Privacy Policy

The controller for the data described in this policy is Pillet Grenie Bureau L.L.C-FZ (“Bureau”), the entity operating the Bureau Assessment service.

Free Zone Limited Liability Company · Meydan Free Zone, Dubai, U.A.E. · Formation no. 2647815 · Registered address: Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.

For any privacy question or to exercise your rights, contact tom@pilletgreniebureau.com.

• To provide the service (create and run assessments, host the application) — performance of a contract.
• To generate assessment questions and analysis using AI models — performance of a contract and, for participant data, on the client’s documented instruction.
• To send transactional email (team invitations, report-ready notices) — performance of a contract.
• To keep the service secure (rate-limiting, error monitoring, abuse prevention) — our legitimate interest in operating a safe service.
• Duty-of-care wellbeing escalation. On assessments that use the dedicated wellbeing template, free-text responses are scanned for explicit signals of psychological distress; a match can trigger an alert email to the client’s administrators. This runs on the client’s instruction. It does not apply to other audit types.

We do not sell personal data and we do not use it for advertising.

We use the following subprocessors to run the service. Where a region is marked “†”, data may be processed outside the EU, or the region / transfer safeguard is still being confirmed and formalised (see section 5).

The list of subprocessors used for participant data, and the mechanism for notifying clients of changes, is set out in the Data Processing Agreement.

Personal data is stored in the EU (Frankfurt). Some subprocessors that perform processing on our behalf are based outside the EU — notably Anthropic, OpenAI, Inngest and Stripe (United States). The Bureau controlling entity is established in the United Arab Emirates.

Where data is transferred outside the EU/EEA, we rely on the transfer safeguards offered by each provider (such as Standard Contractual Clauses in their data processing terms). We are finalising and documenting these safeguards for Anthropic, OpenAI, Inngest and Stripe (United States), and confirming the email-routing region for Resend.commitment

• Raw responses: 18 months by default (a client may request a shorter period). commitment
• Findings and verdicts: for the assessment programme’s lifetime plus 24 months. commitment
• Aggregated, k-anonymised results: retained indefinitely (they contain no individual data). commitment
• Raw voice recordings: deleted 30 days after transcription; the transcript is kept under the response-retention rule above. commitment
• Service measurement events (see “Cookies”): deleted automatically after 30 days.
• Erasure log: kept for 3 years. commitment

These retention periods are our stated policy. Automated enforcement (scheduled deletion) is being implemented; until then, deletions are performed on request through a documented internal procedure.

Subject to applicable law, you may request access to, correction of, deletion of, or a copy of your personal data, and you may object to or restrict certain processing.

• Administrator / account data: contact us directly at tom@pilletgreniebureau.com.
• Participants (employees): because your employer is the controller of your assessment responses, please direct requests to your employer. Bureau will assist the employer in fulfilling them as its processor.

Bureau Assessment uses only strictly necessary cookies. There are no analytics, advertising, or third-party tracking cookies, so no cookie consent banner is required. The cookies we set are:

• A participant session cookie (signed, HTTP-only, expires after 12 hours).
• An administrator “acting organisation” cookie for super-admin support access (HTTP-only, expires after 4 hours).
• Supabase authentication cookies for signed-in administrators.

We use Sentry for error monitoring. It does not set browsing or tracking cookies.

Service measurement. To support participants and improve the service, Bureau records a small set of usage events: for example, that a phase was opened, that a question was left after an estimated visible time, that a save failed and was recovered. These events contain no answers, comments, recordings, names or e-mail addresses, and no question text. They are linked to the participant only within one assessment, are never used to assess individuals, and are deleted after 30 days. No additional cookie or local storage is used for this collection: it relies on the participant’s existing session cookie.

Bureau Assessment uses AI models to run assessments. For transparency:

• Anthropic’s Claude models generate assessment questions and analyse responses into individual profiles.
• OpenAI’s Whisper model transcribes voice recordings into text.
• On wellbeing-template assessments only, a curated keyword detector scans free-text responses for signals of psychological distress (see section 3).

The platform does not make automated decisions producing legal effects about individuals; assessment outputs are reviewed by the client organisation.

Security measures include row-level security on every database table, encryption in transit, hashed participant identities, a private storage bucket for voice recordings accessible only server-side, a k-anonymity gate on aggregated reporting (a floor of five distinct participants per band by default), rate-limiting, and a strict error-monitoring configuration that strips request bodies, cookies, and authorization headers. Full detail is in the Data Processing Agreement.

We will update this policy as the service evolves and will revise the “last updated” date above. Questions: tom@pilletgreniebureau.com.