← Clarissimum

Privacy Policy

Clarissimum shows you how others see you. The protection of your data and the anonymity of respondents are built structurally into the product. This policy describes which data is processed for which purpose.

Controller

Dilaver Öcalan 5020 Salzburg Austria Email: support@clarissimum.com

Legal basis

The basis for processing throughout is your consent (Art. 6(1)(a) GDPR). Each stage (Private, Business) requires its own fresh and logged consent; data from the private context is not quietly reused for other purposes. You can withdraw your consent at any time with effect for the future.

Processing purposes

Private: self-image, anonymous outside view of the people around you, aggregated evaluation and an optional report.
Business (360°): professional self-image and outside view from your colleagues, only after separate consent.
Community (360°): public self-image and outside view from a link you share publicly yourself, which people unknown to you can answer anonymously too, only after separate consent.
Payment processing for paid reports via the payment service provider (merchant of record).

Data minimisation and retention periods

We do not process any photos. There is no image upload, no image analysis and consequently no stored image data.
For youth protection we ask only for the year of birth, not the full date of birth. The minimum age is 16.
Free texts are moderated, summarised anonymously and then deleted in their raw form; only the aggregated summary from three texts onward is shown, never a verbatim quote.
To protect against double rating, a short-lived, hashed fingerprint with a 30-day expiry is stored, without any clear identity.
No identity is stored for respondents. Individual ratings are technically not retrievable; only server-side aggregates from three people onward exist.

Processors

For the linguistic summary of the paid report, for payment processing, for delivery via a content delivery network and for hosting within the EU, processors are used with whom data processing agreements are in place. Your data is not used to train AI models.

Cookies and analytics

We set two technically necessary cookies. In addition we use Google Analytics for anonymised reach measurement, but only with your consent: without your active "Accept all", no analytics cookie is set and no script is loaded from Google. If you choose "Necessary only", only the technical cookies remain.

Name	Purpose	Duration
clarissimum-session	Keeps your session so you stay logged in and your answers are preserved between two questions.	2 hours
XSRF-TOKEN	Protects forms so nobody else can submit them in your name.	2 hours
cl_cookie_consent	Remembers your cookie decision so we do not ask you again on every visit.	180 days
_ga	Google Analytics: measures use of the site anonymously. Set only after your consent ("Accept all").	up to 2 years

You can allow the necessary cookies without agreeing to analytics ("Necessary only"). Your consent to Google Analytics is voluntary and can be withdrawn at any time with effect for the future by changing your cookie decision below.

Google Analytics

If you agree, we use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). On our behalf it processes usage data, such as the pages you visit, approximate location at city level, device and browser, each with a shortened IP address. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). A transfer to the USA to Google LLC is possible; Google is certified under the EU-US Data Privacy Framework, and the Standard Contractual Clauses apply in addition. You can withdraw your consent at any time by changing your cookie decision below.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and withdrawal of consent given. Deleting your account removes all derived data completely. To do so, contact the address named above.

Right to complain

You have the right to lodge a complaint with a supervisory authority. The competent authority is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at.