Data privacy

Who is responsible for your data

Sophyra Limited is the data controller for your account and billing data: a company registered in Ireland (company number 817595). Our registered office is First Floor, Penrose 2, Penrose Dock, Cork, T23 YY09, Ireland.

For the school information you enter into the product, including any staff records, training records and governance documents, your school is the data controller and Sophyra Limited acts as a data processor on your instructions. We process that information only to provide the service to your school, and never for our own purposes.

For any privacy matter, contact privacy@sophyra.ie.

What personal data we collect

• Account data you provide at sign up: your name, email address, and your school's name, type, address, country and website.
• The information you enter into the product as you use it: obligation statuses and owners, policy and publication records, governance meeting and activity records, uploaded documents, staff names and their training records, and your readiness self-evaluation.
• Billing data when you subscribe: handled by our payment processor, Stripe. We receive confirmation of your subscription status; we do not see or store your full card details.
• Technical data needed to run the service securely: IP address, browser and device type, and authentication session data.

Legal bases for processing

• Contract for providing the service to you and your school, including the free trial and any subscription.
• Legitimate interests for operating the service securely and preventing fraud.
• Legal obligation for retaining billing records required by tax and accounting statute.
• Consent where we ever rely on it, which you may withdraw at any time.

Who we share data with (processors)

We use a small number of trusted service providers to run the product. Each acts as a processor under written terms and applies appropriate technical and organisational measures:

• Supabase provides the database, authentication and document storage, hosted in the European Union (Frankfurt, Germany). Each school's data is isolated by row-level security so a school can only ever see its own data.
• Stripe processes card payments and issues our invoices under its own terms as our payment processor; Sophyra Limited is the seller.
• Anthropic Ireland, Limited, with processing in the United States by Anthropic, PBC under standard contractual clauses, processes documents you submit to the Companion Assistant to produce its reports, and, where Ask Companion is enabled for your school, the compliance, governance, readiness, training and calendar records it retrieves to answer your question. Ask Companion retrieves only what your own account may already see in the product, it never receives pupil records or safeguarding case material, and staff appear only as the names and training status your school has entered. Both are processed under Anthropic's Commercial Terms and Data Processing Addendum, with Anthropic as our processor, are not used to train models, and are retained by Anthropic for at most 30 days for safety monitoring.
• Vercel Inc. hosts the application and stores the technical data necessary to serve it.
• Resend Inc. delivers the email we send on our behalf, such as forwarding a message you submit through the report-a-problem form to our support inbox.

OpenAI receives limited advertising measurement data only if you accept advertising cookies; see Advertising measurement below.

We do not sell or rent personal data. International transfers outside the UK or EEA are made under Standard Contractual Clauses or an equivalent Article 46 safeguard.

How long we keep your data

We keep your account and the school data you enter for as long as your account is active. If you close your account, we delete the school data within 30 days, except where we must retain billing records for six years to meet statutory tax and accounting requirements. You can ask us to delete your data sooner, subject to those legal retention obligations.

Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time, where consent was the basis
• Complain to a supervisory authority. Our lead supervisory authority is the Data Protection Commission of Ireland; if you are in the UK you may also complain to the Information Commissioner's Office.

Cookies

By default we use only the cookies necessary for the service to function, such as the cookie that keeps you signed in. The one exception is optional advertising measurement, described below, which we use only if you accept it.

Advertising measurement. If you arrive from one of our adverts in ChatGPT, we ask whether you accept advertising cookies. If you accept, we tell OpenAI, which runs ChatGPT's advertising, when you start our free trial sign-up form. We send the advert reference OpenAI added to the link, the name of the event and the time. We do not send your name, email address, anything you type into the form, or your IP address. The advert reference is kept in your browser for the current session only, and your choice is remembered on this browser for up to 180 days. If you reject, or make no choice, nothing is sent. You can withdraw consent at any time using Cookie settings at the foot of any page, and we stop straight away. OpenAI handles this information as an independent controller under its Conversion Terms, except for limited processing it carries out for us as our processor. For visitors in the European Economic Area it is handled by OpenAI Ireland Limited, which uses a valid transfer mechanism for any onward transfer outside the EEA; for visitors in the UK it is handled by OpenAI OpCo, LLC under the UK standard contractual clauses.

Contact for data requests

To exercise any of the rights above, or for any other privacy question, write to privacy@sophyra.ie. We aim to respond within ten working days and in any event within the statutory month.