Privacy policy

1. Privacy at a glance

Pygar is an AI-supported preparation service for managers and professionals. It helps you prepare for difficult conversations, meetings and decisions involving other people, and check your own reasoning, using five tools: Difficult Conversation, Meeting Challenge, Assumption Check, People Decision Check and Perspective Engine. It also offers a communication colours assessment, a Communication Card and private people notes.

To provide the service, Pygar processes the situations, answers, notes, documents and other material that you provide. It uses an AI model to generate preparation briefs, challenges, practice conversations and feedback.

The main points are:

• Every plan, including the Free plan, receives the same privacy protections.
• Pygar does not sell or rent personal information.
• Pygar does not use your content to create advertising profiles.
• Pygar does not use your content to train AI models, and our AI suppliers have committed not to use it to train theirs.
• Pygar never reads your email, chats or other messages. It uses only what you choose to type, paste or attach for a task.
• Your situations, sessions, people notes, saved openings and attached documents are private to you. If you belong to an organisation, its owners, admins and managers cannot see them.
• Your Communication Card is private unless you choose to share it with your organisation’s managers or list it in its team directory. You can withdraw it at any time.
• Pygar support can see your content only if you give permission, for one situation or all of them, for up to seven days. Every time support looks is shown to you.
• Pygar does not make decisions about people. People Decision Check reviews your reasoning and never decides, ranks or recommends an outcome about someone.
• Employers must not use Pygar as the sole or determinative basis for recruitment, promotion, discipline, dismissal, pay, performance management or similar employment decisions.
• You can download your data at any time, and ask for your account to be deleted from your account page. We delete it 30 days after you ask, you can cancel at any time before then, and once it is deleted it is gone permanently.
• If you connect your own AI assistant to Pygar, it can read your situations and completed briefs, never your people notes, Cards or documents.
• You also have the wider rights described in section 17.

2. Who this policy applies to

This policy applies to:

• visitors to Pygar’s public pages;
• people who send us a message through our contact form;
• people with a personal Pygar account;
• organisation owners, admins, managers and members;
• people invited to join an organisation;
• people described in information that a Pygar user enters, such as a situation or a people note;
• customer and prospective-customer representatives;
• suppliers and professional contacts; and
• people who contact us about privacy, legal, safety or security matters.

Pygar is intended only for people aged 18 or over.

We do not knowingly provide accounts to children.

3. When Pygar is a controller or processor

Data-protection roles depend on who decides why personal information is processed and the essential means used to process it. They are determined by the actual activity, not merely by labels in a contract.

3.1 Personal accounts

For your own account and the content you create, Pygar normally acts as the controller. This applies whether or not you belong to an organisation, because an organisation cannot access your private content.

This means Pygar decides why and how the personal information needed to provide, protect and administer the service is processed.

If you enter information about other people, for example in a situation, a people note or a document, you decide what to include and why. Depending on your circumstances, you may be responsible for that information under data-protection law, and Pygar processes it to provide the service to you. Section 21 explains what this means.

3.2 Organisations

Organisation processing involves shared responsibilities.

The Enterprise customer as controller

The business or other body that sets up an organisation on Pygar or buys an Enterprise plan (the “Enterprise customer”) will normally act as controller for the processing that it directs, including:

• inviting people to join;
• deciding who joins and how many seats to buy;
• creating units and placing members in them;
• assigning owner, admin, manager and member roles;
• deciding which managers are responsible for which units;
• determining why it needs any workplace information obtained through Pygar; and
• using information obtained through organisation features, such as Communication Cards that members choose to share.

For that processing, Pygar normally acts as the Enterprise customer’s processor and follows its documented lawful instructions.

The Enterprise customer is responsible for:

• identifying its lawful basis;
• giving workers and other users an appropriate privacy notice;
• making sure its use is necessary, fair and proportionate;
• consulting workers or representatives where appropriate;
• avoiding coercion or disadvantage connected with optional sharing;
• restricting access to authorised people;
• responding to employment-related questions about its use of Pygar; and
• complying with employment, equality and data-protection law.

Pygar as an independent controller

Pygar remains an independent controller where it determines its own purposes, including:

• creating and authenticating Pygar accounts;
• providing each person’s private preparation, people notes and Card;
• protecting the platform;
• preventing fraud, misuse and security incidents;
• maintaining required consent, sharing and access records;
• administering Pygar’s own billing, once paid plans are on sale;
• responding directly to support or privacy requests;
• maintaining service reliability;
• complying with legal obligations; and
• establishing, exercising or defending legal claims.

The Enterprise agreement and data processing agreement describe the intended allocation of responsibilities. They do not override the parties’ actual legal roles.

4. Information we collect and use

The information we process depends on how you use Pygar.

4.1 Account and identity information

This may include:

• your name;
• email address;
• password hashes and other protected sign-in credentials, including the secret used for two-step verification if you turn it on;
• if you sign in with Google, the name, email address and account identifier that Google shares with us;
• session and account identifiers;
• the devices and browsers you are signed in on;
• account status, including any suspension;
• organisation memberships, roles and units;
• settings and preferences; and
• your confirmation that you are 18 or over, and the versions of the Terms of Service and this policy you accepted, with the date.

We do not store or have access to your password in readable form.

When you create an account, we ask for your date of birth to check that you are 18 or over. It is checked in your browser and is never sent to us or stored. We keep only your confirmation that you are 18 or over, and when you gave it.

4.2 Situations and other content you create

This may include:

• situations, including their descriptions and the people involved;
• files you attach to a situation, which may be text or PDF files of up to 10 MB each, with at most ten for each situation;
• what you enter in a session with a tool, including your description, your answers to its questions and any material you paste;
• preparation briefs, challenges, updated briefs, suggested openings and other output generated for you;
• practice and rehearsal conversations, including your replies and the feedback on them;
• the text read from documents you attach to a Meeting Challenge, with at most three for each session (Pygar keeps the text, not the file);
• insights you choose to carry from one session into another;
• outcome notes;
• saved openings;
• people notes, including a name or label for the person, your relationship, the communication colours you think they lean towards, words they tend to use and your notes;
• your communication colours assessment answers and result;
• your Communication Card, including the preferences you describe and how far you share it; and
• permissions you give Pygar support.

Your content may reveal information about you or another person.

Do not include information that is unnecessary, confidential information that you are not entitled to disclose, or sensitive information that Pygar has not expressly asked you to provide.

4.3 Generated content, colours and safety checks

Pygar generates information from what you provide.

Depending on the feature, this may include:

• preparation briefs, challenges, suggested openings, practice replies and feedback, generated by an AI model;
• a primary and secondary communication colour, calculated from your assessment answers by fixed scoring rules;
• the outcome of the safety check that runs before Pygar prepares anything, including its category, such as a request that needs a qualified professional or a situation where someone may be at risk; and
• a record of the prompt version, model and time used to prepare each result.

Generated output is based only on the information available to the tool and the instructions Pygar gives the model.

Briefs, communication colours and other outputs are not medical, psychiatric, psychological, clinical or occupational assessments. They are not objective statements about your or anyone else’s intelligence, character, health, fitness for work, professional capability or future performance.

Limited, unusual or unrepresentative information may materially affect an output.

4.4 Organisation information

This may include:

• the organisation’s name;
• units and their names;
• each member’s role as owner, admin, manager or member;
• which members belong to which units;
• which units each manager is responsible for;
• invitations, including the invited email address, role, who sent it, when it expires and whether it has been used;
• membership dates;
• organisation activity records, such as people joining or leaving, role changes and invitations; and
• whether each member has turned on two-step verification and whether they share their Card with managers, which owners and admins can see.

4.5 Billing and commercial information

Paid plans are not on sale yet, and Pygar does not currently collect payment information.

Before paid plans go on sale, we will update this policy to name our payment provider and describe the billing information we use, such as billing name, organisation name, plan, billing interval, seat numbers, subscription and payment status, and tax and accounting records.

Payment-card and bank-account details will be collected and handled by the payment provider.

Pygar will not store full payment-card details in its application database.

4.6 Communications and support information

This may include:

• your name and email address;
• the topic you choose and the content of your message;
• relevant account information;
• any files you choose to send us;
• our response;
• internal notes about your request;
• support permissions you give, and the record of each time support viewed your content; and
• complaint or resolution records.

4.7 Technical, security and service information

This may include:

• sign-in sessions;
• security events, such as changes to your password, email address or two-step verification;
• a one-way hash of the IP address of visitors who are not signed in, used to apply rate limits and normally deleted after a day;
• counts of actions, such as messages sent through the contact form, checked against rate limits;
• a record of each AI request, including the tool and step, prompt version, model, outcome, time and number of tokens used, but not its content;
• activity records showing which kind of record changed and when, with the names of changed fields and limited non-content values;
• error information; and
• the signals that Cloudflare’s human check collects when you sign in, such as your IP address and browser details.

Because an IP address can sometimes be worked out from its hash, we treat the hash as personal information.

Pygar’s operational records are designed not to store the content of your situations, sessions or notes.

Our hosting, sign-in, email, security and AI suppliers may receive ordinary network information, including IP address, device and browser information, when they provide their services.

4.8 Information you must provide

To create and operate an account, we normally need:

• your name;
• an email address;
• a password, or a Google account if you choose to sign in with Google;
• your date of birth, checked in your browser to confirm you are 18 or over;
• your acceptance of the Terms of Service;
• information necessary to provide your account or organisation; and
• content needed to carry out a request you make.

Without this information, we may be unable to create or secure your account or provide the requested service.

Optional information, such as people notes, your Communication Card, two-step verification and Card-sharing settings, is not required unless we clearly explain otherwise when collecting it.

Refusing an optional choice will not prevent you from using unrelated features.

5. Where information comes from

We obtain personal information:

• directly from you;
• from an organisation owner or admin who invites you, who provides your email address and role;
• from other Pygar users who describe you in their situations, people notes, documents or sessions;
• from Google, if you choose to sign in with Google;
• from your use of Pygar;
• from the choices you make in the service;
• by generating output or calculating results from what you provide;
• from hosting, sign-in, security and AI suppliers;
• from an authorised representative acting for you; and
• from public business information where necessary to verify or communicate with an organisation.

An Enterprise customer or other person providing information about you must have authority and a lawful basis to do so.

Where data-protection law requires us to give you information after receiving your data from another source, we will do so within the applicable legal period, normally at first contact, before disclosure or within one month.

Pygar cannot see what users write about other people in their private content, so it cannot tell the people described. Because contacting them would be impossible or would involve disproportionate effort, we rely on publishing this policy instead.

6. Why we use information and our lawful bases

We must have a lawful basis for each processing purpose.

Where Pygar acts only as an Enterprise customer’s processor, the customer is responsible for identifying the lawful basis. Pygar processes the information on the customer’s documented instructions and under the Enterprise data processing agreement.

Where Pygar acts as controller, the usual purposes and bases are:

Where we rely on legitimate interests, we assess:

• the interest being pursued;
• whether the processing is necessary;
• the likely effect on you;
• what you would reasonably expect;
• whether a less intrusive method is available; and
• the safeguards that can reduce the impact.

You may object to legitimate-interest processing as explained in section 17.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal.

7. How Pygar uses AI

7.1 AI-supported functions

Pygar uses an AI model to:

• check each request against safety rules before preparing anything;
• check the text of a document before it is attached to a Meeting Challenge;
• prepare the brief for the tool you choose;
• challenge your brief and update it;
• play the other person in a practice conversation, or ask the questions a meeting may raise;
• give feedback on your practice replies; and
• suggest insights that you can carry into another session.

The communication colours result is not generated by AI. Each of your answers counts towards one colour, and you can see the counts behind your result.

Pygar sends AI requests through the AI gateway provided by Lovable (Lovable Labs Sweden AB), which passes them to a Google Gemini model.

We may change the model or provider. We will update this section when we do.

Pygar sends the model only the information needed for the step. Everything you enter is marked as information to analyse, never as instructions for the model to follow.

7.2 AI-provider training and retention

Pygar does not use your content to train AI models.

Lovable states that the data people submit to apps built on its platform is not used for model training. Google’s terms for its paid AI services state that it does not use prompts or responses to improve its products.

Providers may retain requests or related records temporarily for:

• security;
• abuse detection;
• service operation;
• legal compliance; or
• other limited exceptions stated in their business or API terms.

Provider retention may vary by provider, service and contract. Google keeps requests to its paid services for a limited period to detect misuse and meet legal requirements.

We have configured the AI gateway so that Lovable does not keep a copy of the content of AI requests.

We review provider terms and settings before enabling a provider.

7.3 Safety checks

Before Pygar prepares anything, a safety check reads the situation, your description, any pasted material and your answers.

If the check finds that a request:

• involves a risk to someone’s safety or wellbeing, Pygar stops and points you to human support, including the emergency services and Samaritans;
• needs a qualified medical, legal or financial professional, Pygar stops and explains that it cannot advise; or
• asks Pygar to decide, rank or recommend an outcome about a person, or to judge someone using protected or special-category information, Pygar refuses and explains what it can help with instead.

When the check stops a session, the session records the check’s category and outcome. They stay in your account, visible only to you, until you delete the session, its situation or your account. Pygar does not use them for any other purpose.

Automated safeguards cannot identify every sensitive, unlawful or unsuitable input. You remain responsible for avoiding unnecessary sensitive or third-party information.

7.4 Profiling

The communication colours assessment may amount to profiling, because it uses automated scoring to describe your communication preferences.

The main factors are:

• your answers;
• the version of the questions you answered; and
• the fixed scoring rules for that version.

The result affects how your Card describes your preferences and, where you share your Card, how other people’s preparation adapts its wording, order, pace and level of detail.

The result does not establish facts about your intelligence, personality, health, employability or professional competence.

Pygar’s tools also analyse what you write about other people in a situation. Pygar instructs the model to treat what you write as your account rather than as fact; never to diagnose, label or psychologically profile anyone; never to state another person’s motives, feelings or abilities as fact; and never to infer protected or special-category characteristics.

Your people notes about someone are never used to create or change that person’s own Communication Card.

You should consider the available evidence, context and limitations and apply human judgement.

7.5 No significant solely automated decisions

Pygar does not use generated output or communication colours to make solely automated decisions that have legal or similarly significant effects on you or anyone else.

Pygar does not decide through automated processing whether you should:

• be employed;
• receive work;
• be promoted;
• be disciplined or dismissed;
• receive particular pay or benefits;
• obtain credit or insurance;
• receive healthcare; or
• gain access to another significant service.

People Decision Check examines the evidence, assumptions and consistency behind a judgement that you are making about another person. It never makes, ranks or recommends the decision. The decision, and responsibility for it, stay with you.

Enterprise customers must not use Pygar as the sole or determinative basis for employment or similarly significant decisions.

If Pygar introduces significant solely automated decision-making in future, we will first provide specific information about the decision, lawful basis, logic, likely consequences and available safeguards. Those safeguards would include the ability to obtain human intervention, express your view and challenge the decision where required by law.

Since 5 February 2026, Articles 22A to 22D of the UK GDPR have allowed significant decisions based solely on automated processing only with safeguards, including information about the decision and the ability to make representations, obtain human intervention and contest it. Stricter rules apply where special-category information is involved.

7.6 Practising with AI

When Pygar plays another person in a practice conversation, or asks the questions a meeting may raise, you are interacting with an AI model, not a person.

The practice uses only what you have supplied. It is not the real person and does not predict how they will respond.

7.7 Connecting your own AI assistant

You can choose to connect an AI assistant that supports the Model Context Protocol to your Pygar account. The assistant asks for access, and you approve or refuse it on a Pygar page while you are signed in.

If you approve, the assistant can read your situations (their title, description, goal, outcome note and status) and your completed preparation briefs. It cannot read attached files or documents, people notes, Communication Cards, practice conversations or the other inputs to a session, and it cannot change anything or run Pygar’s tools. Two-step verification and account suspension still apply.

If you use an AI assistant built into your browser, it can also read the titles of the situations shown on your screen. Lovable may receive a record that this happened, whether it worked and how long it took, without any content.

What an assistant reads is passed to its provider and handled under that provider’s own terms and privacy policy, not ours. To stop access, disconnect Pygar in the assistant’s settings.

8. Organisation privacy boundaries

8.1 Information available to an organisation

Every member of an organisation can see other members’ names, roles and units.

Organisation owners and admins can also see the information needed to run the organisation, including:

• members’ email addresses;
• whether each member has turned on two-step verification;
• whether each member shares their Card with managers;
• invitations, and each invitation link until it is used;
• units, and which managers are responsible for them; and
• organisation activity, such as people joining or leaving, role changes and invitations.

Access depends on the person’s role.

8.2 Private account content

Organisation features do not give an owner, admin or manager access to your:

• situations;
• sessions, briefs, challenges or practice;
• attached files or documents;
• people notes;
• saved openings;
• outcome notes;
• carried insights; or
• assessment answers.

These boundaries apply to the organisation features provided by Pygar.

They do not prevent you from choosing to copy, show or send your own content to another person.

Exceptionally, authorised Pygar personnel may access or disclose limited content where necessary to:

• investigate a security incident;
• respond to a valid data-protection request;
• comply with a legal obligation; or
• establish, exercise or defend legal claims.

We keep this access to the minimum necessary. Support access for any other reason needs your permission, as explained in section 8.8.

8.3 Your Communication Card

Your Communication Card is written by you and is private by default. You choose whether to:

• share it with your organisation’s managers, so that managers responsible for your units, and the organisation’s owners and admins, can see it and use it to prepare conversations and meetings with you; and
• list it in your organisation’s team directory, so that colleagues can see your primary and secondary colour, and your own words only if you choose to show them.

Your assessment answers and counts are never shown to anyone else.

The “who can see my Card” view shows who can see your Card at any time.

Nobody else can add to or change your Card.

8.4 When someone uses your shared Card

When a manager, owner or admin includes your shared Card in a preparation, a copy of your shared preferences is saved with their session, so that their preparation stays as it was prepared.

Pygar instructs the model to treat Card preferences as your own declared preferences. They may affect only wording and how a conversation or meeting is prepared, and they are not evidence of ability, conduct or suitability.

8.5 The meaning of the sharing control

The sharing control is a technical privacy instruction.

It does not, by itself, establish that an employer or other Enterprise customer has a lawful basis to use the information.

Workers may not always be able to give freely chosen consent to an employer because of the power imbalance in the relationship.

The Enterprise customer must therefore:

• establish its own lawful basis;
• avoid pressure or disadvantage;
• make the purpose clear;
• limit the use of the information;
• provide an alternative where appropriate; and
• respect withdrawal and objection rights.

ICO guidance recognises that workplace monitoring and profiling can be intrusive and must be necessary, proportionate and transparent.

8.6 Withdrawing a sharing setting

You can change how far your Card is shared, or withdraw it, at any time.

Switching sharing off stops future access through the organisation.

It cannot:

• retract information already lawfully viewed;
• remove copies of your Card already saved in other people’s sessions, which are deleted when they delete that session or their account;
• remove information a recipient has separately recorded outside Pygar; or
• erase access and consent records that Pygar must retain for security, accountability or legal claims.

8.7 Team reporting

Pygar does not currently provide team-level reports or aggregate patterns about members.

If we introduce them, we will update this policy first. Any such report will be withheld for groups small enough to expose individuals and will never rank or rate people.

8.8 Support access

Pygar support can see your content only through a permission that you create in Account and security. A permission covers one situation or all of them, lasts 24 hours, three days or seven days, and can be ended at any time.

Support never sees your people notes or Card, the communication context saved with a session, or documents attached to a Meeting Challenge.

Every time support views your content, the view is recorded and listed for you.

8.9 Leaving an organisation

If you leave an organisation or are removed from it, your account and private content stay with you, and your Card is no longer visible to that organisation.

The organisation keeps its activity records about your membership.

If the last member of an organisation deletes their account, the organisation is deleted too.

9. Sensitive and criminal-offence information

“Special-category information” includes information revealing or concerning:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• genetic information;
• biometric information used to identify a person;
• health;
• sex life; or
• sexual orientation.

Criminal-offence information includes allegations, investigations, proceedings, convictions and related security measures.

Pygar is not designed for the routine processing of this information in situations, sessions, people notes or documents.

Do not submit it about yourself or another person unless:

• a feature expressly asks for it;
• the purpose is clear;
• the information is necessary; and
• Pygar has provided appropriate feature-specific information.

Pygar instructs its AI model never to infer health, ethnicity, religion, political opinion, sexual orientation, trade-union membership or criminal history.

The safety check refuses requests to judge or make decisions about identifiable people using special-category or other protected information (section 7.3). Pygar does not otherwise search your content for sensitive information.

Do not record special-category or criminal-offence information about other people in people notes.

Pygar will not continue processing special-category information unless it has:

• a lawful basis under Article 6 of the UK GDPR; and
• an applicable condition under Article 9.

Pygar will not continue processing criminal-offence information unless it has:

• a lawful basis; and
• official authority or an applicable condition under Article 10 and the Data Protection Act 2018.

Where required, Pygar will maintain an appropriate policy document.

UK law requires an Article 6 basis and a separate Article 9 condition before special-category processing begins. Some conditions also require safeguards under the Data Protection Act 2018.

Enterprise customers must not instruct workers to submit sensitive information or use Pygar to infer it.

10. Who receives personal information

We disclose personal information only where necessary for the purposes described in this policy.

Recipients may include:

• Lovable (Lovable Labs Sweden AB), which hosts the Pygar application and its backend (Lovable Cloud), provides the AI gateway and sends Pygar’s emails, such as account confirmations, password resets and notices about your account;
• Supabase, whose platform runs Pygar’s database, file storage and sign-in service within Lovable Cloud, and which may send sign-in emails for Lovable;
• Google, whose Gemini models generate AI output through the AI gateway, which provides Google sign-in if you choose it, and which serves the fonts used on Pygar’s pages;
• Cloudflare, which runs the human check on the sign-in page;
• a payment provider, once paid plans are on sale, which we will name in this policy before then;
• an Enterprise customer, owner, admin or manager, within the role and privacy boundaries in section 8;
• colleagues in your organisation, if you list your Card in its team directory;
• an AI assistant you choose to connect, and its provider (section 7.7);
• professional advisers;
• insurers;
• auditors;
• security and incident-response specialists;
• potential investors, purchasers or transaction counterparties under appropriate confidentiality controls;
• courts and tribunals;
• regulators;
• law-enforcement bodies; and
• public authorities where disclosure is legally required or necessary to protect legal rights.

AI providers may act as processors or sub-processors for submitted content.

Some suppliers may also act as independent controllers for their own purposes, such as Cloudflare improving its bot detection, Google providing Google sign-in and its fonts service, and payment providers meeting financial-regulation and fraud-prevention duties. Their own privacy information applies to those activities.

If Pygar is involved in a genuine merger, acquisition, restructuring or sale, relevant information may be disclosed to advisers and transaction counterparties under confidentiality and data-protection safeguards.

Pygar does not sell or rent personal information.

11. International transfers

Pygar’s database, sign-in accounts and uploaded files (situations, people notes, Cards, tool results and attachments) are held in Lovable Cloud, hosted on Amazon Web Services in Ireland (EU, eu-west-1).

Lovable is based in Sweden. Some suppliers and subprocessors, including Google, Cloudflare and Supabase, operate in the United States and other countries outside the United Kingdom.

Where a transfer is restricted under UK data-protection law, Pygar uses an appropriate transfer mechanism. Depending on the recipient and destination, this may include:

• UK adequacy regulations, which cover the European Economic Area and some other countries;
• the UK Extension to the EU-US Data Privacy Framework, where the US recipient is certified under it;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses;
• approved binding corporate rules; or
• another lawful safeguard.

Where required, we assess the circumstances of the transfer and whether supplementary technical, contractual or organisational measures are needed.

You may contact us for information about the relevant transfer safeguard. We may provide a summary or redacted copy where necessary to protect commercial or security-sensitive information.

Current ICO guidance recognises adequacy regulations, the UK IDTA and the UK Addendum as available transfer mechanisms and requires an assessment where appropriate safeguards are used.

12. How long we keep information

We keep personal information only for as long as needed for the relevant purpose.

We consider:

• whether your account remains active;
• whether the information is still needed to provide a requested feature;
• whether you have asked us to delete it;
• security and fraud-prevention needs;
• legal, tax and accounting duties;
• complaint and dispute periods;
• whether the information remains accurate and useful;
• contractual commitments; and
• whether the information can instead be anonymised.

Our main retention periods and criteria are:

We may retain irreversibly anonymised information because it is no longer personal information.

If you are the only owner of an organisation that has other members, an admin becomes the owner when your account is deleted. If there is no admin, you will be asked to make another member an owner or admin first, and the deletion waits until you have.

These operational steps do not remove your right to request erasure. Pygar and the Enterprise controller will determine the lawful route.

Data-protection law does not set one universal retention period. Organisations must establish and document periods appropriate to each category and purpose.

13. Cookies and browser storage

Pygar uses browser-storage technologies to authenticate accounts, maintain security and remember settings.

The current technologies include:

Browser storage may remain on a device until it expires or is cleared.

Pygar does not keep your situations, sessions or notes in browser storage. If you use a shared or managed device, sign out when you have finished.

The technologies listed above are strictly necessary to provide the service you ask for and to keep it secure, so they do not need your consent. That is why Pygar does not show a cookie banner.

Pygar’s pages load their fonts from Google Fonts. When your browser fetches them, Google receives your IP address and browser details.

Pygar does not currently use advertising cookies.

Pygar does not currently place optional analytics storage technologies.

If this changes, we will update this policy and the available controls. We will obtain consent before using technologies that require it.

PECR applies to cookies, local storage, session storage and other technologies that store information on or access information from a user’s device.

14. Security

We use technical and organisational measures intended to protect personal information.

These include, where appropriate:

• authenticated access;
• role-based permissions;
• least-privilege controls;
• database row-level security, so that private records can be read only by their owner;
• optional two-step verification for every account, which Pygar can require for organisation owner and admin powers;
• two-step verification for every Pygar operator;
• support access only with your permission, with every view recorded;
• separation of ordinary and administrative credentials;
• encryption in transit;
• provider-managed encryption at rest;
• server-side request validation;
• rate limits and limits on AI use;
• a human check on the sign-in page;
• security headers that restrict what Pygar’s pages can load and stop other sites framing them;
• treating everything you enter as information to analyse, never as instructions, in AI requests;
• activity records that do not contain content;
• secrets management outside the source repository;
• automated testing of database access rules and dependency and security review;
• incident-response procedures; and
• supplier due diligence.

No online service is completely secure.

You are responsible for:

• keeping sign-in details confidential;
• using a secure device;
• protecting any connected email account;
• signing out of shared devices; and
• telling us promptly if you suspect unauthorised access.

Where Pygar acts as processor, we notify the relevant Enterprise controller of a personal-data breach without undue delay.

Where Pygar acts as controller, we assess the risk to affected people and notify the ICO where required. Where a breach is likely to create a high risk to you, we will also tell you without undue delay unless a legal exception applies.

15. Accuracy and limitations of generated information

AI-generated and inferred information may be incomplete, inaccurate or misleading.

You may ask us to correct inaccurate personal information.

For generated briefs, results or other output, correction may involve:

• correcting the underlying factual data;
• recording that you dispute an inference;
• challenging a brief so that it is updated, or retaking the communication colours assessment;
• restricting its future use;
• deleting an output; or
• explaining why the information is an opinion rather than an objective fact.

Pygar does not guarantee that every brief or other generated output is accurate.

Do not rely on Pygar as a substitute for medical, legal, financial, psychological, employment or other regulated professional advice.

16. Self-service controls

Depending on your account and available features, you may be able to:

• edit your name and account details;
• take or retake the communication colours assessment and edit your Card;
• change how far your Card is shared, and see who can see it;
• delete situations, sessions, attached files, documents, people notes and saved openings;
• give and end support access, and see each time support viewed your content;
• manage two-step verification and the devices you are signed in on;
• download a JSON file of your records; and
• ask for your account to be deleted, which happens 30 days later unless you cancel before then.

The JSON file is a convenience export.

It covers every part of the service that holds your records, but leaves out some items, such as invitations you sent, which name other people’s email addresses. Files you uploaded are listed in it and can be downloaded from their situation.

Contact us to exercise your full legal rights.

17. Your data-protection rights

Subject to legal conditions and exemptions, you may have the right to:

Be informed

You have the right to clear information about how your personal information is collected and used.

Obtain access

You may ask whether we process your personal information and request a copy, together with relevant supporting information.

Correct information

You may ask us to correct inaccurate personal information or complete information that is incomplete.

Request erasure

You may ask us to delete personal information where the legal conditions apply.

This right is not absolute. We may retain information where it is needed for legal obligations, legal claims or another lawful reason.

Restrict processing

You may ask us to restrict how information is used in certain circumstances.

Data portability

Where processing is automated and based on consent or contract, you may ask to receive information you provided in a structured, commonly used and machine-readable format. You may also ask us to transmit it to another controller where technically feasible.

Object to processing

You may object to processing based on legitimate interests.

We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

Object to direct marketing

You may object to direct marketing at any time.

We will stop using your information for that purpose.

Withdraw consent

Where we rely on consent, you may withdraw it at any time.

Withdrawal does not affect processing that was lawful before it was withdrawn.

Rights concerning significant automated decisions

Where the law applies to a significant solely automated decision, you may have rights to safeguards such as human intervention, an opportunity to express your view and an opportunity to challenge the decision.

Pygar states in section 7.5 that it does not make these decisions.

How to exercise your rights

Choose “Privacy or data request” on our contact form, or contact the privacy email or postal address at the beginning of this policy.

Please describe:

• the right you want to exercise;
• the account or organisation involved; and
• enough information for us to identify the relevant records.

We may ask for proportionate information to verify your identity.

We normally respond without undue delay and within one month after receiving a valid request and any reasonably required identification.

Where permitted by law:

• we may pause the time limit while awaiting necessary clarification;
• we may extend the period by up to two further months where a request is complex or numerous; and
• we may refuse or charge a reasonable fee for a manifestly unfounded or excessive request.

We will explain any extension, fee or refusal and tell you about your right to complain.

Current ICO guidance states that rights requests normally require a response within one month, with a possible extension for complex or numerous requests.

Enterprise information

For some organisation information, the Enterprise customer is the controller.

You may contact either the Enterprise customer or Pygar.

Pygar may refer the request to, or coordinate with, the relevant Enterprise customer. We will not use the role allocation to obstruct a valid request.

Information another user holds about you

If you think another Pygar user has written about you, for example in a situation or a people note, you may contact us.

Pygar cannot see users’ private content, and the user who wrote it may be responsible for it (section 3.1). We may refer your request to that user or their organisation, and we will help as the law requires.

18. Privacy complaints

You have the right to complain about how we use personal information.

You can submit a complaint by choosing “Privacy or data request” on our contact form, or through the privacy contact details at the beginning of this policy.

Please explain:

• what happened;
• which account or organisation is involved;
• why you believe the processing is wrong; and
• what outcome you are seeking.

We will:

• provide an accessible way to complain;
• acknowledge the complaint within 30 days;
• take appropriate steps to investigate;
• keep you appropriately informed; and
• tell you the outcome without undue delay.

These complaint-handling duties have applied to organisations since 19 June 2026.

You may also complain to the UK’s data-protection regulator, the Information Commission, which continues to use the name ICO.

You may complain to the ICO without contacting us first, although we welcome the opportunity to investigate and resolve your concern.

19. Marketing and service communications

Service communications

We may send messages needed to provide, administer or protect your account, including:

• sign-in messages, such as account confirmations and password resets;
• security alerts;
• billing notices, once paid plans are on sale;
• notices about deleting your account, when you ask, 5 days before and once it is done;
• privacy or terms updates;
• service interruption notices; and
• material feature-change notices.

These are service messages rather than direct marketing.

Pygar does not send organisation invitations by email. The owner or admin who invites you sends you the link.

Optional marketing

Pygar does not currently send marketing messages. If we start, we will send electronic marketing only where permitted by law.

We may rely on:

• your consent; or
• the existing-customer soft opt-in where we obtained your details directly, are promoting similar services and offered an opt-out when collecting the details and in every message.

You can unsubscribe through the message or change the relevant preference.

Opting out of marketing does not stop necessary service communications.

Sending us a message allows us to respond to it. It does not, by itself, authorise unrelated marketing.

The soft opt-in is limited and requires a clear opportunity to opt out when details are collected and in later marketing messages.

20. Children

Pygar is intended only for adults aged 18 or over.

Our Terms of Service require users to be 18 or over. When someone creates an account, we ask for their date of birth and do not let anyone under 18 continue. We also assess whether the service is likely to be accessed by children.

If we learn that a person under 18 has created an account, we may:

• suspend access;
• request proportionate evidence of age;
• delete the account and associated information; and
• retain a minimal record where needed to prevent repeated access or meet a legal obligation.

Parents, guardians or other people may contact us if they believe a child has provided personal information.

The ICO’s Children’s Code can apply to an online service likely to be accessed by children even where children are not the intended audience.

21. Information about other people

Pygar is designed for preparing conversations, meetings and decisions that involve other people, so your situations, sessions, people notes and documents will often mention them.

Do not submit personal information about another person unless:

• it is necessary;
• you have a lawful reason;
• you have any required authority; and
• you can fairly provide the information for the stated purpose.

Use initials, a role or a short label instead of a name where you can, and include only what the preparation needs.

People notes are for planning your own communication. What you record about someone’s communication colours or style is your private hypothesis, not a fact about them. It must not be used as evidence about their ability, conduct or suitability, and it never changes their own Communication Card.

If you use Pygar for work, your employer’s policies may apply to what you record. Depending on your circumstances, you may be responsible for that information under data-protection law, including if the person asks to see it.

Do not submit confidential employer, customer, patient, client, legal or commercially sensitive information unless you are authorised and Pygar is an appropriate approved service for that use.

22. Third-party links

Pygar may link to third-party websites or services.

Those operators control their own processing. Their privacy policies and terms apply when you use their services.

Pygar is not responsible for the privacy practices of an unrelated third party.

23. Changes to this policy

We may update this policy to reflect changes in:

• the service;
• the law;
• our suppliers;
• our security arrangements;
• our processing purposes; or
• our organisational structure.

We will publish the current version and its date.

Where a change materially affects how existing personal information is used, we will provide a prominent notice or contact affected users where appropriate.

We will not rely only on a revised privacy policy to make an incompatible new use of information already collected. We will identify an appropriate lawful basis and provide any additional choice or notice required by law.

24. Contact us

For privacy questions, rights requests or complaints, choose “Privacy or data request” on our contact form or use the details below.

Where your question concerns an Enterprise customer’s use of Pygar, you may also contact that organisation using the privacy details in its workplace or customer privacy notice.