AIVORALegal
Privacy Policy
Last updated: 15 September 2026
1. Overview
AIVORA HC (“AIVORA”, “we”, “us”, “our”) provides an AI-assisted Human Capital advisory platform that helps organisations diagnose HC maturity, interpret benchmarks against their own evidence and generate board-ready deliverables. This Privacy Policy explains what personal information we collect through our website (aivorahc.com) and the platform, how we use it, who we share it with, and the rights you have over it.
If you use the platform on behalf of an organisation that has a contract with us, that organisation is the controller of the business data it uploads and our Data Processing statement applies to that data. This policy covers the information we collect as a controller in our own right.
2. Information we collect
Information you provide
- Contact details - name, work email address, phone number and organisation when you request a demo, subscribe to updates or contact us.
- Account details - name, email, role and organisation when an account is created for you on the platform, plus a password (stored only as a salted hash) or an SSO identifier.
- Correspondence - the content of messages you send us, including support requests.
- Billing details - company name, billing address and tax identifiers. Card details are collected and stored by our payment processor, not by AIVORA.
Information collected automatically
- Usage data - pages viewed, features used, timestamps and interaction events, used to understand how the platform is used and to improve it.
- Technical data - IP address, browser type and version, device and operating system, referring URL and approximate location derived from IP.
- Security logs - sign-in attempts, session activity and administrative actions, kept to detect and investigate misuse.
We do not intentionally collect special-category data (such as health, ethnicity or trade-union membership) about website visitors. Where a customer chooses to include such data in workforce evidence uploaded to the platform, the customer is responsible for having a lawful basis to do so and our Data Processing statement governs how we handle it.
3. How we use information
- To respond to enquiries, arrange demonstrations and provide customer support.
- To create and administer accounts, authenticate users and deliver the platform's features.
- To operate, secure, maintain and improve the website and platform, including debugging and performance monitoring.
- To detect, prevent and investigate fraud, abuse and security incidents.
- To send service communications such as account notices, security alerts and changes to our terms.
- To send product updates or marketing where you have opted in; you can unsubscribe at any time.
- To comply with legal obligations and enforce our agreements.
Where the GDPR or similar law applies, we rely on the following legal bases: performance of a contract (providing the service you or your organisation requested), our legitimate interests (running, securing and improving the service and communicating with business contacts), consent (marketing and non-essential cookies) and compliance with legal obligations.
We do not sell personal information, and we do not use your personal information to train AI models.
4. Sharing
We share personal information only in the following circumstances:
- Service providers that host infrastructure, deliver email, process payments or provide AI model inference on our behalf. Each acts under a contract that restricts them to processing on our instructions and requires appropriate security. The current categories of provider are listed in our Data Processing statement.
- Your organisation - if your account was provisioned by your employer or a customer of ours, that organisation's administrators can see your account and activity within their workspace.
- Legal and safety - where required by law, regulation, legal process or to protect the rights, property or safety of AIVORA, our customers or others.
- Business transfers - in connection with a merger, acquisition or sale of assets, subject to the recipient honouring this policy.
5. Cookies and analytics
Our website uses strictly necessary cookies to remember preferences such as your theme choice. Where we use analytics to understand traffic, we do so with privacy-preserving tools and do not build cross-site advertising profiles. The platform uses a session token to keep you signed in; it is not used for tracking. You can control cookies through your browser settings.
6. Data retention
We keep personal information only for as long as necessary for the purposes described above. As a guide:
- Demo and enquiry details - up to 24 months from last contact, unless you become a customer.
- Account information - for the life of the account and a short period afterwards to allow reactivation, then deleted or anonymised.
- Security and audit logs - retained for a defined period to support investigations, then deleted.
- Billing records - for the period required by tax and accounting law.
Backups are retained on a rolling schedule and are overwritten in the normal course of operations.
7. International transfers
AIVORA operates from the United Arab Emirates and uses service providers located in other jurisdictions, including the European Union and the United States. Where personal information subject to the GDPR, UK GDPR or similar laws is transferred outside its home region, we rely on appropriate safeguards such as standard contractual clauses and providers' adequacy decisions.
8. Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you and receive a copy.
- Correct inaccurate or incomplete information.
- Request deletion of your information.
- Restrict or object to certain processing, including direct marketing.
- Receive your information in a portable format.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with your local data protection authority.
To exercise any of these rights, email info@aivorahc.com. We will verify your identity before acting and respond within the timeframe required by applicable law (normally within 30 days). If your account is managed by your organisation, we may direct your request to them or work with them to fulfil it.
SecurityHow we protect your data
Security is a core part of how the platform is built, not an add-on. The measures below apply to the personal information described in this policy and to the customer data covered by our Data Processing statement.
- Encryption in transit. All traffic to the website and platform is served over HTTPS/TLS with certificates that renew automatically. Plain HTTP is redirected.
- Encryption of stored secrets. Integration credentials, API keys and similar sensitive values are encrypted at the application layer before being written to the database; passwords are never stored - only salted bcrypt hashes.
- Tenant isolation. Every organisation's data is stored with a tenant identifier and every query is scoped to the caller's tenant, so one customer's evidence, benchmarks and deliverables are never visible to another.
- Authentication and access control. Sign-in uses short-lived signed tokens with support for single sign-on (SSO/OAuth). Role-based permissions restrict what each user can view, upload, generate or administer.
- Audit logging. Administrative and data-changing actions are recorded in an audit log that records who did what and when, so activity can be reviewed and investigated.
- Abuse protection. Rate limiting, request validation and strict cross-origin rules protect the API from brute-force and automated abuse.
- Backups and recovery. The production database is backed up on a schedule with a defined retention window, allowing point-in-time restoration if data is lost or corrupted.
- Least privilege operations. Production infrastructure is isolated in containers, accessed only by named administrators over key-based SSH, with secrets injected from environment configuration rather than committed to code.
- AI model handling. Content sent to third-party AI models is limited to what is needed to produce the requested output, is transmitted over encrypted connections, and is not used by AIVORA to train models. See the sub-processor section for the providers involved.
No system can be guaranteed to be completely secure. If you believe your account has been compromised, or you have discovered a vulnerability, contact us immediately at info@aivorahc.com. We treat security reports as a priority and will acknowledge them promptly.
9. Children
Our website and platform are intended for business users and are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. For material changes we will give notice on the website or by email to account holders before the changes take effect.
11. Contact
Questions, requests or concerns about this policy or how we handle your information: email info@aivorahc.com.