Privacy Policy

Sophyra Next is a registered business name of Sophyra Limited, a company registered in Ireland (company number 817595, business name number 787485), with its registered office at 1st Floor, Penrose 2, Penrose Dock, Cork, T23 YY09, Ireland. For the purposes of data protection law, Sophyra Limited is the data controller for personal data collected through sophyranext.com.

You can contact us about data protection matters at: [email protected]

We collect the following categories of personal data:

• Account data: first name, email address, and hashed password when you register for an account.
• Profile and preference data: study preferences, destination choices, and affordability inputs you enter into the platform.
• Assessment data: responses to the RIASEC strengths assessment, if you choose to save your results.
• Checklist and roadmap data: your application task progress and deadline inputs.
• Document content: text you submit through the Document Feedback feature (personal statements, CVs) for AI-assisted review.
• Payment data: subscription status. We do not store card numbers or payment credentials directly - these are handled by Stripe.
• Usage data: page views, feature interactions, and technical data (IP address, browser type, device type) collected through analytics tools.
• Cookie data: as described in our Cookie Policy below.

We process your personal data on the following legal bases under the GDPR:

• Contract performance (Article 6(1)(b)): processing necessary to provide the Sophyra Next service to registered users, including account management, subscription management, and platform features.
• Legitimate interests (Article 6(1)(f)): analytics and platform improvement, security monitoring, and fraud prevention.
• Consent (Article 6(1)(a)): for RIASEC assessment results that you explicitly choose to save, and for any optional marketing communications. You may withdraw consent at any time.

We use your personal data to:

• Create and manage your account
• Provide the platform features you access
• Process your subscription payments via Stripe
• Send transactional emails (account confirmation, password reset)
• Improve and develop the platform based on usage patterns
• Maintain the security of the platform
• Comply with legal obligations

The Document Feedback feature uses the Anthropic Claude API to provide feedback on personal statements and CVs you submit. When you use this feature:

• The text you submit is sent to Anthropic PBC (USA) for processing via their API.
• Anthropic processes the content to generate feedback and does not retain it beyond the immediate API request.
• Anthropic's privacy policy is available at anthropic.com/privacy.
• We do not use the content of your documents to train AI models.

The legal basis for this processing is your consent, given when you submit content through the feature. You may choose not to use the Document Feedback feature at any time.

We share data with the following third-party sub-processors. Where data is transferred outside the EEA, appropriate safeguards (Standard Contractual Clauses) are in place.

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (for example, financial records relating to payments).

RIASEC assessment results you choose to save are retained until you delete them or delete your account. Usage analytics data is retained in aggregated, anonymised form.

Under the GDPR, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to correct inaccurate personal data.
• Right to erasure: to request deletion of your personal data in certain circumstances.
• Right to restriction: to request that we restrict processing of your data in certain circumstances.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, to withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

We use the following types of cookies:

• Essential cookies: required for authentication and session management. These cannot be disabled without breaking the service.
• Analytics cookies: we use Google Analytics 4 (GA4) to understand how the platform is used. GA4 data is anonymised and aggregated. You can opt out via your browser settings or by using the Google Analytics opt-out browser add-on.

We do not use advertising cookies or share cookie data with third parties for marketing purposes.

We take the security of your personal data seriously. We use industry-standard encryption for data in transit (TLS) and at rest. Authentication is handled through Supabase, which provides secure session management and password hashing. Payments are handled entirely by Stripe; we do not handle or store payment card data.

No system can guarantee absolute security. If you become aware of any security issue, please contact us immediately at [email protected].

Sophyra Next is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected data from a child under 16, please contact us immediately and we will delete it.

If you have a complaint about how we handle your personal data, you have the right to lodge a complaint with a supervisory authority. In Ireland, this is the Data Protection Commission (dataprotection.ie). You may also contact the supervisory authority in your country of residence.

We may update this privacy policy from time to time. We will notify registered users of material changes by email or through a notice within the platform. The date at the top of this page reflects when the policy was last updated.