Privacy, in plain English.
Your reports are deleted once they’re read.
When you upload a report, bFluid reads the figures and labels it needs and then deletes the file. We never keep the report itself or its text.
- What we collect
- Your account details, the reports you upload, the notes you write, and what your team members choose to add about themselves.
- Why
- To build the profile and advice you asked for. Nothing else.
- If your manager describes you
- We never keep a profile of you that you can’t see. Once you’re invited, you see what your manager’s bFluid profile says about you, can add your own words, and can delete anything you’ve shared.
- Where it’s stored
- In the EU, on infrastructure independently audited for security (SOC 2 Type II).
- Who processes it
- A small number of specialist providers for hosting, email, product analytics and AI analysis, each under a data processing agreement. Our AI provider is contractually barred from training on your data and deletes it within 30 days, unless the law or its usage policy requires longer. Full list of providers available on request.
- Product analytics
- Managers’ use of the app is measured in the EU without cookies, using a pseudonymous account ID; events never include what anyone writes. Session recording is off unless a manager turns it on in Settings, and recordings hide all text, typing and photos. Analytics never run on team members’ pages or on our website.
- International transfers
- Some processing, including AI analysis, takes place in the US under UK-approved data transfer safeguards.
- How long we keep it
- For as long as your account is open. Deleted within 30 days of cancellation.
- How to delete or export
- From the page itself, any time. Or email us and we’ll do it for you.
The full policy
The plain-English summary above is a guide. This is the text that binds us.
bFluid helps managers understand and work well with the people on their team. This policy explains, in plain English, what we store, what we never do with it, who processes it on our behalf, and how it gets deleted.
Your organisation is the controller of the data in its bFluid account; bFluid is the processor acting on its instructions. Team members can see and shape how bFluid describes working with them, via the “Working with me” link their manager sends.
If your manager invited you
- •You’ll always see everything built from what you share.
- •Your manager may keep private observations about working with you, as any manager does. Those aren’t shown to you. Everything built from what you share is.
- •If your company already holds your report, your manager may add it; you’ll see what bFluid reads from it here.
- •bFluid is for managing, never for appraisal, pay or selection decisions.
What bFluid stores
- •Your account: your name, email, organisation, country, and your settings, including whether you have opted in to session recording.
- •The people you add: name, job title, and optionally their email, photo and pronouns.
- •If your manager adds your email, bFluid uses it only to send you your Working with me invite and anything your manager chooses to share with you. Nothing else.
- •Personality reports you upload: we read each report once to extract the scores, then delete the file and its text. We keep the scores and the name of the framework.
- •Your notes and your answers to questions about someone, and the events on their Timeline. These stay private to you.
- •Advice and briefs: the situations you describe, the advice bFluid writes, your ratings and comments, and your weekly brief.
- •We review anonymised questions and answers to improve the advice.
- •The bFluid Profile: a team member's answers to the 60 statements and the five results worked out from them. A PDF is created from the results each time it's downloaded; we don't store it. Individual answers are never shown to anyone. A team member can delete their Profile at any time, which deletes the answers and results.
- •What a team member adds about themselves through Working with me: their own words, photo and pronouns, and their choice to share a Profile.
- •Your own Profile and report on About you, which are private to you and never shared.
- •Early-access and partner enquiries: your email, and any name, team size, practice or message you include. We use them only to contact you about bFluid, keep them for up to 12 months, and delete them sooner on request.
Our commitments
- •Your personality data is never used to train AI models.
- •We never sell your data — to anyone, for any purpose.
- •Each organisation's data is isolated from every other organisation's.
Who processes data for us (sub-processors)
We use a small number of specialist providers to run bFluid, for hosting, email, product analytics and AI analysis. Each processes data only to provide its part of the service, under a data processing agreement. A full list of our providers is available on request.
- •Our database and file storage are in the EU, on infrastructure independently audited for security (SOC 2 Type II).
- •Our product analytics run in the EU and set no cookies or other browser storage. They record how managers use the app (which pages and features, how long steps take) under a pseudonymous account ID, never what anyone writes, a team member's details or report content. Session recording is off unless a manager turns it on in Settings; recordings hide all text, typing and photos. Analytics never run on team members' own pages or on our website.
- •Our AI provider is contractually barred from training on your data and deletes it within 30 days, unless the law or its usage policy requires it to keep it longer.
International transfers
Some processing, including AI analysis and our email provider's delivery records, takes place in the United States. Where personal data is transferred outside the UK, it is protected by safeguards approved under UK data protection law, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
Aggregate statistics
We use aggregated, anonymised statistics that cannot identify any individual, team, or organisation to improve bFluid and to publish research. No statistic is ever derived from free-text content, and none is computed from groups small enough to identify anyone. Working preferences and member-uploaded reports are excluded from these statistics.
Deleting a team member
Deleting a team member removes their profile data, their uploaded files, and their working preferences. A team member can also delete everything they've shared themselves, at any time, from their “Working with me” link — no manager approval needed.
Security
What’s in place today. Anything still on the roadmap is marked as roadmap, not implied.
- Row-level tenant isolationEvery query is scoped to your account at the database layer. One manager’s data is never visible to another’s.
- Report filesReport files are never shown again after upload: they’re read, then deleted.
- Encryption in transit and at restTLS for every connection; encrypted storage for everything we hold.
- Audit trailAccess to and changes in profiles are logged, so what happened and when can always be answered.
Questions, deletion or export requests: privacy@bfluid.ai. We reply within five working days.