1. General

This document explains how ClariAze — the AI-powered risk management platform — collects, stores and processes user data. By using the platform you accept this policy.

2. Data we collect

• Account data: first name, surname, email address, position, department and assigned role.
• Company data: company name, registration number, industry, address and contact details.
• Assessment data: all text, selections, documents and attachments you enter for a risk analysis.
• Risk registry: the risks you accept, their actions, deadlines, notes and status changes.
• Audit records: who changed what and when, recorded systematically.
• Technical records: request time, IP address, processing duration and error conditions.

3. How the data is used

Data is used solely to deliver the platform's functionality: performing risk assessments, storing results, sending notifications, managing user accounts and monitoring the technical stability of the system.

4. Multi-tenant architecture

ClariAze is built on a multi-tenant model. Each company's data is logically isolated — a user of one company can never reach another company's risks, analyses or users. The boundary is enforced automatically on the server for every request.

5. Data exchanged with the AI service

To perform the analysis, the text you enter is sent to a third-party AI service. It is used only for the analysis; the data is not used to train the model.

Please do not enter personal identification details (identity card numbers, bank card details, medical information and the like) into the assessment form.

6. Data retention

Assessment results are retained for as long as your account is active. User and company records are never physically deleted — they are deactivated, so that the integrity of the audit trail is preserved. Uploaded files are stored in a protected directory on the server with direct access blocked.

7. Data sharing

Your data is not sold for commercial purposes, is not used for advertising, and is not shared with third parties beyond what is technically necessary.

8. Security

Passwords are stored only as cryptographic hashes and never in plain text. Every operation is subject to server-side role and company checks. Session cookies are protected with the HttpOnly flag.

9. Your rights

You have the right to see your data, to request corrections, to update your profile directly from Settings, and to request deactivation of your account. For anything further, contact your company administrator.

10. Contact

Questions about privacy can be directed to your company administrator or to the owner of the ClariAze platform.