{"version":"notice_v2","language":"en","fiduciary":"Tovellan","summary":"This pre-launch notice describes Tovellan's current personal-data handling across Tovellan Masters, buyer enquiries, early-access applications and authenticated customer workspaces. Tovellan acts as fiduciary for the expert/public collection described here; the current DPA-gated customer-workspace path admits only processor-classified engagements and covers workspace-account authentication, customer artifacts and evaluations on the customer's instructions. It states implemented behaviour and open gaps; it does not claim complete erasure, real government-identity KYC, a final retention schedule, correction or nomination tools, or an operating grievance channel.","data_collected":["Expert account: email, raw password processed transiently to derive a one-way verifier (the raw password is not stored or logged), full name and account status.","Identity and age flow: the name and date of birth you enter, plus provider, status, age-check result and reference identifier. The current working provider is a mock and does not verify a government identity.","Expert onboarding: skills-test answers processed for grading (and may be sent to the configured judge when LLM grading is enabled), persisted per-item scores and result, interview-video object and submission metadata, and calibration submissions and scores.","Authored work: task content and versions, quality checks, review decisions and linked release provenance where applicable.","Buyer enquiry: name, email address, company, use case, target capability, model, data type, volume and timeline that you choose to submit.","Early-access application: name, email, domain and background that you choose to submit.","Customer workspace: tenant link, user email, role, account timestamp and a one-way password verifier, plus customer artifacts. The raw admin password is processed transiently to derive the verifier and is not stored or logged. Provisioning and login are recorded for customer_account_security; login, customer-artifact and evaluation processing require a provisioning administrator's signed-DPA assertion. Only that boolean is stored, not a signature or agreement reference. Covered operations write a basis-labelled audit row and no individual consent row for the workspace user.","Technical and evidence data: user agent, platform, a truncated hash of the client IP, timestamps, consent history and audit records."],"purposes":[{"purpose":"expert_account_creation","description":"Create and secure the expert account using the submitted email, full name and a one-way password verifier. The raw password is processed transiently to derive that verifier and is not stored or logged. Account status and timestamps are retained."},{"purpose":"kyc_verification","description":"Run the pre-launch age-and-identity flow. The only working provider is a mock that accepts the supplied name and date of birth; it does not verify a government identity. Tovellan stores the supplied name and date of birth plus the provider, status, age result and reference identifier."},{"purpose":"skills_assessment","description":"Process finance and accounting skills-test answers for grading. When LLM grading is enabled, the short answer can be sent to the configured judge. Tovellan persists per-item scores and the result, not the raw answer text."},{"purpose":"video_interview_storage","description":"Store the expert's interview-video object and submission metadata for review. Withdrawing this purpose queues deletion of the stored video object; the submission record and related evidence remain."},{"purpose":"calibration_task","description":"Store and grade the expert's calibration-task submission."},{"purpose":"task_authorship_storage","description":"Store, version, quality-check and review work the expert authors, and retain linked release provenance where applicable."},{"purpose":"marketing_contact","description":"Store the buyer-enquiry fields submitted through the Get data form and use them to respond about that enquiry."},{"purpose":"expert_onboarding_interest","description":"Store an early-access applicant's name, email, selected domain and background and use them to contact the applicant about that cohort."},{"purpose":"customer_account_security","description":"Provision and authenticate a customer workspace administrator under the processor-classified engagement. Store the tenant link, email, role, account timestamp and one-way password verifier. Login requires the provisioning administrator's signed-DPA boolean assertion; no individual consent row is created."},{"purpose":"customer_data_processing","description":"Store and process customer workspace artifacts on the customer's instructions when a provisioning administrator has asserted that a data-processing agreement is signed. The current system stores that assertion as a boolean, not a signature or agreement reference. This processing is not based on the individual workspace user's consent."},{"purpose":"eval_run_on_customer_model","description":"Run and record an evaluation requested by an authorised customer workspace user when a provisioning administrator has asserted that a data-processing agreement is signed. The current system stores that assertion as a boolean, not a signature or agreement reference. This processing is not based on the individual workspace user's consent."}],"rights":["Experts with an active account can download an access summary and view their consent and audit history. The summary includes authored records but does not disclose private benchmark split membership.","An expert can record withdrawal of a granted purpose. Withdrawal blocks future calls to the identity-check, skills, interview and calibration routes protected by the consent gate. Withdrawing task_authorship_storage also blocks creation, update, submission, reviewer access, quality checks and new review decisions for authored tasks until a new current-notice grant is recorded; existing authored work, review records and linked provenance are retained. Only withdrawal of video_interview_storage also queues deletion of stored interview-video objects. Withdrawing expert_account_creation does not delete the account or disable login. Account and KYC-retention consequences remain unresolved.","Expert self-service erasure removes the name and date of birth from expert and KYC records, disables sign-in, and queues deletion of any processor-held interview-video objects. It does not delete the email/account record, verification outcome, consent and audit evidence, onboarding submissions, authored work, review records or linked benchmark provenance.","Self-service correction and nomination are not implemented.","Buyer leads and early-access applicants do not yet have an authenticated or manual access, correction, withdrawal or erasure path.","For processor-classified customer workspaces, data-principal requests are handled through the customer/Data Fiduciary under the DPA. The current API gives tenant administrators tenant-scoped artifact erasure and audit access; it does not provide a tenant-user self-service account access, correction or erasure route. Expert privacy controls do not apply to workspace users.","A named Grievance Officer and operational grievance contact are not yet provisioned."],"retention":"Audit and consent evidence is currently retained. Configuration defines a 365-day minimum for audit logs, but the automated purge or archive sweep is not implemented. Retained expert-account, verification, onboarding, authored-work, review/provenance, buyer-enquiry, early-access and customer-workspace account/artifact records have no final retention or de-linking schedule yet. Interview-video objects are queued for deletion only after video-consent withdrawal or expert erasure. This notice does not promise deletion when a purpose is served.","grievance_officer":"Not provisioned. No named officer or dedicated grievance mailbox is operational. Deployed expert/public personal-data intake is blocked until an officer and reachable contact are published. Authenticated customer artifact and evaluation processing is separately gated by an administrator's DPA assertion, whose signature and agreement reference are not yet retained."}