Privacy and data handling

How the platform treats employee data, and the limits we build into the product itself.

What the platform holds

Capital U stores workforce data supplied by the client company: employee identity and role, organisational structure, role expectations, performance and commitment scores, attendance, relationship and engagement signals, workload, and — where a specific issue triggers it — incidents, training, promotion, compensation and recruitment records.

Separation of roles

The admin workspace holds raw data, evidence, diagnostic notes and internal case reasoning. The client portal holds approved results only: aggregate metrics, approved findings, the approved action timeline and agreed KPIs. There is no route through the client portal to raw employee records, internal evidence, investigation notes or the body of an intervention plan.

Small-group suppression

Department-level figures in the client portal are withheld when the group is smaller than five people, because at that size a group average effectively identifies an individual.

AI processing

AI-assisted interpretation is optional and off unless a provider key is configured. When it is used, employee names are replaced with anonymised labels before the request leaves the platform, and the response is stored separately from verified metrics and labelled as a hypothesis. The system prompt forbids predictions about named individuals and any recommendation of adverse action.

Demographic data

Where demographic attributes are recorded, they are used only for aggregate fairness monitoring — checking whether adverse outcome rates differ materially between groups. They are never an input to an individual risk score, finding or decision.

Audit trail and correction history

Every data change is written to an append-only correction history that survives deletion of the live record, and every administrative action is logged with its actor and timestamp.

Backups

A complete encrypted-in-transit snapshot of the database is generated on a schedule and sent to the account owner's registered address, so the data survives loss of the hosting environment.

This page describes how the software behaves. It is not legal advice, and it does not replace the client company's own privacy notice or its obligations as data controller.