Privacy Policy
Last updated:
What we collect
Your account details, the skills you claim and verify, your development plans and the work you submit against them, feedback given and received, and — where your company switches them on — leave records, interview recordings and an uploaded CV.
Why we use it
To run the product you or your employer signed up for: verify skills, draft and track plans, show progress, and keep an audit trail. Analytics tell us which parts of the product work. Nothing is sold, and nothing is used for advertising.
Who else sees it
Inside a workspace, the people your company's permissions allow. Outside it, the providers that host the product, send its email, monitor its errors and run its AI agents — each named below, each bound by a contract, none of them free to use your data for their own purposes.
Your rights
Access, correction, deletion, a copy of your data, and an objection to how it is used. If you use PDP Quest through your employer, ask your workspace admin first — they hold the account — and we help them answer. Otherwise, ask us directly.
1. Who we are
PDP Quest is built and operated by Armenian PM, the company of its founder Hovik Tamazyan, based in Armenia. Armenian PM is the service provider for everything on pdpquest.com and on the company workspaces served from its subdomains, and is the party this policy means by "we".
You can reach us through the contact page, or by email at [email protected]. Either route reaches a person, not a queue.
2. Who this policy covers
This policy applies to pdpquest.com, to the company workspaces served on its subdomains, and to the emails the product sends.
Two kinds of people read it. Visitors and prospective customers — you browse the site, read the blog, or book a demo — for whom PDP Quest decides what is collected and why. And workspace users — you were invited by your employer and sign in at your company's address — for whom your employer decides: it chose the product, it invited you, it configured which features and agents are on. PDP Quest processes your data on your employer's instructions under the agreement it signed with us. Where this policy says "your company" or "your admin", that is who it means.
3. What we collect from visitors
If you book a demo or contact us, we keep what you type: your name, work email, company, job title, team size, which part of the product you want to see, and what you are hoping to achieve. We use it to reply to you and to prepare for the conversation, and for nothing else. It is not added to a marketing list.
The public site uses Google Analytics to understand which pages are read and where visitors come from. The blog counts readers with a random identifier that is not linked to you. The sign-in and password-reset pages are protected by Cloudflare Turnstile, which looks at how a request behaves to tell people from scripts.
4. What we collect inside a workspace
Account details: your name, work email, job title, who you report to, your location and country, and a profile picture. Passwords are stored only as a one-way hash; we cannot read them.
Skills and assessments: the skills you claim, the level you claim them at, every assessment you take with its questions, your answers, the time taken and the result, and the verified levels that follow. Development plans: the goals, topics and activities in your plan, the exercises generated for you, what you submit against them and how it was graded, and your manager's review.
People and recognition: feedback you give and receive, including notes your manager marks as manager-only, kudos, and the team view of who reports to whom. Gamification: XP, levels, badges, streaks, quests and your leaderboard position, all derived from the above.
Optional features your company may switch on: leave requests, balances and any certificate you upload with them; a spoken development interview, which is recorded and transcribed; a CV or LinkedIn export you upload so that a starting set of skills can be proposed from it; and an illustrated avatar generated from a photo you provide, after which the original photo is deleted — the avatar is the only picture kept.
Records the product keeps about itself: when you signed in, what was changed and by whom in the audit trail, which AI agents were called on your behalf, and error reports when something breaks.
Information you provide
- Name, work email, job title, who you report to, location
- The skills you claim, and the level you claim them at
- Plans, goals, and the work you submit against them
- Feedback and kudos you write
- Optional: a CV, a leave certificate, a photo for your avatar
Recorded as you use it
- Assessment answers, the time taken, and the result
- XP, levels, badges, streaks and leaderboard position
- Sign-in times, and the audit trail of what changed
- Which AI agents ran on your behalf
- Product analytics, session replay, and error reports
From your identity provider
- Only when your company switches on Google or Microsoft sign-in
- The account identifier, and whether the email is verified
- The email address and the name on the account
- Nothing else is requested, and no HR or payroll system is connected
5. Why we use it
To provide the service: to verify skills, draft and track development plans, show progress, route reviews to the right manager, calculate XP and badges, and give your company the analytics it bought. To keep it secure: to detect abuse, rate-limit sign-in attempts, and investigate failures. To improve it: to see which features are used and which are abandoned, in aggregate.
We do not sell personal data, share it with advertisers, or use it to build profiles for any purpose other than the product itself. The AI agents that draft plans and questions do not train on your data; every request is a single call with a single answer.
Run the product you signed up for
Shape your plan around you
Show progress and analytics
Send the email you asked for
Keep it secure and stop abuse
6. Who else processes it
PDP Quest runs on a small number of providers, each of which handles only what its job needs and is bound not to use it for anything else. Railway hosts the application and its databases. Cloudflare provides DNS, encryption in transit and the bot check on sign-in. Resend delivers invitation and password-reset emails. Sentry receives error reports, in its EU region, so that failures can be fixed; those reports can include the request that failed.
Anthropic runs the AI agents that draft development plans, write exercises and assessment questions, and grade scenario answers; it receives the text those tasks need — a plan, an interview transcript, a skill definition — and returns a draft. OpenAI transcribes and voices the spoken interview, and generates the illustrated avatar from a profile photo; xAI is used for avatar generation only if a company configures it instead.
Inside the signed-in product, Amplitude records which screens are used and how, including session replay, so that we can see where people get stuck; it does not run on the public site. Google Analytics runs on pdpquest.com only — not inside the product, and not on your company's own sign-in page.
Some of these providers process data outside the country you are in. Where they do, we rely on their published data-protection terms and standard contractual clauses. A list of current providers is available on request and is kept in step with this page.
7. How companies are kept apart
Every company's data lives in its own separate database, served from its own subdomain. A session belongs to one workspace and is refused by every other. Nobody at one company can reach another company's data through the product, and PDP Quest's own access to a workspace is limited to support, is logged, and is visible to that company's admins.
9. How long we keep it
Workspace data is kept for as long as your company's workspace is active. When a company ends its agreement, its database is deleted on its instruction; a company can also ask for an individual's data to be removed at any time, and a departing employee's account is deactivated by their admin. Sign-in records, audit entries and error reports are kept for as long as they are needed to secure and support the service, then removed.
Demo requests and enquiries are kept until they have been answered and for a reasonable period afterwards. Analytics data is retained according to each provider's settings.
10. Security
Passwords are hashed, never stored. All traffic is encrypted in transit. Each company's data is isolated in its own database. Access inside a workspace follows the roles your company sets, and every administrative change is written to an audit trail your admins can read. Sign-in is rate-limited and protected against automated attempts. If we ever become aware of a breach affecting your data, we will tell the affected company without undue delay.
11. Your rights
You can ask to see the personal data held about you, to have it corrected, to have it deleted, to receive a copy of it in a usable format, and to object to a particular use of it. Depending on where you live, some of these are legal rights and others are things we will do anyway.
If you use PDP Quest through your employer, your employer holds the account and decides on these requests; ask your workspace admin first, and we will help them answer. If you are a visitor or a prospective customer, contact us directly and we will respond within thirty days. Where the law gives you the right to complain to a supervisory authority, this policy does not take that away.
12. Children
PDP Quest is a workplace product and is not intended for anyone under sixteen. We do not knowingly collect data from children; if you believe we have, contact us and we will delete it.
13. Changes to this policy
When the product changes what it collects or who processes it, this page changes with it, and the effective date at the top moves. Material changes are announced to workspace admins before they take effect. Earlier versions are available on request.
14. Governing law
This policy is governed by the laws of the Republic of Armenia, where Armenian PM is based. Nothing in it removes protections you have under the data-protection law of the country you live in, and where that law gives you the right to complain to a supervisory authority, you keep it.
15. Contact
Questions about this policy or about your data can be sent through the contact page, or by email to [email protected]. Admins of a customer workspace can also reach us from inside the console, which arrives with the context of their company attached.
“Your privacy helps build brighter opportunities for everyone.”
