Privacy Policy

1. Data Controller

The data controller for personal data processed through the Sariio platform ("Service") is:

Sariio Limited
Company Registration Number: 15760535 (England and Wales)
C/O The Accountancy Partnership
Suite 5, 5th Floor, City Reach
5 Greenwich View Place
London, E14 9NN
United Kingdom

Email: hello@sariio.com

Sariio Limited ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data when you use the Service.

2. Data We Collect

We collect the following categories of data from users:

• Account information: Names and email addresses provided during registration or via magic link authentication.
• Assessment data: Survey responses to the MAPS preference assessment, including individual statement-pair selections via Visual Analogue Scale (VAS) sliders, and calculated scores including pair means, standard deviations, and preference classifications.
• Organisation data: Organisation name, industry sector, and role information.
• Usage data: Session information, feature usage, and tracking information.
• Payment data: Transaction identifiers and purchase records (payment card details are processed directly by Stripe and are not stored on our servers).

We do not intentionally collect sensitive personal data such as health information, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or data concerning sex life or sexual orientation.

3. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR:

• Contract performance (Article 6(1)(b)): Processing necessary to provide the Service, including generating assessment results and comparison reports.
• Legitimate interests (Article 6(1)(f)): Processing for service improvement, security, fraud prevention, and anonymised research, where our interests do not override your rights.
• Consent (Article 6(1)(a)): Where we rely on your consent (e.g., for marketing communications or optional data sharing), you may withdraw consent at any time.
• Legal obligation (Article 6(1)(c)): Processing necessary to comply with our legal obligations.

4. Purpose of Data Collection

We use your data to:

• Provide the core Service, including assessment scoring, preference profiling, and comparisons.
• Generate AI-powered narrative summaries and comparison reports.
• Improve the functionality and user experience of the Service.
• Facilitate account management and communications.
• Process payments and manage your subscription.
• Generate anonymised and aggregated analytics for platform improvement.

5. Third-Party Data Processors

We share your data with the following third-party processors, each operating under appropriate data processing agreements:

• Anthropic (AI processing): Your preference data (pair scores and authored orientation content) is transmitted to Anthropic's API to generate narrative summaries and comparison reports. Anthropic processes this data under their data processing addendum and does not use it to train their models.
• Stripe (payment processing): Payment card details and transaction information are processed directly by Stripe. We do not store your full payment card details on our servers.
• Render.com (hosting and infrastructure): The platform is hosted on Render.com infrastructure running on Amazon Web Services eu-central-1 in Frankfurt, Germany. All data processed by Render remains within the European Economic Area. Render holds SOC 2 Type II Attestation of Compliance.
• Resend (email delivery): Transactional emails (such as survey invitations, magic link logins, and report sharing notifications) are delivered through Resend.

We may add, change, or remove third-party processors. Material changes will be reflected in updates to this Privacy Policy.

6. Sharing of Data

We only share your personal data under the following conditions:

• With the third-party processors listed in Section 5, for the purposes described.
• With your explicit consent, such as when comparing survey results with other users within the same organisation or via a dyadic comparison invitation.
• When data is aggregated and anonymised for research, analytics, or platform improvement (anonymised data is no longer personal data).
• To comply with legal obligations, respond to lawful requests, or enforce our Terms.

We do not sell your personal data to third parties.

7. International Data Transfers

Our platform infrastructure is hosted in Frankfurt, Germany (European Economic Area) via Render.com on Amazon Web Services eu-central-1. Core platform data for EU and UK clients does not leave the EEA. One of our third-party processors (Anthropic) is based in the United States. Where personal data is transferred outside the UK or European Economic Area, we ensure appropriate safeguards are in place through Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office.

8. Data Storage and Retention

Your data is stored on servers in Frankfurt, Germany (EU) provided by Render.com on Amazon Web Services eu-central-1. Data is retained only as long as necessary to fulfil the purposes outlined in this policy:

• Account data: Retained while your account is active and for a reasonable period thereafter to allow for account reactivation.
• Assessment data: Retained as part of your MAPS history to enable longitudinal preference tracking.
• Payment records: Retained as required by applicable tax and accounting regulations.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:

9.1 Infrastructure Security

The Service is hosted on Render.com infrastructure running on Amazon Web Services eu-central-1 (Frankfurt, Germany), benefiting from AWS eu-central-1's ISO 27001, SOC 1/2/3, and PCI DSS certified data centres. Our hosting provider, Render.com, holds SOC 2 Type II Attestation of Compliance. Network protection includes a Web Application Firewall (WAF), load balancing, private networking for internal services, and rate limiting on authentication and API endpoints.

9.2 Encryption

All data in transit between your device and our servers is encrypted using TLS 1.2 or higher. All data at rest, including database records and backup copies, is encrypted using AES-256 server-side encryption provided by AWS eu-central-1. Encryption key management is handled by AWS Key Management Service (KMS).

9.3 Database Security

Our PostgreSQL database is managed through Render.com's managed database service, operating on AWS eu-central-1, with automated patching and continuous health monitoring. Database access is restricted to the application layer; no database port is exposed to the public internet. All database connections use SSL/TLS encryption. Multi-tenancy data isolation is enforced at both the database and application layers, ensuring organisations cannot access each other's data.

9.4 Backup and Disaster Recovery

We maintain multiple backup layers to protect against data loss:

• Automated daily backups with configurable retention, hosted on AWS eu-central-1.
• Point-in-time recovery to any specific second within the retention window, minimising data loss in the event of corruption or accidental deletion.
• Application-level exports allowing authorised administrators to create independent backup exports of critical data.
• Automated failover if the primary database becomes unavailable.

The application server is stateless; all persistent data resides in the database, which has its own independent redundancy. A complete loss of the application server results in zero data loss.

9.5 Application Security

All user input is validated server-side. Content Security Policy (CSP) headers restrict executable resources. Authentication is via magic link (passwordless), with session management via secure, HttpOnly cookies.

No system is completely secure, and we cannot guarantee absolute security.

10. User Rights

Under UK GDPR, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request corrections to inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data, subject to our legal obligations.
• Right to restriction: Request that we restrict processing of your data in certain circumstances.
• Right to data portability: Request your data in a structured, commonly used, machine-readable format.
• Right to object: Object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.
• Right to lodge a complaint: You have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data rights have been violated.

To exercise these rights, contact us at hello@sariio.com. We will respond within one month of receiving your request.

11. Cookies and Tracking

We use cookies and similar technologies to:

• Maintain your authenticated session.
• Analyse website performance and usage patterns.
• Improve user experience.

You can manage cookie preferences through your browser settings.

12. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will take steps to delete it.

Data Usage Policy

This Data Usage Policy explains how Sariio Limited uses and protects the data you provide.

1. Data Use

Your data is used to:

• Generate personalised preference profiles and AI-powered narrative summaries.
• Improve our algorithms, AI prompts, and services.
• Conduct anonymised research to enhance the Service.

2. AI Processing

When AI-powered features generate narrative summaries or comparison reports, your preference data is processed by Anthropic's large language models. AI-generated outputs are stored and cached for subsequent views. We do not use your personal data to train AI models, and we require the same commitment from our AI providers.

3. Anonymisation and Aggregation

We aggregate and anonymise data to:

• Conduct performance and usage analysis.
• Develop marketing materials and insights without identifying individual users.
• Generate benchmark statistics and research findings.

Anonymised data cannot be used to identify individual users and is no longer considered personal data under GDPR.

4. Data Access and Control

We ensure:

• Only authorised personnel and systems have access to personal data.
• You have control over your data, including opting out of specific uses.
• Access to personal data is logged and auditable.

Consent Management Policy

This Consent Management Policy outlines how we obtain, manage, and honour user consent regarding personal data.

1. Consent Mechanisms

Consent is obtained through:

• Clear opt-in options for data collection and third-party sharing.
• Survey consent captured before the assessment begins, explaining how data will be used.

2. Withdrawing Consent

You may withdraw your consent at any time by:

• Adjusting settings in your account.
• Contacting us at hello@sariio.com.

Upon withdrawal, data processing will cease, except where required by law.

3. Consent Records

We maintain an audit trail of all consents provided to ensure compliance with UK GDPR.

4. User Control

Users can:

• Customise consent preferences.
• Contact us to request changes to their data processing.

Contact Us

For questions about any of these policies, please contact:

Sariio Limited
C/O The Accountancy Partnership
Suite 5, 5th Floor, City Reach
5 Greenwich View Place
London, E14 9NN
United Kingdom

Email: hello@sariio.com