Privacy Policy

Last updated: 15 March 2026

1. Who We Are

Fluency is operated by Sondera Studios ("we", "us", "our"). We provide an AI literacy assessment platform for hiring organisations. For data protection enquiries, contact us at privacy@sonderastudios.com.

2. What Data We Collect

We collect and process the following personal data:

  • Assessor accounts: Full name, work email address, organisation name, sector, and hashed password.
  • Candidates: Full name, email address (provided by the assessor), assessment responses (chat conversations, Task B answers), AI-generated scores, and session metadata (timestamps, time used).
  • Technical data: IP address, browser type, and session cookies (used for authentication only, not tracking).

3. How We Use Your Data

  • To deliver the assessment service to hiring organisations.
  • To generate AI-scored candidate reports for assessors.
  • To send invitation emails to candidates on behalf of assessors.
  • To authenticate and manage assessor accounts.
  • To improve the platform (aggregated, anonymised usage data only).

4. Legal Basis for Processing

We process personal data under the following legal bases (GDPR Article 6):

  • Contract performance: Processing assessor data to provide the service they signed up for.
  • Legitimate interest: Processing candidate data to deliver assessments on behalf of the hiring organisation (data controller).
  • Consent: Where required, such as sending marketing communications.

5. Data Sharing

We share personal data with:

  • Supabase — database hosting and authentication (EU region).
  • Anthropic (Claude API) — candidate chat conversations are processed by Claude to deliver the assessment and generate scores. Anthropic does not use this data for model training.
  • Resend — transactional email delivery for candidate invitations and password resets.
  • Vercel — application hosting.

We do not sell personal data to third parties.

6. Data Retention

Assessment data (candidate responses, scores, and reports) is retained for the duration of the assessor organisation's account, plus 12 months after account closure. Assessors may request deletion of specific candidate data at any time.

7. Your Rights

Under GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your data ("right to be forgotten").
  • Object to or restrict processing of your data.
  • Data portability — receive your data in a structured format.
  • Lodge a complaint with a supervisory authority (e.g. the ICO in the UK).

To exercise any of these rights, contact privacy@sonderastudios.com.

8. Data Processing Agreement

Hiring organisations acting as data controllers may request a Data Processing Agreement (DPA) by contacting legal@sonderastudios.com. The DPA covers our obligations under GDPR Article 28 as a data processor.

9. Changes to This Policy

We may update this policy from time to time. We will notify registered assessors of significant changes via email. The "last updated" date at the top reflects the most recent revision.