Privacy policy

YouMight SAS publishes YouMight, an AI simulation platform that allows organisations to assess and develop their people's managerial competencies through realistic scenarios.

Our role differs depending on the context. That distinction determines who you should send your requests to.

a) Data you provide

• Identity and contact details: first and last name, work email address, job title, organisation, phone number where applicable.
• Account: credentials, password (stored as a hash), role within your organisation's workspace, interface language, preferences.
• Simulation content: your written messages (chat, email), your spoken contributions during voice calls and meetings (audio recordings and transcripts), the documents you produce or upload within a simulation.
• Content you create: prompts, scenarios, training materials (PDF, DOCX, PPTX) uploaded to generate scenarios.
• Communications: messages sent to our team, support requests, demo request form (work email address and, if you choose to fill it in, your stated need), contact form (first name, last name, work email address, role and, if you choose to fill it in, your question).

b) Data generated by the platform

• Assessments: overall score, per-competency rating, the associated written reasoning, the message-by-message annotated replay, the history of attempts and progression.
• Usage data: simulations played, dates and durations, channels used, progress through learning paths.
• Organisation reports: aggregated indicators at team and company level (competency gaps, risk areas).

c) Data collected automatically

• Technical data: IP address, device type, browser, operating system, pages viewed, timestamps, connection logs.
• Cookies and trackers: see section 9.

Where we rely on legitimate interest, we balance that interest against your rights and freedoms. You may object to such processing at any time (see section 11).

Simulations and assessments rely on language and speech models. Your content is transmitted to our model providers in order to generate the characters' responses and the assessments.

The assessments produced by the platform are a decision-support and skill-development tool. They do not constitute a decision producing legal effects or similarly significantly affecting you within the meaning of article 22 of the GDPR: your employer decides, on the basis of meaningful human review and other elements of judgement. The message-by-message annotated replay exists precisely so that every rating can be verified by a human.

You may request an explanation of an assessment concerning you, express your point of view and contest the outcome with your employer, who is responsible for organising the review. We provide them with assistance.

Where the platform is used to evaluate people with a view to a decision affecting the employment relationship, it may qualify as a high-risk AI system within the meaning of Regulation (EU) 2024/1689: your employer must then inform you that an AI system is being used and ensure effective human oversight. The platform uses no emotion recognition, no social scoring and no individual surveillance.

Where we act as a processor, retention periods are set by your employer; the periods below apply in the absence of contrary instructions from them.

Your data is accessible to authorised YouMight staff, on a need-to-know basis, and to the administrators and authorised people within your organisation, according to the roles it has defined.

We rely on the following sub-processors, all bound by contractual confidentiality and security commitments:

Your data may also be disclosed to our advisers (lawyers, accountants, auditors), to administrative or judicial authorities where required by law, and to a potential acquirer in the context of a sale or restructuring. We do not sell your personal data and do not disclose it to any third party for advertising purposes.

We favour hosting and processing within the European Union. Where a transfer outside the European Union is necessary, it is framed by the appropriate safeguards required by the GDPR: an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework), or standard contractual clauses, supplemented where necessary by additional technical measures (encryption, minimisation).

You may obtain a copy of the safeguards in place by writing to contact@youmight.ai.

Our website uses strictly necessary cookies (language preference, security), which do not require your consent, and analytics cookies (Google Analytics), which are only set after you have given consent. In addition, we run consent-exempt first-party analytics, described below.

The banner displayed on your first visit lets you accept or decline. Until you accept, no data is sent to Google Analytics (consent mode, all parameters denied by default). Declining has no impact on your browsing, and you may change your choice at any time by clearing the site's cookies in your browser.

We also run first-party analytics, hosted on our own infrastructure in the European Union, which falls under the consent exemption for audience measurement. It is configured accordingly: no advertising cookie, no IP address retained, no persistent identifier stored on your device, no cross-site tracking, no transfer to a third party. The unique-visitor count relies on a technical identifier that is renewed every day and computed irreversibly, so it cannot follow you from one day to the next. The data collected (pages viewed, elements clicked, traffic source, device type, country) is used solely to measure the website's audience and is kept for 13 months at most.

Within the platform, we measure feature usage (PostHog) in order to fix errors and improve the product. That measurement is strictly limited to professional use of the platform, is never used for advertising, and is never used to monitor an individual employee.

We implement appropriate technical and organisational measures to protect your data: encryption in transit (TLS) and at rest, role-based access control, least-privilege principle, logging, vulnerability management and staff awareness training.

In the event of a data breach likely to result in a high risk to your rights and freedoms, we inform the relevant data controller without undue delay and, where applicable, the supervisory authority and the data subjects, in accordance with articles 33 and 34 of the GDPR.

Under the GDPR and the French Data Protection Act, you have the following rights:

• Access — obtain confirmation that your data is processed and receive a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — request deletion of your data, in the cases provided for by law.
• Restriction — request that processing you contest be temporarily frozen.
• Objection — object to processing based on legitimate interest, on grounds relating to your particular situation, and object to direct marketing at any time.
• Portability — receive the data you have provided to us in a structured, machine-readable format.
• Withdrawal of consent — at any time, where processing is based on your consent, without affecting the lawfulness of processing carried out beforehand.
• Post-mortem instructions — set out what should happen to your data after your death.

To exercise these rights, write to support@youmight.ai. If your request concerns your use of the platform within your organisation, please contact your employer first, as they are the controller for that processing; we will forward any request we receive and assist them. We may ask you for proof of identity in the event of reasonable doubt, and we respond within one month, extendable by two months for complex requests.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the French supervisory authority (Commission Nationale de l'Informatique et des Libertés (CNIL)): www.cnil.fr, or with the supervisory authority of your country of residence.

We may update this policy to reflect changes to the platform or to the law. The date of the last update is shown at the top of this page. In the event of a material change, we will inform you by email or by a message on the platform.