period set in each analytics tool. Ask us for the current periods at privacy@trainedteam.com.

8. Your rights

Under UK GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (subject to legal retention requirements)
• Restrict processing in certain circumstances
• Data portability - receive your data in a structured format
• Object to processing based on legitimate interest
• Withdraw consent for marketing communications at any time
• Withdraw consent for analytics at any time: use Cookie preferences in the footer of our website, or Settings, Account, Analytics in the app

To exercise any of these rights, email privacy@trainedteam.com. We will respond within one calendar month.

9. Cookies

We use cookies that are strictly necessary for sign-in and security. With your permission, we also use analytics cookies and similar technologies: PostHog on our website and in the app, Google Analytics on our website, and Vercel Analytics, which sets no cookies. Nothing loads until you allow it, and refusing is as easy as accepting. Our website and the app each ask you separately. See our Cookie Policy for the full list.

10. Children

TrainedTeam is not intended for use by individuals under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. We will notify registered users of material changes by email. The “last updated” date at the top of this page indicates when the policy was last revised.

12. Complaints

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.