Privacy Policy

Archer Futura Technologies AB, org. no. [org number not set], [address not set], Sweden ("we") is the controller of the personal data described in this policy, unless a section says otherwise. You can reach us on data protection matters at [privacy email not set].

This policy covers the website and the AI First Matrix service: the Quick Scan and the Opportunity Map, the Workforce Pulse, the assessor workspace, and the assessments we carry out for client companies.

1. Data we process, and why

Visiting the site

Our hosting provider records the IP address, time, requested page and browser type of each request in server logs, to keep the site running and secure. Legal basis: our legitimate interest in operating a secure service (GDPR art. 6(1)(f)). Logs are kept for a short period set by the provider and are not used to profile visitors.

We count page views with Plausible Analytics (Plausible Insights OÜ, Estonia, EU). For each visit it records the page, the referrer, the country and the browser and device type. It sets no cookie and stores nothing in your browser. Your IP address and browser signature are used only to derive the country and a daily, non-reversible hash that keeps one visitor's page views for that day apart from another's; the IP address is not stored, and no identifier follows you between days or across sites. We see aggregate statistics only. Legal basis: our legitimate interest in knowing how the site is used (art. 6(1)(f)).

Quick Scan and Opportunity Map

Your answers and figures are stored in your own browser (in local storage) so that you can return to them. They are not sent to us. If you choose to add your Quick Scan result to the anonymous pool, we store your company size band, the sector you select, your scores and the date: nothing that identifies you or your company. That contribution is not personal data.

Workforce Pulse

The Pulse is an anonymous survey sent to a client company's employees by link. We store the answers, the respondent's role level (executive, manager, frontline), the function chosen from the client's list, and the date. We do not store the respondent's name, e-mail address, IP address, device or exact time, and we do not place any cookie or identifier in the respondent's browser. Results are only ever shown for groups of ten or more, or for the company as a whole. The Pulse is designed so that the answers cannot be linked to a person. Where the client company is nonetheless considered the controller of the survey, we act as its processor under the assessment agreement.

Assessments carried out for a client company

To assess a company we process:

• contact details of the client's representatives (name, role, work e-mail, phone) to run the engagement (legal basis: performance of the contract, art. 6(1)(b), and our legitimate interest in managing client relationships, art. 6(1)(f));
• interview notes, documents and references to documents provided as evidence, which may mention employees by name or role (legitimate interest of the client and of us in carrying out the assessment the client has commissioned, art. 6(1)(f); a data processing agreement applies where we act as processor);
• usage data from the client's AI tools. The client's administrator exports a per-user usage report; that file is read in the assessor's browser and only totals and groups of ten or more are sent to us and stored. No name, e-mail address or individual activity leaves the assessor's computer, and none is stored by us.

Outside-in assessments

For an outside-in assessment we assess a company on public sources only: its website, job advertisements, annual reports, press and similar. These may mention named executives or employees. We store the URL of the source, the date we looked at it and a short note. Legal basis: our legitimate interest in providing research about companies from information they have made public (art. 6(1)(f)). Where we use an AI research assistant to find such sources, the company's name and website are sent to the AI provider together with the public pages retrieved; no client data or personal data from our systems is sent.

Client accounts

A client company's contacts may be given an account to see their own company's assessments: their status, the workforce-pulse link, the final report, and to record whether the anonymised result may join our benchmark base. Sign-in is provided by Clerk, as below. We store the contact's e-mail address, name and the link to their company, and the fact and date of a benchmark consent given. Legal basis: performance of the assessment agreement (art. 6(1)(b)).

Assessor and administrator accounts

Our assessors and administrators sign in with an account. Sign-in is provided by Clerk, which processes the account e-mail address, name, password or passkey, sign-in events and session tokens. We store the account's e-mail address, name and role, and the actions taken in the workspace (who scored what, when), which the method requires as an audit trail. Legal basis: performance of the assessor's contract with us (art. 6(1)(b)) and our legitimate interest in the integrity of assessments (art. 6(1)(f)).

Correspondence

If you write to us, we process what you send for as long as it takes to deal with it, and afterwards as required by bookkeeping or contract law.

2. Recipients

We use these providers, each bound by a data processing agreement:

Provider	Purpose	Location
Supabase	Database	Ireland (EU)
Vercel	Hosting and delivery of the site	Servers in Ireland (EU); Vercel Inc. is a US company
Clerk	Account sign-in for assessors and administrators	Clerk Inc., US
Plausible	Page-view statistics for the site	Plausible Insights OÜ, Estonia (EU)
Anthropic	AI research assistant for outside-in assessments (public sources only)	Anthropic PBC, US

We do not sell personal data and do not share it with advertisers. We disclose personal data to authorities only where the law requires.

3. Transfers outside the EU/EEA

Our database and hosting are in the EU. Where a provider is a US company, or support access may take place from outside the EEA, the transfer is covered by the EU–US Data Privacy Framework, by the European Commission's standard contractual clauses, or both. You may ask us for details of the safeguards in place.

4. How long we keep data

• Server logs: as set by the hosting provider, at most a few months.
• Page-view statistics: indefinitely, as aggregate counts that contain no personal data.
• Quick Scan pool contributions: indefinitely, as they contain no personal data.
• Workforce Pulse answers: for the duration of the assessment and for benchmarking afterwards, in anonymous form.
• Assessment records, including contact details and interview notes: for the term of the client agreement and for ten years afterwards, in line with the limitation period for contractual claims and the Swedish Bookkeeping Act where invoicing records are concerned. The client may ask for earlier deletion of material that is not needed for those purposes.
• Assessor accounts: for the term of the engagement with us; the audit trail of scoring remains attached to the assessments.
• Correspondence: as long as needed to handle the matter, then in line with bookkeeping and limitation rules.

5. Your rights

You have the right to ask for access to the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, and to receive data you have provided to us in a portable format, in each case within the limits of the GDPR. Where processing rests on consent, you may withdraw it at any time. Write to [privacy email not set].

You also have the right to lodge a complaint with a supervisory authority. In Sweden that is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se.

6. Security

Data is encrypted in transit and at rest with our providers. Access to client data is restricted to the assessors assigned to the assessment and to administrators, each signed in individually. Usage exports are aggregated before anything is stored, and survey results are only shown for groups of ten or more.

7. Children

The Service is for businesses and is not directed at children under 16.

8. Changes

We may update this policy. The version in force is published on this page with its effective date; we keep earlier versions and will tell clients about material changes.

9. Contact

Archer Futura Technologies AB, [address not set], Sweden. Data protection: [privacy email not set]. General: [contact email not set].

Effective from 2026-09-22.