Privacy Policy

Sophyra Next is a registered business name of Sophyra Limited, a company registered in Ireland (company number 817595, business name number 787485), with its registered office at 1st Floor, Penrose 2, Penrose Dock, Cork, T23 YY09, Ireland. For the purposes of data protection law, Sophyra Limited is the data controller for personal data collected through sophyranext.com.

You can contact us about data protection matters at: privacy@sophyra.ie

We collect the following categories of personal data:

• Account data: first name, email address, and hashed password when you register for an account.
• Profile and preference data: study preferences, destination choices, and affordability inputs you enter into the platform.
• Assessment data: responses to the RIASEC strengths assessment, if you choose to save your results.
• Checklist and roadmap data: your application task progress and deadline inputs.
• Document content: text you submit through the Document Feedback feature (personal statements, CVs) for AI-assisted review.
• Payment data: whether you have Pro access and when it ends. We do not store card numbers or payment credentials directly - these are handled by Stripe.
• Usage data: page views, feature interactions, and technical data (IP address, browser type, device type) collected through analytics tools.
• Cookie data: as described in the Cookies section below and in our Cookie Policy.

We process your personal data on the following legal bases under the GDPR:

• Contract performance (Article 6(1)(b)): processing necessary to provide the Sophyra Next service to registered users, including account management, payment and access management, and platform features.
• Legitimate interests (Article 6(1)(f)): analytics and platform improvement, security monitoring, fraud prevention, and confirming to CV by Sophyra that a member's Pro includes CV Pro, so members do not have to ask for it.
• Consent (Article 6(1)(a)): for RIASEC assessment results that you explicitly choose to save, and for any optional marketing communications. You may withdraw consent at any time.

We use your personal data to:

• Create and manage your account
• Provide the platform features you access
• Process your payment for Pro via Stripe
• Send transactional emails (account confirmation, password reset)
• Improve and develop the platform based on usage patterns
• Maintain the security of the platform
• Comply with legal obligations

If you also use CV by Sophyra, another Sophyra Limited service, we use your Sophyra Next membership to include CV Pro there and, only if you ask, your saved strengths result to help shape your CV profile.

The Document Feedback feature uses the Anthropic Claude API to provide feedback on personal statements and CVs you submit. When you use this feature:

• The text you submit is sent through Anthropic's API to Anthropic Ireland, Limited, which acts as our processor; it may be processed in the United States by Anthropic, PBC under standard contractual clauses.
• Anthropic processes the content under its Commercial Terms and Data Processing Addendum to generate the feedback. Anthropic does not use it to train its models and deletes it within 30 days, unless it is flagged as breaching Anthropic's usage policy or the law requires Anthropic to keep it for longer.
• Anthropic's privacy policy is available at anthropic.com/privacy.
• We do not use the content of your documents to train AI models.

The legal basis for this processing is your consent, given when you submit content through the feature. You may choose not to use the Document Feedback feature at any time.

The AI Guide also uses the Anthropic Claude API. When you generate a shortlist, the answers you give to the shortlist questions are sent to Anthropic: your field of study, subjects, qualification and grades, budget and whether you expect a grant, scholarship or family support, whether you want to study at home or abroad, home country and preferred countries, whether you hold citizenship of an EU or EEA country or Switzerland, whether this will be your first bachelor's degree, and, where you entered them, your intended start year, what matters most to you and the application deadline you are planning around. Your saved strengths code is included only if you choose to use it. We do not add your name or email address. Anthropic handles this content on the same terms as Document Feedback: it is not used to train models and is deleted within 30 days, subject to the same exceptions.

We share data with the following third-party sub-processors. Where data is transferred outside the EEA, appropriate safeguards (Standard Contractual Clauses) are in place.

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (for example, financial records relating to payments).

Assessment answers and results from tools used without an account remain temporarily in the current browser tab. Saving your RIASEC results to an account requires active Pro access and your explicit consent. Results you choose to save are retained until you delete them or delete your account. Usage analytics data is retained in aggregated, anonymised form.

The cost planner and personal statement tool also offer an optional copy stored in your browser on your device. This copy is saved only when you select Save on this device or Update saved copy. It does not sync between devices. You can restore it or delete it in the relevant tool, or clear it using your browser’s site-data controls. Signing out does not delete this local copy; avoid saving it on a shared device.

Under the GDPR, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to correct inaccurate personal data.
• Right to erasure: to request deletion of your personal data in certain circumstances.
• Right to restriction: to request that we restrict processing of your data in certain circumstances.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, to withdraw it at any time.

To exercise any of these rights, contact us at privacy@sophyra.ie. We will respond within 30 days.

We use the following types of cookies:

• Essential cookies: required for authentication and session management. These cannot be disabled without breaking the service.
• Analytics cookies: we do not currently use any cookie-based analytics tool. The analytics consent category exists so that if we ever introduce one, it would load only with your opt-in (analytics cookies are off by default), and you could withdraw consent at any time via the cookie preferences button.
• Cookieless analytics: we also use Vercel Web Analytics, a cookieless service that counts visits in anonymised, aggregated form. It stores no IP addresses and no personal identifiers. You can switch it off at any time in our cookie preferences panel.
• Advertising cookies: if you opt in to advertising cookies in our cookie preferences panel, we use the Meta Pixel to measure whether our advertising on Instagram and Facebook leads to visits and account creations, and to improve how those adverts are delivered. Meta Platforms Ireland Limited acts as a joint controller for this data. The pixel is never loaded unless you opt in, and you can withdraw consent at any time in the cookie preferences panel, after which it stops sending data immediately.

Advertising measurement: if you accept advertising cookies and arrive from one of our adverts in ChatGPT, we tell OpenAI, which runs ChatGPT's advertising, when you start our signup form. We send the advert reference OpenAI added to the link, the name of the event and the time. We do not send your name, email address, anything you type into the form, or your IP address. The advert reference is kept in your browser for the current session only. You can withdraw consent at any time in the cookie preferences panel, and we stop straight away. OpenAI handles this information as an independent controller under its Conversion Terms, except for limited processing it carries out for us as our processor. For visitors in the European Economic Area it is handled by OpenAI Ireland Limited, which uses a valid transfer mechanism for any onward transfer outside the EEA; for visitors in the UK it is handled by OpenAI OpCo, LLC under the UK standard contractual clauses.

We never share the contents of your account, your assessments or your documents with advertising platforms.

We take the security of your personal data seriously. We use industry-standard encryption for data in transit (TLS) and at rest. Authentication is handled through Supabase, which provides secure session management and password hashing. Payments are handled entirely by Stripe; we do not handle or store payment card data.

No system can guarantee absolute security. If you become aware of any security issue, please contact us immediately at privacy@sophyra.ie.

Sophyra Next accounts are for students aged 16 and over. Sixteen is the age of digital consent in Ireland, where Sophyra Limited is established, so we do not create accounts for anyone under 16 and we do not knowingly collect their personal data. If you believe we hold data about someone under 16, please contact us immediately and we will delete the account and its data.

The same rule applies wherever we take an email address without an account, which is the case for the guide and assessment report emails and for the Transition waitlist. Each of those asks you to confirm you are 16 or over before you submit, and we record that confirmation.

Creating your Pro account and paying for access are separate steps. To buy Pro you must be 18 or over, or aged 16 or 17 with the consent of a parent or guardian. We ask you to confirm which applies at checkout. Where a parent or guardian consents, we record their email address and use it once, after Pro access starts, to tell them it exists and how to contact us. We do not use that address for marketing.

If you have a complaint about how we handle your personal data, you have the right to lodge a complaint with a supervisory authority. In Ireland, this is the Data Protection Commission (dataprotection.ie). You may also contact the supervisory authority in your country of residence.

This site displays the exali liability seal, which confirms that Sophyra Limited holds professional indemnity insurance. The seal graphic is loaded from servers operated by exali AG. Because of the technical design of the internet, your IP address is transmitted to exali AG so that the graphic can be delivered to your browser. If you click the seal you leave this site and are taken to exali AG’s servers.

The legal basis is Article 6(1)(f) of the General Data Protection Regulation, legitimate interest. Our legitimate interest is in allowing visitors to verify independently that we hold professional indemnity cover. exali AG is established in Germany, within the European Economic Area, so no transfer outside the European Economic Area arises. Further information is in exali AG’s privacy notice.

We may update this privacy policy from time to time. We will notify registered users of material changes by email or through a notice within the platform. The date at the top of this page reflects when the policy was last updated.