Privacy Notice

The controller is Darwinian Angel Ltd, trading as Intuitioneer, company number 14715407, registered at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom and registered in England and Wales. We are registered with the Information Commissioner's Office under reference ZC180810. Our privacy and Data Protection Officer contact is info@darwinianangel.com. General and legal enquiries can be sent to hello@intuitioneer.com.

Account data includes email, verification state, name, headline, location and authentication identifiers. Professional records can include titles, contributions, outcomes, dates, Work Map answers, skills, capabilities, learning, relationships, future views, visibility, fingerprints and references.

Evidence can include uploaded PDFs or images, filenames, descriptions, hashes, private storage paths and access settings. Sharing and trust data can include link labels, expiry, witness names, roles, relationships, selected statements, comments, outcomes and timestamps. Optional sector context is part of a frozen record. Owner reflections can contain personal thoughts about how recorded work changed their judgement, assumptions, capability or way of working. Operational records include audit events and provider status data.

Most information comes from account owners. Witnesses provide their own attestation data. Optional LinkedIn reports provide only stored factual connection/category signals when the integration is enabled. Hosting, authentication and security systems may generate technical logs. Other people may be mentioned in records or evidence supplied by an owner.

We use information to create and secure accounts; provide drafting, freezing, sharing, publication, evidence, attestation, Museum and Workprint functions; respond to rights and content reports; maintain provenance and non-recycled references; prevent misuse; and meet legal obligations.

We rely on contract for core account and service delivery. We rely on legitimate interests where proportionate for security, audit and reference integrity, content reporting, limited service improvement and factual witness or public provenance. We rely on legal obligation where the law requires action. Public publication is initiated by the owner, but that choice is not automatically consent for every processing activity.

You can contact us for more information about a legitimate-interest assessment or to object where that right applies.

Only records deliberately made public are intended for public discovery. Public pages may show the owner's intended public profile fields and sanitised aggregate provenance. Search engines and other people may index, copy or cache public information beyond our control. Private evidence, raw attestations and identity-verification data are not public projections. Owner reflections are private by default and are not shown to witnesses or included in public records.

If you receive an invitation, the sender has asked you to respond about one frozen record. We record the details you submit, the statements selected, the outcome, any comment, the notice version and response time. The owner can see your response. If the record is public, limited factual provenance may also be public, but raw verification metadata remains private.

Records and evidence may mention colleagues, clients or others who did not provide the data directly. Owners should not name or include other people unless reasonably necessary, and must have a lawful basis and appropriate rights to submit or publish that information. Anyone can use the reporting route to request correction or removal.

Supabase provides database, authentication and private object storage services. Web hosting, network delivery, authentication-email and operational providers process only the information needed to provide and secure their functions. LinkedIn is an optional provider only when explicitly enabled and configured. We do not currently use advertising or analytics services in the application.

Newsreader and IBM Plex fonts are packaged with the application. Browsers no longer contact Google Fonts to render them, so Google Fonts is not an active runtime recipient.

Some providers or their subprocessors may process information outside the United Kingdom. Where UK data-protection law requires a transfer safeguard, we use an applicable adequacy regulation, approved contractual safeguards or another lawful transfer mechanism. Contact us for information relevant to a particular transfer.

Retention follows the actual product lifecycle and the reviewed retention schedule. Drafts, frozen records, attestations, shares and audit history are retained while needed to provide the service or preserve legitimate provenance, subject to deletion, approved retention rules and legal needs. Link or invitation expiry stops access immediately; database purge is a separate controlled operation.

Reflections are appended rather than silently replacing earlier entries. You may delete your own reflections, and they are deleted with the associated account or Workefact.

Deleted Workefacts queue private evidence for storage cleanup and leave a minimal audit record and non-recycled reference history. Backup and log deletion periods require provider confirmation. We do not promise immediate removal from backups.

Controls include private server-mediated evidence storage, short-lived signed URLs, row-level access controls, owner checks, restricted mutation functions, hashed bearer tokens, immutable frozen content and audit events. No internet service can guarantee absolute security.

Depending on the circumstances, you may have rights of access, correction, deletion, restriction, portability and objection, and rights relating to automated decisions. The service does not make employment decisions or assign trust scores. Contact info@darwinianangel.com. We may need to verify a request and consider other people's rights, legal duties and accurate provenance.

You can delete your account from Account settings after confirming your password and the permanent action. You can also contact us about deletion or another rights request. You may complain to the UK Information Commissioner's Office at ico.org.uk, and you may have another supervisory authority available to you.

LinkedIn connection is optional and hidden unless fully configured. We store provider subject linkage and factual IDENTITY or WORKPLACE category presence as designed; provider access tokens are not persisted. Existing factual signals may remain visible when new connections are disabled. LinkedIn use is not a condition of publication or attestation.

The application uses functional browser storage for authenticated sessions, OAuth continuity, invitation continuity in one witness flow, and a small presentation preference. It does not currently use advertising or analytics identifiers. Read the Cookies and storage notice.

We will update the date and version when this notice changes materially and provide further notice where appropriate. Privacy questions and requests can be sent to info@darwinianangel.com or through the reporting route. General and legal enquiries can be sent to hello@intuitioneer.com.