Privacy Policy

Last updated: draft, not yet published.

Overview

This Privacy Policy describes how MFLIX (“we”, “us”) collects, uses, and shares information when your organization (a “company”) and its members use the platform. It applies to all companies, groups, and individual accounts on MFLIX.

Data we collect

• Account information: name, email address, and authentication credentials.
• Organizational data: company, group, and role membership.
• Learning activity: path progress, assignment submissions, video playback events, and achievements.
• 360° feedback responses, scoped and anonymized per the review cycle’s configured visibility.
• Communications: notifications, broadcast messages, and support interactions.
• Technical data: IP address and device information, collected for rate limiting, security, and error diagnostics.

How we use data

• To operate the platform: authenticate accounts, enforce company/group data isolation, and deliver learning content.
• To generate progress, engagement, and review analytics visible to authorized group leaders, company owners, and platform staff.
• To send transactional notifications (assignment due dates, review cycle updates) and, where enabled, broadcast announcements.
• To detect and prevent abuse, including rate limiting and audit logging of administrative actions.
• To diagnose and fix errors, using aggregated error-tracking data that excludes sensitive form input.

Data sharing & sub-processors

We do not sell personal data. Data is shared only with infrastructure sub-processors necessary to operate the platform (hosting, database, video delivery, transactional email, and error monitoring), each bound by their own data processing terms, and within your own company/group as configured by your administrators’ role and visibility settings.

Data retention

Account and activity data is retained for as long as your company’s subscription is active. Deactivating a company, group, or user account hides it from active views but does not immediately delete underlying records, so that administrators can reverse the action; a permanent deletion request can be made through your account owner or platform support.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, or request deletion of your personal data. Requests should be directed to your company’s account owner, who can escalate to platform support.

Security

Every company’s data is isolated at the database level, administrative actions are logged to an audit trail, and authentication-sensitive actions are rate limited. See our security page for more detail on what’s actually shipped today.

Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected here with an updated revision date once this document moves past draft status.

Contact

Questions about this policy can be directed to your company’s account owner or platform support.