DATA PROTECTION / TRANSPARENCY
Privacy deserves specifics.
Not a compliance slogan.
VTO Manager has a professional pilot history, an independent public demo and a web host. They are different data environments, and this page distinguishes the facts we checked from the author's account and unresolved hosting questions.
1. Three environments, three different claims
| Environment | Information involved | Basis of statement |
|---|---|---|
| Original professional pilot | Actual operational and employee-related information, kept in restricted employer-controlled internal systems according to the author. | Author's account; no independent access or governance audit. |
| Public portfolio demo | Generated employee identities, schedules and event histories; in-browser changes are temporary. | Files reviewed in the supplied static bundle. |
| Cloudflare website delivery | Potential IP addresses, request metadata, security signals, logs and network-level cookies. | Cloudflare documentation; the account-level configuration has not been reviewed. |
2. What happened in the professional project
The author states that all real operational data were accessed and exchanged only within the employer's internal environment. The working information was held on an internal network with restricted shared access, not on this public website. Relevant material originated from employer-authorised sources and internal tooling.
No real employee records or operational datasets were sent to external generative AI tools. Development discussions with AI involved spreadsheet/table structures, not real populated tables. Several AI systems were used to challenge solutions and assist especially with the interface and technical implementation.
The author proposed the project and received approval from the direct Operations Manager to work on the initiative and support for a pilot with management colleagues on one operational shift. This reflects local operational sponsorship, not a blanket statement about company-wide security, privacy review or public redistribution rights.
Why it could still involve personal data
If an internal tool processes names, staff identifiers, work histories or related employee information, it involves personal data under GDPR even when held behind a VPN or company intranet. Restricted access is a security measure, not a substitute for a lawful basis, purpose limitation, access governance, employee information, retention rules and the employer's own legal assessment.
3. What the public demo does, and does not do
- Uses synthetic records: the app bundle provides fictitious people, shifts and events generated for demonstration. The portfolio analytics describe these fixtures, not the employer's real workers.
- No employer integration: no link to the original internal data source, identity service or internal workflow is present in the inspected static bundle.
- Browser-side example: calculations and edits of the synthetic scenario run client-side. No application-level endpoint submitting VTO workforce records to a remote database was found in the files inspected.
- Not completely storage-free: a limited interface preference (for example navigation layout) can be written to the browser's local storage. This is not an employee database.
- No external AI inference: the rules engine works deterministically from the provided input and does not call a generative AI service to choose employees.
- Do not enter real data: this public version is intended only for test scenarios. Users should not paste or import real employee or confidential employer records.
This assessment covers the supplied bundle. It is not a penetration test, a review of an unseen Cloudflare Worker wrapper, or an assurance about future code changes.
4. Cloudflare and visitor metadata
Opening any hosted page makes a network request. Cloudflare may process IP addresses, request details, security information and other technical metadata as the delivery and protection provider. Depending on enabled features, network-level cookies, analytics or logs may also exist.
What we checked: the uploaded static application did not contain a third-party analytics tag or application-level calls sending VTO data to an external server.
What remains to check: the exact Worker deployment, enabled analytics and bot/security tools, access logs, cookie behaviour, any extra scripts injected during deployment, retention periods, geographical processing, contractual roles and the appropriate visitor notice/contact details.
Cloudflare documentation: analytics categories, Cloudflare cookies. This page makes no claim that network traffic leaves no technical trace.
5. GDPR: what a responsible claim requires
GDPR compliance cannot be established solely by storing information on an intranet, replacing names with numbers or using fictional demonstration records. In the original work environment, the employer's applicable privacy governance, legal basis and staff information need to be assessed by the authorised teams. In this independent public version, the site operator must assess the hosting and visitor metadata processing.
Anonymised means people cannot realistically be reidentified; pseudonymised information remains personal data. This public demo uses generated fictional records instead of relying on a real dataset merely stripped of names.
Sources: CNIL on anonymisation and CNIL on identifying personal data.
6. Checks before wider publication
- Review the actual Cloudflare Worker settings, access logs, analytics, cookies and retention behaviour.
- Confirm that no real-person records or internal-only details are embedded anywhere in pages, fixtures, files or PDFs.
- Confirm any employer trademark/reference, screenshot and document permissions separately from pilot authorisation.
- Complete the public site's appropriate controller/contact and hosting disclosures once deployment configuration is verified.
- Recheck data flows after any code or hosting change.
This page is a project transparency statement and technical assessment summary, not a substitute for legally required notices or counsel.