Privacy notice

SmartNote2Self · Biz Resilience Scan is a product of Kaiventive Holdings Ltd ("we", "us"). We provide AI-assisted operational resilience planning. For general enquiries, contact marcelle@smartnote2self.com. For privacy and data-rights requests, contact marcelle@smartnote2self.com.

• Assessment inputs you type (operational answers).
• Optional details: organisation name, email address, uploaded logo.
• Account profile if you sign in with Google (email, name, profile picture).
• Anonymous product analytics (only if you accept analytics cookies).
• Email delivery audit logs (recipient, timestamp, message ID).

• Service delivery — to generate your continuity plan and PDF (contract / legitimate interest).
• Consent — to send your plan by email, store your logo, and use analytics cookies.
• Legitimate interest — to improve the product and prevent abuse.

• Anthropic — AI drafting of plan sections (Claude Sonnet 4.5 via Emergent's API proxy).
• Resend — email delivery (plans, booking confirmations, consultant requests).
• Emergent — application hosting, object storage, Google sign-in proxy.
• MongoDB — database hosting.
• PostHog — anonymous product analytics (only if you opt in).
• Meta Pixel — advertising measurement (page views, scan starts, purchases) to gauge ad performance. Loaded only if you accept marketing/analytics cookies.

About AI training: your assessment answers and any organisation context you provide are sent to Anthropic's Claude API only to generate your plan. Under Anthropic's commercial API policy, this data is not used to train their models. Anthropic may retain prompts and outputs for a short period (typically 30 days) strictly for abuse and safety monitoring, with access restricted to that purpose.

• Anonymous assessments: retained while in use; abandoned drafts (no activity for 90 days) are automatically purged.
• Completed plans: retained for 2 years from last activity, then automatically purged.
• Shareable links: automatically expire after 30 days.
• Email delivery logs: 12 months for support and audit.
• Signed-in account data: until you request deletion.

Authorised administrators may access aggregate statistics and individual assessment records to operate the service (e.g. support enquiries, abuse investigation, retention enforcement). By default, personally identifiable fields (email, organisation name) are shown in minimised form. Every administrative access to identifying or detailed answer data is recorded in an internal audit log to support our record-keeping obligations under applicable data-protection law.

Wherever you are located, you have meaningful rights over the personal data we hold about you. We honour the rights below — voluntarily where they are not legally required in your jurisdiction.

For signed-in users, three of these rights are self-serve and instant on your Account page under "Data & privacy". For all other rights, or if you are not signed in (e.g. a visitor, prospect, or booking-only user), email marcelle@smartnote2self.com — we respond within 30 days.

• Access — see and obtain a copy of every assessment input, booking, payment, share link, and account record we hold about you. (Self-serve via Account page.)
• Portability — "Download my data (JSON)" produces a complete machine-readable export of everything we hold about you. (Self-serve.)
• Erasure — "Delete my account" cascades through every collection (assessments, share links, delivery log, bookings, payments, sessions, profile) and cannot be undone. (Self-serve.)
• Rectification — correct any inaccurate or incomplete personal data we hold about you.
• Restriction of processing — ask us to pause processing while a dispute or objection is investigated.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — at any time, without affecting the lawfulness of prior consent-based processing (e.g. emailing your plan, storing your logo, analytics cookies).

Legal basis & supervisory authorities. These rights are statutorily enforceable under the UK GDPR (with the UK Data Protection Act 2018), the EU GDPR (Regulation 2016/679), and Jamaica's Data Protection Act, 2020. You may lodge a complaint with the UK Information Commissioner's Office (ICO), your local EU supervisory authority, or the Office of the Information Commissioner of Jamaica (OIC).

A note on portability. Data portability (the right to a machine-readable export) is a statutory right under the UK and EU GDPR. Jamaica's Data Protection Act 2020 grants the equivalent right of access in intelligible form but does not separately enumerate portability; we extend the same machine-readable JSON export to all users globally as a matter of policy.

We use essential cookies needed for the app to work, and (with your consent) anonymous analytics cookies. You can change your choice at any time by clearing site data and reloading the app.

This service does not provide legal, regulatory, audit, or certification advice. You remain responsible for validating, implementing, testing, and maintaining your continuity arrangements.