Privacy notice

1. Who is responsible

The service operator’s legal entity name has not yet been provided. The registered postal address has not yet been provided.

For privacy questions or rights requests, email andrew@ripponconsulting.com. Your organisation normally acts as controller for personal data it uploads into its workspace; CertifyAI’s operator acts as processor for that data under the applicable service agreement. The operator is controller for its own account administration and security processing. Contractual roles must be confirmed in a data processing agreement.

2. Data we process and why

• Account email, user identifier, authentication information, workspace memberships and roles: to sign you in and provide controlled access.
• AI system details, classification answers, decision memos, document hashes, evidence states and audit events: to deliver the compliance workspace and maintain traceability.
• Plan, trial dates, subscription changes, payment attempts and payment/webhook outcomes: to administer billing. Hosted payment card entry takes place with Revolut, not in this app.
• Help conversation text, titles and timestamps: to answer your questions and let you revisit conversations. Your questions and relevant saved conversation history are sent to the AI service when you use the helper.
• Support messages you choose to send and technical error/security information: to respond to requests and maintain service reliability.

Do not include patient records, biometric samples, passwords, payment card details or other special-category data in the AI helper or support messages. Such data is not needed for product guidance.

Incident evidence and reminders

Incident attachments are intentionally stored in private Lovable Cloud storage, with filenames, content types, sizes, SHA-256 fingerprints and access audit records. This is separate from hash-only connector evidence verification. Authorised workspace members can download; authorised editors can remove files. Files remain until removed or an operator retention policy is applied. No malware scanning is currently provided: upload only trusted, minimised evidence and avoid unnecessary sensitive personal data. Recipient sharing is optional: an exported bearer link grants download access for seven days and may be revoked; a download URL already issued remains valid for up to one minute. Do not forward those links to unauthorised recipients.

FRIA review dates and incident reminder settings store responsible members and escalation choices. FRIA review dates are organisation-defined, not statutory annual deadlines. Sentinel keeps immutable status and ownership history. Reminders do not report incidents or replace immediate legal reporting obligations. Email delivery requires a configured sender domain; in-app reminders remain available.

3. Legal grounds

For the operator’s own processing, providing and administering the service relies on contractual necessity (Article 6(1)(b)) where applicable. For business users who are not parties to that contract, account administration, proportionate security and support may rely on legitimate interests (Article 6(1)(f)), subject to balancing and your right to object. Mandatory accounting or legal records rely on legal obligation (Article 6(1)(c)). Workspace data is processed on your organisation’s documented instructions; your organisation must establish its own lawful basis. No optional tracking is currently enabled; any future consent-based use must be disclosed and enabled only after valid consent.

4. Providers and disclosures

Lovable Cloud provides account and data services. The AI helper uses an OpenAI model through Lovable’s AI gateway. Revolut Sandbox handles connected test checkouts; otherwise payment outcomes are simulated in-app. Authorised members can access workspace records according to permissions; Help conversations are scoped to the individual account and workspace. Technical error reports may be processed by Lovable.

Email, Google sign-in and WhatsApp involve their respective providers when you choose them. WhatsApp is operated by Meta. External services have their own privacy terms. Fonts are served locally rather than fetched from Google Fonts. Trust evidence may include ledger references; do not place personal data in public ledger payloads. Simulated anchors are not live ledger transactions.

5. International transfers

Hosting locations, subprocessors and transfer safeguards have not yet been confirmed by the operator. Before production use, the operator must verify provider agreements, any transfers outside the EEA and the applicable adequacy decision or safeguards such as Standard Contractual Clauses, with supplementary measures where required. EU-only hosting is not currently promised.

6. Retention and deletion

Workspace records and saved Help conversations currently remain stored until the operator arranges deletion or applies an agreed retention schedule; no automatic expiry is configured. The operator must document retention periods for accounts, evidence, billing, logs and backups before production use. Ask the contact above to arrange deletion or an export; no self-service account deletion is currently provided.

Legal, security or accounting obligations may require limited continued retention. Data already published to an immutable ledger may not be removable; use non-personal references and hashes only.

7. Your GDPR rights

Where applicable, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You can withdraw consent without affecting prior lawful processing. Contact the email above; for data controlled by your employer, also contact your organisation. We may need proportionate identity verification. Requests should be answered within one month, with permitted extensions explained. You may complain to your local data protection supervisory authority, including the Italian Garante if relevant.

8. Cookies and browser storage

The app uses necessary authentication/session storage, a remembered workspace selection and a necessary-only privacy choice. The privacy choice is stored under certifyai-cookie-choice for up to 180 days. Session storage duration is managed by the authentication service; workspace preferences remain until removed or browser storage is cleared. No optional analytics or advertising cookies are enabled by the app. Necessary service storage does not require opt-in where the applicable exemption applies.

Use “Cookie settings” in the footer to review or renew your choice. Clearing browser storage removes the saved choice and can sign you out. Cookie choices do not disable operational server logs or change how external sites process data after you open them.

9. Security and automated decisions

Workspace access is restricted by database-enforced tenant membership and role permissions. Help history is private to its account and workspace. No security measure eliminates all risk. Classification outcomes are generated from a guided rules-based tree; the AI helper provides advisory text only. The app does not itself make decisions with legal or similarly significant effects about individuals. Any such use by your organisation requires a separate assessment and appropriate safeguards.