Privacy notice

Flect is a reflective-practice pilot operated by Clariflect Ltd (in the process of incorporation), the data controller for your information. You can reach us at clariflect@protonmail.com. Our ICO registration is in progress.

Your account details: your email address and, if you give it, your name.

What you choose to tell us about yourself at sign-up: your professional role, and anything else you'd like to share about your life or situation. Both are optional, and used only to help Clari's facilitation feel relevant to you.

Optional demographic details, only if you choose to give them (in Settings): your gender, your age band, and — behind a separate, explicit opt-in, because it is sensitive (“special-category”) information — your ethnicity. These are self-reported, never required, and you can change or remove them at any time. We keep them as part of our research into how Flect is used, so we can understand how well it works for different groups of people and make it more valuable for everyone who uses it — looked at only in aggregate, with small groups hidden so no one can be singled out. None of this ever informs how Clari works with you: it is kept separate from your reflections, and your ethnicity is stored encrypted at rest, the same way your reflections are.

Your reflections — the conversations you have with Clari, and the short summaries generated when a reflection completes. If you use voice input (optional), your browser or phone turns your speech into text. Depending on your browser, its maker's speech service may do that part (for example, Google's in Chrome), under that company's own terms rather than ours. Flect receives only the text, never an audio recording.

Safety flags: where the safety system identifies a possible risk, we store the category, severity and a brief reason (metadata), linked to the message — not a separate copy of your words.

Operational metadata: anonymous usage and cost figures (such as token counts), and limited security logs (such as an IP address, held briefly), used to run and protect the service. We do not analyse the content of your reflections for anything beyond the safety and quality systems described here.

Research metadata — only if you opt into research (the Research Commons choice or higher): the date, local time and approximate location (a coarse area derived from your internet address, not precise GPS) at the start and end of each reflection. This is described under “Research use” below; it is never used by Clari during your reflection.

If you choose to connect your Google Calendar (optional, read-only to begin with): the titles, dates and times of your upcoming events, so they appear in Flect for you to prepare for. To help Flect judge which events genuinely warrant a gentle preparation or reflection invitation — rather than treating every meeting alike — we also read the event's location, whether it recurs, whether it has notes or attached documents (never their contents, only whether they exist), and the names and email addresses of other attendees. Attendee identity is used only to match association rules you set yourself (for example, "always invite me to prepare for meetings with a particular person") and is encrypted at rest. We never read event descriptions or attachment contents. You can disconnect at any time — which also removes the events we synced.

Separately, and only if you agree to each one when Flect offers it, you can let Flect do three small things for you in Google: add an event to your calendar, add an item to your Google Tasks, or save a draft email in your Gmail. Each is its own optional permission, and you can withdraw any of them at any time in your Google account. Flect only ever creates things: it is built with no ability to read your existing tasks or emails, or to send email for you. To be plain about it, the permission Google asks you to grant is broader than what Flect does with it, so we rely on how Flect is built, not only on the permission. A draft email is saved addressed to nobody, for you to read, change and send yourself; Flect never chooses who a draft goes to.

Short safety codes, if the safety system notices something that may affect your wellbeing: see “Noticing things that may affect your safety” below. They are never your words.

If you turn on notifications on your device (optional): the technical address your browser gives us so we can send them. These can carry the same content as our emails — for example, an event title — and are delivered through your browser's own push service, such as those run by Google, Apple or Mozilla. They never contain your reflections.

Your consent choices, with timestamps.

We use your reflections to provide the facilitation itself. The AI facilitation is provided through Anthropic, acting as our processor; your messages are sent to Anthropic's API to generate Clari's responses, and are not used to train their models.

After a reflection, a short summary — its topic, the situation, and where your thinking landed, with no name, email or account identifier attached — is sent to Mistral AI to create a numeric “embedding”. This is what lets Flect gently notice when two reflections are connected in meaning (the feature you'll see as Echo). Mistral AI is an EU company acting as our sub-processor.

Finding support near you: if you're talking about something difficult and Clari offers to look for a specialist service near you, you can tell it roughly where you are; a town is enough. Only if you do, Flect sends a short web search containing the kind of service and the place you named (never your own words) to Anthropic, our AI provider, which runs the search using its search partner and returns the results, handled under the same Anthropic data terms as the rest of your conversation. Results come only from trusted directories, such as the NHS, councils and national charities. The place you name is not stored anywhere new: it stays only in your own message in that conversation, encrypted like the rest. You never have to share a location, and the national helplines are always offered either way.

We use an automated safety system to help keep people safe. When it flags something, we keep only the category, how serious it seems and a brief reason, never your words, and Clari responds to you with care and points you to support. Nobody at Clariflect reads your reflections to do this.

If you connect your Google Calendar, Google acts as our sub-processor for that access. Event titles, dates, times and the other calendar details described above are stored in our EU/UK database; attendee names and email addresses are encrypted at rest, the same way your reflections are. If you agree to Flect adding an event, a task or an email draft, only that event, task or draft is sent to Google, at the moment you agree. Your reflections are never sent to Google.

If something goes wrong on our end — a technical fault, a failed request — a description of that fault is sent to Sentry, our error-monitoring sub-processor, along with a random-looking account identifier so we can see it's affecting your account without seeing who you are. Sentry never receives your reflections or their content, and we do not record what you did on screen (no session replay).

When we email you — an invitation to reflect, a reminder about something you've added to your calendar, or a note about a feature — it's delivered through Resend, our email-delivery sub-processor, from EU sending infrastructure. Resend receives your email address and the content of that particular email, which may include your first name and details like an event title or date, but never your reflections or any other email's content. These emails are opt-in, and every one includes a one-tap link to turn them off.

We also keep an encrypted backup copy of our database with Infomaniak, an independent Swiss company acting as our sub-processor, so that a serious problem with our primary hosting can't mean losing your data entirely. Switzerland is recognised by the UK and EU as offering an equivalent standard of data protection. Infomaniak only ever receives the backup in its already-encrypted form — the same protection described under “How we protect your reflections” below — so it cannot read your reflections or anything else in it.

If you contact us for help, our support chat and inbox run on Crisp, our customer-support sub-processor (an EU company, EU-hosted). Crisp receives what you send us in a support message and a minimal identifier so we can reply; it is kept separate from your reflections, and your reflections are never sent to it.

During the beta we also invite you to take part in a short research survey or two, to help us improve Flect. Those surveys are run separately from the app, on Tally — an EU-owned, EU-hosted form provider acting as our sub-processor — and are operated on our behalf by Publicus Ltd as our processor, with Clariflect Ltd as the controller. Survey responses are linked to your Flect activity only by a random code that means nothing to Tally and identifies no one; taking part is optional and separate from using Flect, and your reflections themselves are never sent to the survey tool.

Problem reports: if you report a problem, for example that Clari got something wrong, real people at Clariflect may read everything you add to the report: what you write, any exchange you tick to include, and any file you attach. The form tells you this before you add anything, so only add what you are comfortable with us seeing. We use it to look into the problem. For an exchange you include, we rely on your consent (the tickbox); for the rest, you are choosing to write to us.

Checking images attached to problem reports: when you attach an image to a problem report, Flect checks it against a database of images that child-protection analysts have already identified as child sexual abuse material. Our own server works out a short numerical fingerprint of the image (a “hash”), and only that fingerprint is sent, to the organisation named in the next paragraph. The image itself, your name, your email address and your account identifier are never sent. The check can only recognise material that has already been identified, so it cannot find anything new, and “no match” does not mean a file is safe. Documents and videos are not checked yet. We do this because we are responsible for what is uploaded to our service, and because the people who read reports should not have to meet this material. The check itself never takes any action against your account. If it finds a possible match, we do not delete the file: we stop it being opened and keep it securely, and we may have to pass it to the police or another authority, which the law may mean we cannot tell you about. A possible match is only that, and is not treated as proof of anything.

Clariflect Ltd accesses Shield by Project Arachnid (projectarachnid.ca), a program of the Canadian Centre for Child Protection Inc., to facilitate the detection and removal of child sexual abuse material and harmful-abusive material of children and survivors of child sexual abuse on its services. That organisation is in Canada, so the fingerprint leaves the UK; we send it only under the data-protection terms that cover transfers from the UK.

We do not use third-party advertising or analytics trackers, and we do not sell your data.

We rely on your consent to take part in the pilot, and on our legitimate interests in keeping the service and its users safe and secure. That includes checking images attached to problem reports against known child sexual abuse material, and the short safety codes described under “Noticing things that may affect your safety”, which we keep for your own protection, and which you can switch off. Any use of your reflections for research, and the automated check on Clari's replies, relies on your separate, optional consent.

Any optional demographic details you give us rely on your consent, taken separately from everything else. For ethnicity, which is special-category data, we rely on your explicit consent (UK GDPR Article 9), asked for on its own — you can give the other details without it, or give none at all, and the service works exactly the same.

If you describe being hurt, controlled, frightened or followed by someone, or being treated unfairly because of things like disability, race or sex, Flect may note this as a short code, never your words, so that Clari can gently mention it in a later conversation that you start.

How it works: when a reflection is completed, an automated check (run by Anthropic, as for the rest of your reflection) looks for these situations. If it finds any, we keep only a code from a fixed list: the kind of situation, the kind of relationship involved (for example, a partner or an employer), and the date of the reflection. We keep no text, no names and no quotes. The codes are encrypted in the same way as your reflections.

What Clari may do with it: if, in a conversation you have started, you are talking about that part of your life, Clari may say, in your own words, what it has noticed, and ask how that sits with you. It does this at most once for a given pattern, unless things later seem to be getting more serious. It stops straight away if you don't want to talk about it. It will not tell you what to do about the other person, call anyone's behaviour abuse, discrimination or a crime, or count anything aloud. It may mention where to find free support or advice.

Who sees it: only you, and Clari in the way described above. Nobody else is told, and nothing is sent to you outside a conversation you are having. Our team has no screen that shows these codes. They are left out of your normal data export; instead, you can download them separately from Settings, after confirming your password. The codes are deleted when you delete the reflection they came from, and when you delete your account. We do not currently use them for research.

This is on unless you turn it off, and you can do that at any time in Settings. If you share a device or an account with someone you're worried about, that is a good reason to look at that setting and to use a password only you know.

Flect is built for adults: you need to be 18 or over to have an account, and you confirm that when you sign up. We don't check it with identity documents, because we'd rather not collect more about you than we need to. The protections described in this notice are the same for everyone: your reflections are private to you and encrypted; we don't build a profile of you, we don't show you adverts, and we don't sell your information. We don't use streaks, points, guilt, or reminders designed to keep you coming back.

If you're under 18 and tell us so when signing up, we can't give you a Flect account. If you're 13 to 17 you can leave your email address and your age to be told when Flect Teen, a version for younger people that is being developed, is ready. We keep only those two things, we use them only to tell you about Flect Teen, and we delete them by your 18th birthday at the latest. They aren't attached to any account; the one exception is that if someone later signs in to Flect with that email address, we ask them to confirm they're 18 or over, and delete the record when they do. If you're under 13, we don't keep your details at all. If you're ever overwhelmed, Childline is free on 0800 1111, any time.

If you're a parent or guardian with questions, or you think a young person has made an account, please get in touch at clariflect@protonmail.com.

Why we do this. Flect follows the EU AI Act's transparency rules (Article 50). They say people must be told when they are dealing with an AI, and that text an AI generates must be marked so it can be recognised as such. We think that is right, and we apply it to everyone who uses Flect. If you share a Flect file with an employer, an assessor or a regulator, they are entitled to know which parts an AI wrote, and you should never be put in the position of passing off Clari's writing as your own without realising. That is also why every reply from Clari is captioned “Clari (AI)”.

Clari is an AI, built on Claude, a language model made by Anthropic. Because it writes some of what you see, Flect marks it. Files Flect makes for you, such as exports, prep sheets and CPD portfolios, show which parts Clari wrote, with labels that survive printing and marks that software can read. Each file also carries a signed record. The record holds no personal data: it says what kind of document it is, when it was made, and a fingerprint of the file, never who you are or what you wrote.

Anyone a Flect file reaches can check it on our “Check a Flect file” page. That page works out the file's fingerprint in the visitor's own browser and sends us only the record and the fingerprint, never the file. Beyond the ordinary technical logs described above, we store and log nothing from a check. Separately, Anthropic marks the words themselves as its model writes them, in a way that people can't see.

When you recognise or reword something Clari drafted for you in “Your development so far”, we record whether the final wording is Clari's, written jointly, or yours, along with a number for what share of Clari's original words remain. It is kept with that item, used only to label your pages and portfolios honestly, never used by Clari in a conversation, and deleted with your account. For the marks and this record we rely on our legitimate interests: files that tell the truth about who wrote them serve you, and the people you send them to, as well as us.

To make sure Clari keeps to its own safety and honesty rules, and that changes we make to it don't make it worse, an automated check reads a small sample of recently finished conversations. This is a check on Clari, not on you: nothing about you is scored, nothing from it is shown to you, and it doesn't change how Clari treats you.

It only ever happens if you have chosen Research Commons or Active study participation in Settings, and made or confirmed that choice after this wording was added. If you chose earlier, you need to confirm your choice again first. If you choose Standard or Maximum privacy at any time, you are left out from then on. Conversations in Private mode are never included.

How it works: an AI model reads the conversation in the moment (Anthropic, who already process your conversations as described above, on the same terms) and scores Clari's replies against our written guidelines. The conversation isn't copied or saved anywhere new. We keep only totals, counted by guideline, by AI model and by month, with no names, account identifiers or words of yours in them. No person at Clariflect reads the conversation. Our lawful basis is your consent, and you can withdraw it at any time.

Some of what Flect does is there because the law asks for it, and some because we think it is right. Here is which is which.

Telling you Clari is an AI, and marking its writing: Flect follows the EU AI Act's transparency rules (see “Clari's writing, and how it is marked”).

Keeping a dated record of each consent choice: UK data protection law says we must be able to show that you agreed to what you agreed to. That is why Flect adds a new record each time you change a choice, rather than overwriting the old one.

Letting you see, export, correct and delete what we hold: UK data protection law gives you these rights. Wherever we can, we have built them as tools in Settings rather than leaving them to a request.

Adults only: the Information Commissioner's Children's Code applies to online services that children are likely to use. Flect is built for adults, and we apply the Code's thinking to everyone: no streaks, no profiling for adverts, and high privacy by default.

The situations the safety codes look for are ones UK law itself names: coercive control (Serious Crime Act 2015), stalking and harassment (Protection from Harassment Act 1997) and discrimination (Equality Act 2010). We use the law to decide which harms to pay attention to, never to decide whether anyone has broken it, and no one else is told.

Your account and reflections are stored in a database hosted by Supabase in the EU/UK region, and the Flect app itself runs on Vercel, in London. Both act as our processors. By default, the key that protects your reflections is held in a separate system from that database (see “How we protect your reflections”). Facilitation is processed by Anthropic. We use providers that offer appropriate safeguards for any processing.

An encrypted backup copy is also held with Infomaniak in Switzerland, recognised by the UK and EU as offering an equivalent standard of protection.

Reflection content is among the most sensitive information we hold, and we've designed our security around that. Your reflections are encrypted both in transit and at rest.

Each person's reflections are encrypted with a key unique to them, and the master key that protects those keys is kept in a different system from the database. This means that a copy of the database alone — even a complete one — cannot be used to read anyone's reflections. This design is a deliberate response to breaches such as the 2020 Vastaamo case in Finland, where a stolen psychotherapy database was used to extort the individuals in it.

By default, we can restore access to your account if you forget your password, because a second copy of your key is held under a master key kept apart from the database. If you want the strongest privacy Flect offers, you can choose Private mode in Settings. In Private mode, your personal reflections are encrypted so that only you can open them: we hold no copy of the key that would let us, so not even we can read them. The trade-off is real. You are given a recovery kit once, and if you lose both your password and your kit (and any passkey you've set up to unlock), your reflections are gone for good, and nobody, including us, can get them back. Files you upload are not covered by Private mode; they stay protected by your account as they are now. While you are signed out, a few background features pause, such as calendar sync and reminders that name your events. Private mode can't yet be combined with Flect Together.

Because Clari is an AI that responds to what you write, your words are decrypted within our systems only at the moment they are processed to generate a reply, or when you yourself view or export them. Our team does not read your reflections, and we have built no screen in Flect that would let them. In the default mode the system holds a recovery key, so this is a commitment as well as a design; in Private mode it is also technically impossible. The only things we do read are those you choose to send us: a problem report, including any exchange you tick to include and any file you attach, or a support message.

To generate that reply, your decrypted words pass to Anthropic's systems transiently, in the clear — this is inherent to how any AI language processing works, and is true whichever provider generates the reply. The short, de-identified summary sent to Mistral AI to create an embedding is handled the same way. Once that moment of processing is complete, Flect itself keeps no separate readable copy: what our systems store afterwards is the encrypted version only.

We monitor for, rate-limit, and alert on unusual bulk access to data — the single large extraction that characterised the Vastaamo breach. You can also turn on two-step verification (using an authenticator app) in Settings for extra protection of your own account. We intend to commission an independent security review before moving beyond the pilot.

Beyond what's needed to run the service, you choose how your data may be used, and can change this at any time in Settings:

Maximum privacy — only what's necessary to provide the service.

Standard (the default) — anonymous, aggregated patterns help us improve Flect; nothing that could identify you leaves our systems.

Research Commons — you're giving advance consent for your de-identified reflections to be available to approved researchers studying professional learning, when we launch our research programme. No reflections are shared with external researchers yet. This choice also lets an automated check score a sample of your finished conversations for how well Clari keeps to its own rules (see “Checking that Clari works as it should”).

Study participation — everything in Research Commons, and you're open to being invited to specific, ethics-approved studies when the programme launches; you would consent to each one separately before any use of your data.

Your account, reflections, summaries, safety codes and the other things you've created in Flect are kept for as long as your account exists. When you delete your account, they are deleted straight away, and the keys that protect them are deleted with them.

Backups: the database has an encrypted backup held by our database host for 14 days, and an encrypted copy with Infomaniak for 90 days. Anything you delete drops out of these as they expire.

Beta research: if you take part in the beta surveys or interviews, your responses are linked to your Flect account only by a random code. We keep that link for twelve months after the beta programme ends, and then delete it; the beta is planned to end in December 2027, so the link would be deleted by the end of December 2028, and we'll tell you if those dates change. Until the link is deleted, if you delete your account we also remove your survey responses from the survey tool. Once the link has been deleted, we can no longer connect your responses to you, so we won't be able to find and remove them if you ask later. We keep them in that de-identified form with no fixed end date, so that what we learn from the beta isn't lost.

Support messages are kept while we're helping you and deleted if you ask. Error reports sent to Sentry are kept for 30 days.

Problem reports and their attachments are kept as long as your account exists, and are deleted with it. Alongside each attached file we keep one line recording whether the image check ran and, if it did, whether it found nothing known or a possible match. The fingerprints sent for the check are not kept by us.

The email address and age on the Flect Teen waiting list are kept until your 18th birthday at the latest, as described above.

Your reflections are private to you by default. You can export all of your data at any time, as both a complete file and a readable copy, from Settings.

You can delete your account at any time from Settings. This permanently and irreversibly deletes your account and every reflection, message, summary, note and rating you own.

You also have the right to access, correct, restrict or object to processing, to data portability, and to withdraw consent. To exercise any of these, use Settings or contact us. You can complain to the ICO if you're unhappy with how we handle your data.

If — and only if — you opt in (the Research Commons choice, or higher, in Settings), your de-identified reflections may be used in research into how professionals learn from experience. You can withdraw at any time in Settings, and any publications would refer to contributors collectively, never to you individually.

Our research programme is in development. Choosing Research Commons or Study participation now records your support for this future use — no reflections are currently shared with external researchers. When the programme is ready to launch, we will let you know, and you will have the opportunity to confirm or withdraw your consent before any sharing takes place.

If you opt in, this research use also includes limited metadata about when and where reflection happens — the date, local time and approximate location at the start and end of each reflection — to study the spatial and temporal patterns of reflective practice. The location is a coarse area derived from your internet address (not precise GPS, and no permission prompt), held encrypted in the same way as your reflections, and would only ever reach researchers in a further coarsened, de-identified form that cannot pinpoint you. This metadata is never seen by Clari during your reflection. No reflection content is shared with external researchers until the programme launches and you have confirmed your choice.

This is a pilot and this notice will be finalised before wider use. We'll tell you about material changes.