Privacy notice | Candovio

1. Who we are

Candovio is the controller of the personal data described in this notice. Contact: connect@candovio.com.

2. The law that applies

This notice is given under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) and any executive regulations issued under it. If you are in the United Kingdom or the European Union, the UK GDPR or the EU GDPR also applies, and section 11 gives the extra information those laws require.

3. What we collect

Call-back and invitation requests. Your name, work email address, company or project name, and, if you give them, a sentence about the business, the regulator you have in mind and a preferred time for a call. If you tick the optional box, we also record that you want occasional updates from Candovio.
Launch notices. The email address you leave in the countdown panel so that we can tell you when the assessment opens. It is used for that message only.
Form checks. With either form, we also record the address of the page you sent it from and how long the page had been open. We use these only to filter out automated spam.
The assessment account. Your name, email address, phone number and company name. Your email address is used to sign you in. There is no password.
Your answers and messages in the assessment. The answers you give and the messages you type or speak to Clara, our AI assistant.
Technical data. This site sets no cookies and uses no analytics. We serve our fonts from our own server. Hostinger hosts the site and processes your IP address to deliver the pages, under a data processing agreement with us. The assessment saves your progress in your browser's local storage so you can return to it. This is needed to provide the service you asked for, and you can clear it in your browser settings.

We never ask for identity documents through this site or the assessment, and we ask you not to upload or paste them.

4. Why we use it and on what basis

Purpose	PDPL basis	UK/EU GDPR basis
Reply to a request, send an invitation or launch notice, arrange a call-back, prepare the confirmed report	Steps taken at your request before a contract (Art. 4(9))	Steps before a contract (Art. 6(1)(b))
Run the assessment and send your messages to the AI model in the United States	Your consent (Art. 6), and your explicit consent to the transfer (Art. 23(1)(b))	Consent (Art. 6(1)(a)); transfer under Anthropic's standard contractual clauses
Improve the rules the assessment runs on	Only records anonymised so they no longer identify you; we do not use records we cannot anonymise	Legitimate interests in accurate results (Art. 6(1)(f))
Keep records to deal with legal claims	Legal claims and defence of rights (Art. 4(3))	Legitimate interests (Art. 6(1)(f))

5. Processing by an AI model

Clara runs on Claude, an AI model provided by Anthropic PBC in the United States, under Anthropic's commercial terms and data processing addendum. Anthropic processes your messages only to generate replies for us. It does not use them to train its models. It deletes them within 30 days, but may keep a message flagged for breaching its usage policy for up to two years.

You can speak to Clara instead of typing. Your browser asks your permission before the microphone is used. What you say is converted to text, and the text is then handled in the same way as a typed message.

We send the model only what it needs to reply: your messages about the business and the stage the assessment has reached. We collect your name, email address, phone number and company name in a separate step and do not send them. Before each message is sent, we remove anything that looks like an email address or phone number. We cannot remove every detail you type or say, so please do not include people's names or other personal details. For this reason, messages sent to Anthropic are pseudonymised, not anonymous.

We ask for your explicit consent before your first message is sent. Without it, you can request a call-back instead. You can withdraw consent at any time by emailing connect@candovio.com. We then stop sending your messages to the model; messages already sent are not affected.

6. Other recipients and transfers

Call-back requests and launch notices are stored in Google Sheets, provided by Google. Google may process them outside the UAE.
The assessment backend, with your results and transcripts, is hosted by Amazon Web Services in the UAE.
Your messages to Clara are sent to Anthropic in the United States to generate replies, as described in section 5. The basis for this transfer is your explicit consent (PDPL Art. 23(1)(b)).
Hostinger hosts this site and processes your IP address to deliver the pages, under a data processing agreement with us. The pages themselves store no personal data.
Our fonts are served from our own server, so loading a page sends nothing to a font provider.
We do not sell or share personal data for marketing.

7. How long we keep it

Assessment transcripts and answers: stored in the UAE for 12 months from your last message, then deleted.
Call-back and invitation requests, and the confirmed report: one year from our last contact with you, unless you ask us to delete them sooner or an engagement follows.
Launch notices: until the launch message is sent, then deleted.
Anonymised records used to correct the rules: kept without any link to you.

If we find an error in a result after your records have been deleted, we cannot tell you about it. We keep only a list of the email addresses that received a confirmed report, so that we can send corrections.

8. Your rights

You can ask us for access to your personal data, and for correction, erasure, restriction or a copy in a portable format. You can object to processing and withdraw consent at any time. You can also object to a decision made only by automated processing. Every provisional result is reviewed by a person before it is released, you can challenge any activity the assessment assigns to your business, and you can ask for a person to review any result. Email connect@candovio.com. We may ask you to confirm your identity, and we reply within 30 days. If you are not satisfied, tell us first and we will look at it again. You can also complain to the UAE Data Office, or the authority that takes over its functions. For UK and EU complaints, see section 11.

9. Security and breaches

We protect your data with technical and organisational measures appropriate to the risk. If a breach affects your personal data, we notify the UAE Data Office as soon as we become aware of it. Where the breach could harm your privacy or security, we also tell you, together with the steps we have taken. Where the UK or EU GDPR applies, we notify the relevant supervisory authority within 72 hours when the law requires it.

10. Changes

We will post any change to this notice on this page with the date it took effect. This version: 15 November 2026.

11. People in the UK and the EU

When we send your messages to Anthropic in the United States, the transfer is covered by Anthropic's data processing addendum, which includes the EU standard contractual clauses and the UK addendum. If you are in the UK, you can complain to us by emailing connect@candovio.com, and we will acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office. If you are in the EU, you can complain to the data protection authority where you live or work.