Privacy Policy

1. Who We Are

InspirU is the registered trademark of the company BrilliU.app Ltd that is the Data Controller.

2. What We Collect

During your InspirU experience, we collect, store, encrypt and never share the following:

• Contact Info: Your Name and Email Address.
• Usage Data: All app usage data: we track the content you view and the features you interact with in the app, to help with improving & personalising your experience.
• Your Reflections and Ideas: The text you provide in reflections & challenges, and in the ideas you create with Comets & Innovation Projects and Aurelius AI conversations.
• Files You Upload: Any documents or images you upload are stored securely and used only to support your work with Aurelius. If you share a file by mistake, you can remove it, or ask Aurelius to: we delete the file and everything Aurelius learned from it, including its summary and the parts of the conversation that used it.
• CQ Analysis Data: Your responses to the full 3-CQ Study. Please note: we anonymise all 3-CQ study responses before aggregating them for use in research.
• Voice Input: If you choose to use the microphone, your browser's own speech service (for example Google in Chrome or Apple in Safari) turns your speech into text. We never receive, record or store your voice, only the text you choose to submit. This is a feature of your browser, not one of our processors.
• Read Aloud: If you choose to have an Aurelius reply read aloud, or when Aurelius greets you while music is playing, its text is sent to Google Gemini (listed in Section 4) to create the audio. The audio is played to you and never stored by InspirU. Your greeting is stored on your own device, so it can replay instantly; it is replaced when its words or voice change.
• Digital Legacy: If you nominate a trusted data beneficiary, to inherit your InspirU data should you pass away, we store their name and email and send them an email to tell them. They can decline at any time, and we then delete their details. If your data beneficiary asks to inherit your data, we email you first. If you open InspirU, the request is declined automatically and we contact you as part of our investigation. If we receive no response from you in 48 hours, our security team calls your nominated data beneficiary to seek proof (such as a death certificate) before sharing any data. We keep their phone number and a record of the proof checked with our security records. Your data may include what you wrote about other people. Innovation projects related to your enterprise access are never shared. Enterprise users cannot nominate a data beneficiary; this is part of our strict SOC 2 controls.

3. How We Use It

• To provide you with a secure, password protected access to your CQ Report and the InspirU app.
• To provide Aurelius AI with the context it needs to personalise how it supports you with coaching and co-innovation.
• If you consented to receive communications: we may occassionally send emails updates on features to support your personal innovation. Your consent status can be updated via the app settings page.

Specific Use of your CQ Study Data:

• Strict Purpose: Any data provided by an individual as part of their CQ analysis is used strictly for the purposes of providing that individual with their CQ Report and its outputs.
• No Third-Party Sharing: We never share any individual's inputs and outputs for the CQ analysis with 3rd Parties (this excludes our service processors listed in Section 4, who process data solely on our instructions).
• Benchmarking: Only Aggregated and Anonymised CQ scores are used as part of our Academic Research and B2B benchmarking service. Your individual data is never identifiable in these datasets.

4. Our Data Protection Pledge

Your trust is our most valuable asset. We make the following strict guarantees regarding your data:

• Security by Design: Data is encrypted both in transit (TLS/SSL) and at rest. We adhere to strict Role-Based Access Control (RBAC) ensuring your private workspaces and North Star sessions remain strictly confidential.
• No Selling of Data: We do not sell, trade, or rent your personal information to third parties for marketing or any other purpose.
• No AI Training on Personal Data: We strictly DO NOT use your personal reflections, notes, or ideas to train public AI models.
• Trusted Processors Only: We share data strictly with the following processors, each necessary to run this platform: Google Firebase / Google Cloud Platform (database and hosting infrastructure), Vercel (application hosting), Google Gemini API on a paid tier (our AI model provider — paid-tier usage is excluded from Google's model training under Google's API terms), Stripe (payment processing), Resend (transactional email), and Airtable (our editorial content library). These processors act solely on our instructions under contract — they are not third parties who use your data for their own purposes. We do not share your data with any processor beyond this list. See Section 11 for how we safeguard any transfer of your data outside the UK.

5. Children's Privacy (COPPA)

Our Service is not intended for individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to remove that information from our servers. If you believe we might have any information from or about a child under 13, please contact us.

6. Your Data Rights & Contact

You have the right to access, correct, export, or request the deletion of your personal data at any time. To exercise these rights, or if you have any questions regarding this Privacy Policy, please contact our Data Protection team: support@inspiru.ai

7. Data Retention & Deletion

We retain your personal data for as long as your account remains active. When you request deletion of your account, we permanently delete your personal data — including your reflections, ideas, and CQ history — from our live database immediately upon processing your request.

Where you have contributed to a corporate workspace as part of an enterprise engagement, that content is retained by the relevant organisation as its business record, but is anonymised at the point of your account deletion: your name and personal identifiers are permanently removed from it, so it can no longer be linked back to you.

Files you upload are deleted when you delete the Comets & Innovation Projects they belong to, or your account. Files you uploaded to a company's enterprise Comets & Innovation Projects stay with that company's workspace, anonymised like your other contributions there.

For disaster recovery purposes, our systems maintain rolling operational backups covering the preceding seven days. A residual copy of deleted data may therefore persist in these backups for up to seven days after deletion, purely for system recovery purposes, before being permanently purged.

8. Reporting a Security Concern

If you believe you have found a security vulnerability or wish to report a security concern, please contact our security team directly at security@inspiru.ai.

9. Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases to process your personal data:

• Performance of a Contract: We process your account information, reflections, ideas, Comets & Innovation Projects, and Aurelius AI conversations because this data is necessary to provide you with the InspirU service you have signed up for.
• Consent: Where you complete the 3-CQ Study, or opt in to receive marketing communications, we process your data on the basis of your explicit, freely given consent. You may withdraw this consent at any time via your account settings, without affecting the lawfulness of processing carried out before withdrawal.
• Legitimate Interests: We process aggregated, anonymised usage data to maintain, secure, and improve the platform. We have assessed that this processing does not override your fundamental rights and freedoms.
• Legal Obligation: Where required, we process and retain data to comply with our legal and regulatory obligations.

10. Security Incident Notification

If a security incident affects your personal data, we will notify you directly, with a factual account of what happened, what data was affected, and what steps we have taken. Where an incident meets the threshold for a personal data breach under UK GDPR, we will report it to the Information Commissioner's Office within the statutory 72-hour window.

11. International Data Transfers

Some of our processors (Section 4) are based in, or process data in, the United States. Where we transfer your personal data outside the UK, we ensure an appropriate legal safeguard is in place:

• Google (Firebase / Google Cloud Platform), Vercel, Stripe, and Resend are each certified under the UK Extension to the EU-U.S. Data Privacy Framework, a UK government-recognised adequacy mechanism that permits transfers to certified US organisations without additional safeguards.
• Airtable is not certified under the Data Privacy Framework. Transfers to Airtable are safeguarded via the UK Addendum to the EU Standard Contractual Clauses, incorporated into our agreement with Airtable.

We review the certification and transfer-safeguard status of our processors periodically to ensure continued compliance.

12. Cookies & Similar Technologies

InspirU uses one small, first-party cookie to understand how visitors use the site before they register. It is only set if you choose Accept All in the banner shown on your first visit; if you choose Reject, it is never set and the site works exactly the same. We never use cookies for advertising or cross-site tracking.

Where you arrive at InspirU as a guest, or via a specific research programme (for example, Prolific or an Open University study), we use your browser's session storage — a temporary storage technology — to carry your progress and any research-programme attribution data (such as your Prolific participant ID) through your session. This is strictly necessary to provide the specific service you have engaged with: for example, ensuring you receive the correct Prolific completion code, or that your in-progress reflections and ideas are not lost as you move between pages. This data is stored only for the duration of your browser session and is automatically cleared when you close your browser tab. It is not used for advertising, cross-site tracking, or any purpose beyond delivering the service you requested.