Teams testing privacy notice

Who this notice covers

This notice covers expressly invited Portraits Microsoft Teams tests using fictional assessment content: the internal one-account People Work Life pilot and a separate Microsoft certification review. It does not cover customer assessment programmes or offer public participation. The internal pilot stops on 19 October 2026 at 23:00 BST. Certification access is approved for 30 days from actual submission; the private review invitation will state its exact start and closure dates. Submission has not yet occurred. Reviewer access uses separate test accounts, not the internal tester’s account. An extension requires a new agreement and updated dates before access continues.

People Work Life Limited (company 16547876), 26 Cromwell Road, Ascot, England, SL5 9DG, is the controller for these tests. Contact rob@peopleworklife.com about this notice, your information or leaving the pilot.

What we collect and why

We use the name, email and authentication details associated with your test account. Microsoft supplies tenant, directory-user, Teams-user and conversation identifiers and the service address needed to reply. The app records your test task relationships, linking confirmations, notice preferences, verification hashes, timestamps, delivery attempts and receipts.

Browser/session information, IP-derived rate-limit keys and diagnostic events help secure and troubleshoot the pilot. A browser proof cookie used in Teams linking lasts ten minutes. Email fallback records can include your recipient address, subject, template, task reference, delivery receipt and error details. Our email provider receives the message and portal link needed to deliver it. Support records contain information you choose to provide.

We use this information to check that the right account links to an eligible task, deliver requested test notices, test access and revocation, prevent misuse and investigate faults. Our lawful basis is our legitimate interests in verifying and securing this integration before customer use, including Microsoft certification. Participation is voluntary and restricted to the approved internal tester, expressly invited certification reviewers and authorised support staff. We use fictional assessment content, restrict access and retention, and provide a route to object or leave the test. We do not use pilot information for marketing or decisions about employment, health or other significant personal matters.

Do not enter real employee feedback, client records, health information or other confidential assessment content. Fictional examples do not make account identifiers anonymous. AI assessment features are outside this Teams pilot. No solely automated decision with legal or similarly significant effects is made about you as part of this test.

Who receives information and where

Access is limited to the approved tester and authorised people administering or investigating the pilot. Microsoft processes Teams identity and chat messages. Vercel hosts the app, Neon stores the isolated test database, Upstash supports rate limiting, sign-in security and duplicate-welcome prevention, Resend delivers any fallback emails, and Sentry receives diagnostic events.

The isolated Neon database is in London, UK. This is not a promise that all processing stays in the UK. Resend stores customer data in the United States; the other providers can also use overseas support or subprocessors. Their data-processing terms provide international-transfer arrangements, including Standard Contractual Clauses and the UK Addendum where applicable. Some also provide for the Data Privacy Framework where it applies. Contact rob@peopleworklife.com for a copy of the applicable safeguards and information about a particular provider.

Teams notices identify the task type and provide fixed instructions and secure links. They contain no names, scores or submitted content. These notices contain generic task information and secure links, not assessment answers or report content. They can still reveal that you use Portraits. Default diagnostic scrubbing is enabled in Sentry, but we do not promise that every identifier or IP address is removed. Its optional use of aggregated identifying data for product improvement is off.

Retention and closure

At the actual closure of each test environment we will stop delivery, revoke that environment’s test access and credentials, and delete its isolated live database and local screenshots or exports. This includes the test account and assessment records, Teams links, challenges, delivery records and application email logs. We will verify cleanup; an expiry setting alone is not evidence that all copies have been erased.

We keep only the minimum support or security evidence needed to investigate test failures for up to 30 days after actual closure, then delete it. A genuinely non-personal summary of test outcomes may remain. If a specific incident or legal obligation requires longer retention, we record the reason, limited information involved and a review date.

Provider-held copies have separate lifecycles. Vercel runtime logs are retained for up to 30 days under the available Pro/Observability arrangements; this does not describe all provider account or security records. Sentry events on our Developer plan are retained for 30 days from ingestion, while its organisation audit records have indefinite retention. Resend Pro email and log data is retained for 30 days, with a separate seven-day backup period. Ending this pilot does not close these shared provider accounts.

The isolated Neon project has a six-hour restore-history window. This is not a six-hour physical-backup erasure guarantee: provider backups follow the applicable deletion procedures. Upstash rate-limit/security records expire according to the relevant control; the Teams exchange budget is fifteen minutes. Hashed installation-event receipts prevent duplicate welcome messages and expire after 30 days. We do not clear security records belonging to other apps or promise that live-key expiry erases provider backups.

Microsoft Teams messages and delivered emails are separate copies. They may remain after the pilot under Microsoft, mailbox and tenant retention or legal-hold arrangements. Removing the app, disconnecting or deleting a visible chat is not a guarantee that every compliance copy is erased. Contact us about removal of pilot messages and any copies that remain.

Linking challenges and launch tickets are usable for ten minutes and binding codes for thirty minutes. Their expiry stops use but does not automatically delete every database row. Those records are included in the live database cleanup at closure. The engineering cleanup schedule for customer use is not yet active in production; this notice does not promise a customer retention service.

Your choices and rights

Taking part is optional; the identifiers needed to link and deliver notices are necessary if you choose to test Teams. Send pause to stop notices, resume to restart them, or disconnect to revoke your Teams link. Disconnecting does not itself erase records or end every existing email or browser invitation. Contact us to end other test access or request deletion.

You can request access, correction, erasure or restriction where applicable. You can object to our use of your information for the legitimate interests described above. We will consider your circumstances and explain the outcome. Data portability applies only where its legal conditions are met. Contact rob@peopleworklife.com to exercise these rights.

You can complain directly to the UK Information Commissioner’s Office without contacting us first. If we change the pilot scope, add testers or extend it, we will review this notice and the processing arrangements before doing so.