Draft. The technical sections describe the platform as built. The sections marked awaiting wording have not been reviewed by a lawyer and must be replaced before this page is public.

Privacy policy

Last updated 25 September 2026

OnTrac Tracker records the progress of people taking part in a capability programme run by their employer. This page explains what it stores, where it is stored, and who can see it.

Who controls your data

Your employer decides that you take part in a programme and what is measured. They are the data controller. OnTrac operates the platform on their instructions as a processor. Awaiting wording: the controller and processor entities, and the contact address for data requests.

What is recorded

• Your name and work email address, so you can sign in and so your manager can find your record.
• The readings you file each week against the metrics your programme defines.
• Whether you completed each activity, and the written answers you give to reflection activities.
• The choices you make in a simulation, including runs you abandon part way.
• Whether you recorded your manager’s sign-off for a week.
• What you say to the AI Coach, and what it says back.
• A log of changes to any of the above — what changed, when, and by whom.

There are no passwords. Signing in uses a link sent to your email address, or your employer’s own Google or single sign-on, so the platform holds no password to lose.

Where it is stored

All data is held in India and is not replicated outside it, with one exception, described under the AI Coach below. The database is in Mumbai and the application servers are in Bangalore. Metric names, written answers and other free text are encrypted with AES-256-GCM before they reach the database, so they are unreadable in a backup or a database dump. Email addresses are additionally stored as a keyed hash so a record can be found without the address itself being searchable in the clear.

Who can see it

• You see your own record in full.
• Your direct manager sees your record, by name.
• Leadership above your manager sees aggregate figures for their part of the organisation — percentages and counts, never a named individual’s entries.
• Your employer’s administrators see the programme and cohort configuration, and aggregate progress.
• Other organisations see nothing. Isolation between clients is enforced in the database itself, not in application code.

Learners in the same cohort at the same employer may see aggregate progress for that cohort. They cannot see each other’s entries.

The AI Coach

The coach is the one part of this platform that sends your information outside it, and it is worth being exact about what that means.

• What is sent. When you message the coach, your message is sent to Anthropic, which operates the model that answers. So is a summary of your record: your programme and week, the metrics you track and the readings you have filed, your activities, and the reflections you have written. The coach is only useful because it can see these; you should assume everything you have entered into this platform can be part of a coaching conversation.
• Where it goes. Anthropic processes this outside India. The video coach is operated by Tavus and the spoken coach by ElevenLabs, who also process it outside India. These are the exceptions to the residency statement above.
• If you speak to it. Voice mode is operated by ElevenLabs, who transcribe what you say and speak the replies. Your recorded speech reaches them, and they process it outside India. Where no voice provider is configured the browser’s own speech recognition is used instead, which means your speech is processed by the browser vendor — Google in Chrome, Apple in Safari. Either way, if you would rather that did not happen, type instead.
• The language you choose — English, Hindi or Telugu — is stored against your account so the coach keeps using it. So is whether you prefer a female or male voice.
• Who can read it. Nobody but you. Coaching conversations are the only records here that your manager, your facilitator and OnTrac’s own administrators cannot see. That is enforced in the database, not by policy. A coach your manager can read is not a coach.

Awaiting wording: the data-processing terms with the model provider, and whether conversations may be used for any secondary purpose. They are not today.

How long it is kept

Records are kept until they are deleted deliberately. Nothing expires on a timer, because a programme’s value is in its history. Awaiting wording: the deletion request process and the timescale your employer commits to.

Your rights

Awaiting wording: access, correction, erasure and objection rights under the applicable law, how to exercise them, and the supervisory authority to complain to. In practice, the platform already lets you correct any reading or answer you have filed for the duration of your programme.

Cookies

The platform sets only the cookies needed to keep you signed in. There is no advertising, no analytics sold on, and no third-party tracking.

Changes to this policy

Awaiting wording: how changes are notified.