Who we are
The Climb is an artificial intelligence training platform for teams in companies. It is published by The Tech Nation S.L., NIF B19412451, Passeig de Gràcia 2, 08007 Barcelona, España.
Contact for any question about your data: jeremie@the-tech-nation.com. We have not appointed a data protection officer.
This policy explains what data The Climb processes, why, who can see it, how long we keep it and how to exercise your rights. It describes what the application actually does today.
Who decides what
Data of our clients' team members
When a company buys The Climb for its teams, the company decides to train its team members, to invite them and to follow their progress. The client company is the controller of its team members' data. The Tech Nation is its processor: we process this data on its behalf and on its instructions, under the data processing agreement.
If you are a team member of a client company, please contact your employer first with any question or request. If you write to us, we pass your request on to your employer and help them answer it.
Data The Tech Nation is responsible for
The Tech Nation is the controller for:
- buyers and contacts at our clients (order, invoicing, account administration);
- visitors to The Climb's website and demo;
- participants in the public AI Maturity Path questionnaire;
- Yetis (our distribution partners) and people who apply to become one;
- requests sent through The Climb's forms;
- feedback that Yetis send us;
- accounts created freely on The Climb, without a client company.
Prospects entered by a Yeti
A Yeti can keep, in their space, a list of the companies and contacts they approach. The Yeti is the controller of this data: they choose whom they add and why. The Tech Nation hosts it for them, as a tool, and does not use it for its own outreach.
The data we process
Team members of a client company
- Identity and account: name, work email, role in the application (climber, Sherpa, admin, People), team, status, invitation, arrival and departure dates, login identifier, date of last visit.
- Entry and follow-up questionnaire: answers question by question (including your role and the company size), level reached, six self-assessment scores, badges.
- Progress: experience points, streak of active days, steps and checkpoints passed, last activity, chosen avatar, the AI tool you say you use, and the active time spent in the app, in total and per step (only the seconds when the tab is visible and you acted in the last two minutes count).
- Exercises: for each exercise, the status, score, number of attempts and a few short details (tool, mode, boxes ticked, review by a Sherpa). The text of your answers is not kept.
- Reviews: successes and mistakes, to bring concepts back at the right time.
- Signals: blockers you report, with an optional free note, and your answers to the team weather (feeling, obstacle, hope, free "Other" field).
- Certificates: full name, company name, programme, level, skills, dates, status, and an electronic signature of the certificate. A cryptographic fingerprint of the certificate is anchored in the Bitcoin blockchain to prove its date (see below).
- Support: when The Tech Nation team opens a support session in an account, who asked for it and why.
- Audit log: administration actions (who, what, on what, when), without email addresses.
- Technical data: IP address, browser, pages requested, recorded by our hosting providers in their logs.
The Climb does not ask for any sensitive data (health, opinions, etc.). Please do not enter any in free text fields.
Buyers and client contacts
- Company name, legal name, billing address, VAT number.
- Name and email of the person who orders or who will become admin, name of the contact given at checkout.
- Number of seats, price, payment and invoice history, the Yeti code used if any.
- Card details are entered directly with Stripe. We do not see them.
Website and demo visitors
- Technical browsing data (IP address, browser, pages requested).
- What The Climb stores in your browser, described on the Cookies and local storage page.
AI Maturity Path participants
- Answers to the questionnaire, level, scores, role and company size you give.
- If you create a team: team name, your email, your choice to receive news from The Climb or not. Your colleagues' results are linked to a random identifier of their browser, without a name.
- During an event, if you choose to appear on the screen: the first name you type, your avatar and your progress.
- If you ask to receive your plan: name, email, company, message, wish to be called back, your newsletter choices, level, scores, role, company size, where your visit came from (campaign link, referring site, landing page) and your IP address. This request is sent to the the-tech-nation.com website, which also belongs to The Tech Nation.
Yetis and Yeti applicants
- Application (with or without an account): name, email, optional phone number, country, current activity, motivation, target countries and sectors, how they find clients, fit with their activity, billing status (company, country, optional tax number), optional LinkedIn profile and website, language, decision and internal note. For an application without an account, the IP address as a fingerprint, to limit abuse.
- Yeti training: an accepted Yeti takes The Climb training in the company "Yetis · The Tech Nation". Their learning data is that of a team member (see above). The Tech Nation is then the controller of this data, and the other Yetis in training see their name and progress, as teammates.
- Active Yeti: name, organisation, language, login email, invitation status, activity dates, number of times their links were opened, codes, client companies brought in, price requests (with their reason), commissions and payments.
- Feedback: free text, client mentioned if any, mood, our team's reply.
A Yeti's prospects (hosted for the Yeti)
- Company name, contact name, stage, free note, next action.
- Openings of links sent by the Yeti: page, channel, and the company name and number of seats the Yeti put in the link.
Form requests
- Email, company, subject of the request (workshop, language, track, consulting assignment with its details), free note.
- Your IP address as a fingerprint (pseudonymised), to limit abuse.
Why, and on what legal basis
For a client's team members
The purposes are set by the client company: training its teams in AI, following progress, engaging teams, issuing certificates. The Tech Nation also uses, only as totals and without names, the time spent and the number of refused proofs per step to improve the content of The Climb. The legal basis is the client company's, usually its legitimate interest in training its teams (article 6.1.f GDPR) or the performance of the employment contract (article 6.1.b). The client company must inform its team members, and where relevant their staff representatives, of what managers can see (see "Who sees what").
The Climb makes no automated decision with legal or similarly significant effects on anyone. No AI assesses team members. There is no advertising and no sale of data.
For our own processing
| Purpose | Legal basis |
|---|---|
| Handle the order, open and manage the subscription, provide support | performance of the contract (art. 6.1.b) |
| Invoice, keep accounts, meet our tax obligations | legal obligation (art. 6.1.c) |
| Answer a request sent through a form or the AI Maturity Path | pre-contractual steps (art. 6.1.b) or legitimate interest in answering (art. 6.1.f) |
| Send you news from The Climb when you asked for it | consent (art. 6.1.a), which you can withdraw at any time |
| Tell our clients about new features close to what they bought | legitimate interest (art. 6.1.f) and article 21.2 of the Spanish LSSI-CE, with an opt-out in every email |
| Run the Yeti programme: applications, access, sales attribution, commissions | pre-contractual steps then performance of the contract (art. 6.1.b), legal obligation for payments (art. 6.1.c) |
| Host a Yeti's prospect list | performance of the contract with the Yeti (art. 6.1.b); the legal basis towards their prospects is the Yeti's |
| Show a progress screen during an event | your choice to appear (consent, art. 6.1.a) |
| Secure the service, limit abuse, keep the audit log | legitimate interest (art. 6.1.f) |
| Establish, exercise or defend legal claims | legitimate interest (art. 6.1.f) |
Who sees what in the application
| Who | What they see |
|---|---|
| Member (climber) | Their own data. On their team map: the name, team, entry and current self-assessment scores, steps passed and last activity of their teammates and of the company's Sherpas. Other colleagues appear without name or team, with their progress. |
| Sherpa | The same as a member. In addition, their name and progress are visible to all members of the company. They also see their team's proofs sent to review (the person, the step, the date), look at the method with the person and can leave them a note. People and the admin see the same queue for the whole company. |
| Client admin | The full list of team members with their emails, roles, teams and statuses, invitations and departures, billing. And, like People, each person's progress by name. |
| Client People | For each person, by name: entry level and scores, current scores, experience points, streak, steps and checkpoints passed, last activity, total active time. Team weather and blockers only as totals, per team, and only from 5 responses, with no names or notes. |
| Yeti | For the companies they brought in: company name, seats, price paid, their commission, term, dates, status. Their own codes, price requests, prospects and feedback. Never team members' data. |
| The Tech Nation team | Companies, team members' names and emails, progress, the audit log, requests, applications, Yetis, commissions, feedback. It only accesses them to provide the service, support and security. It only opens a support session in a member's account at the request of the client or of the person, or to handle an incident; the session is recorded with its reason. |
| Public | On a certificate's verification page (/verify), anyone who has the certificate's link or number sees the full name, company, programme, level, skills, dates and status. On a Yeti's link, the Yeti's name. With the link to a named offer, the name and email of the future admin and the company name. During an event, the public screen shows the first name, avatar and progress of participants who chose to appear, for 8 hours. |
AI integrations (MCP)
The Climb offers access through the MCP protocol, which lets you connect an AI assistant (a chat assistant, for example) to some of The Climb's tools.
- Who can use it: only Yetis and The Tech Nation team. Clients' members, Sherpas, admins and People have no MCP tools.
- How: connecting requires an explicit authorisation (OAuth, handled by Clerk). Each call is limited to the permissions granted, the role is checked again every time, and every change made this way is written to the audit log with the identifier of the connected assistant.
- What a Yeti can read: their profile, their codes and the companies they brought in, their commissions, their price requests, their prospects (with contact names and their notes) and their feedback.
- What The Tech Nation team can read: companies and their team members (names and emails), the audit log, requests received, Yeti applications (with the LinkedIn profile), Yetis, commissions, feedback. It can also open a support session.
- Good to know: whatever a tool returns enters the conversation of the chosen AI assistant, and so reaches the provider of that assistant. The Climb itself does not call any AI model.
How long we keep data
These periods are maximum periods. A team member's departure is handled automatically by the application; for other data, automatic deletion is being put in place and, until then, we apply it through regular reviews and on simple request.
| Data | Period |
|---|---|
| Active team member | for the term of the client company's contract |
| Team member who leaves the company | access cut as soon as the admin records the departure; automatic pseudonymisation 30 days later: name, email and team replaced, name erased from their certificates (which remain verifiable without a name), free notes on their blockers and review notes erased, login account deleted if it serves no other company. Progress remains, linked to a profile with no name or email. The admin can cancel the departure before the 30 days are over. |
| Client company account (team members, progress, certificates, settings) | for the term of the contract, then 6 months (for reactivation or export), then deletion |
| Buyers and client contacts | for the term of the contract, then 6 months, except what appears on invoices |
| Invoices and accounting records | 6 years (article 30 of the Spanish Commercial Code) |
| Unused named price offers | 12 months after they expire |
| Security logs, audit log, support sessions | 12 months |
| Form requests | 12 months after the last exchange, or for the term of the contract if you become a client |
| AI Maturity Path: teams and results | 12 months after the team is created |
| AI Maturity Path: event screen | shown for 8 hours, deleted within 7 days |
| Agreement to receive our news | until you withdraw it |
| Yetis: profile, codes, commissions | for the partnership, then 12 months; payment records 6 years |
| A Yeti's prospects, openings of their links, Yeti feedback | for the partnership, then 12 months; the Yeti can delete a prospect at any time |
| Rejected Yeti applications | 12 months |
| Account created freely, without a client company | deleted after 12 months without login |
| Storage in your browser | on your device, until you clear it (see Cookies and local storage) |
Our hosting providers' backup copies disappear at the end of their rotation cycle.
The certificate case. To prove its date, a cryptographic fingerprint of the certificate is written into the Bitcoin blockchain through the public OpenTimestamps service. This fingerprint contains no name and cannot be erased, but it cannot be used to identify anyone once the certificate has been deleted.
Processors and recipients
We use providers to host the application, manage logins, collect payments and send emails. The full list, with what each one processes and where, is published on the Subprocessors page. Any new subprocessor for team members' data is announced to clients at least 30 days in advance.
Other recipients:
- Yetis, only for the data described in "Who sees what";
- authorities, when the law requires it.
We do not sell any data.
Transfers outside the European Union
Several providers are based in the United States. The application is hosted in the United States: server functions at Vercel (Washington region) and the database at Convex (default region, in the United States). Logins go through Clerk, also in the United States.
These transfers rely on the safeguards offered by the provider (Data Privacy Framework or standard contractual clauses). The Data Privacy Framework rests on the European Commission's adequacy decision (EU) 2023/1795, for certified companies; standard contractual clauses rest on decision (EU) 2021/914. Details per provider are on the Subprocessors page.
Your rights
You can ask for access to your data, its rectification or erasure, restriction of processing, object to processing and ask for portability (articles 15 to 21 GDPR). You can withdraw consent at any time.
- Team member of a client company: contact your employer. If you write to us, we pass your request on to them within 5 working days.
- A Yeti's prospect: contact the Yeti who reached out to you. We can also pass your request on to them.
- Anyone else: write to jeremie@the-tech-nation.com. We reply within one month.
You can also lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es), our supervisory authority. If you are in France, you can contact the CNIL (www.cnil.fr).
Security
- Logins handled by Clerk: password, code or link sent by email, two-factor authentication available.
- Permissions checked on the server, on every request, according to the person's role; each company only sees its own data.
- Encrypted connections (HTTPS).
- Access cut as soon as a departure is recorded.
- Audit log of administration actions and changes made through MCP; support sessions recorded with their reason.
- Team weather and blockers shown to managers only as totals, from 5 responses.
- Public forms limited against abuse; IP addresses kept as fingerprints.
- Certificates signed electronically, so that they cannot be forged.
Detailed measures are in annex 2 of the data processing agreement.
Minors
The Climb is a service for professionals only. It is not aimed at children. If a company invites a team member who is a minor (an apprentice, for example), the company is responsible for it.
Changes
This policy may change as the service evolves. The version date is at the top of the page. We notify our clients by email of any significant change.