Privacy notice

[PLACEHOLDER] This text is a placeholder and has not been legally reviewed. The final version will be added before the public launch (docs/05). The outline below only shows the planned sections.

1. Controller

[Name, address, email: contact@sembrelio.com]

2. Data processed and purposes

[Account (email address, password as hash, language setting), questionnaire, consents, assessment data, research data in pseudonymised form only with consent.]

3. Legal bases

[Art. 6(1)(a), (b) and (f) GDPR; balancing test for comparison businesses and named competitors.]

4. Cookies

[Only technically necessary cookies: login session (Supabase Auth) and selected language (NEXT_LOCALE). No analytics or marketing cookies, no external fonts or scripts.]

5. Processors and hosting

[Supabase (Frankfurt, eu-central-1), Vercel (Frankfurt, fra1), Railway (EU), email delivery, Anthropic, OpenAI, Google.]

6. Transfers to third countries

[Legal basis per provider (EU-US Data Privacy Framework and/or standard contractual clauses). Only business data is sent to AI providers, never data about the respondent.]

7. Web crawler

[SembrelioBot fetches public pages of submitted websites, see /bot.]

8. Retention

[Until the end of the research project, date to follow; deletion on request.]

9. Your rights

[Access, rectification, erasure, restriction, data portability, objection, withdrawal of consent, complaint to a supervisory authority.]