Privacy notice
Draft for specialist review. This is a plain-English first draft written by the people building Cyfer. It has not been reviewed by a data-protection specialist. Sections marked as being finalised will be completed before real people’s data is used.
Who is responsible
Cyfer is run by Align-Empower. Contact: info@align-empower.com. The person or organisation that sets up a review decides why it is being done and who takes part. This section is being finalised with a data-protection specialist before any live review opens.
What Cyfer holds
| Data | Who gives it | Why |
|---|---|---|
| Leader’s name and role | Person setting up the review | To label the review and the report |
| Leader’s answers: personality, motives, pressure tendencies, self-ratings | The leader | To produce their report |
| Team ratings and optional written comments | Team members | To produce the team view. Stored without names, links or times. |
| Private links and the team link (stored scrambled) | Generated by Cyfer | To let each person reach only their own page |
| Review settings: number of team members invited, whether each private link has been used, whether the report and comments are shared with the leader, and the delete date | Person setting up the review, and Cyfer | To run the review, stop a link being used twice, and delete everything on time |
Cyfer does not ask for email addresses and does not send emails or messages. It sets no cookies and uses no analytics or advertising tools. Cyfer does not make automated decisions about anyone.
Who sees what
- The person who set up the review sees the leader’s answers, the team averages and the written comments.
- The leader sees their report only after the person who set up the review shares it. They see comments only if that person also shares those.
- Team members are not shown results.
- Cyfer’s pages and reports show nobody which team member gave which answer, within the limits set out below. Averages appear only once at least three have replied, and no single statement shows with fewer than three answers. A comment question shows only if at least three people wrote a comment on it.
Written comments can identify their author through their content. Team members are asked not to include identifying details, and the person reading them is asked not to try to work out who wrote them.
The limits of anonymity
- Each team member gets their own private link from the team link. The organiser never sees those private links, so cannot tell from them who has replied.
- Whoever hands out the team link knows who was invited, and could use it to take a place and add replies of their own. Cyfer can’t stop this. Choose an organiser the team trusts, and never the leader. Whoever sets up a review must confirm that they are not the leader being reviewed.
- With few replies, averages reveal more. With exactly three replies, if everyone gives the same score then everyone’s view is visible. Invite five or more if you can. Three is the minimum for results. Reports with fewer than five replies say so.
- Results are fixed when collection is closed, so later replies cannot be used to work out an individual’s answers.
- Comments can identify people through their content, which is why they are shown only in groups of three or more per question, shuffled, and not shared with the leader unless the organiser chooses.
Lawful basis
This section is being finalised with a data-protection specialist before any live review opens.
How long it is kept
Each review is deleted automatically on a date shown on the manage page, 60 days after it is created by default (30 or 90 can be chosen). The person who set it up can delete it at once. A leader can withdraw their own answers before results are shared. Because team answers are stored without any link to the person, a team member cannot withdraw them after sending.
Where it is kept
Stored data is held with Netlify (Netlify Blobs). Cyfer’s code asks for the EU (Frankfurt) storage region, and nothing in the Netlify settings overrides it. The code that handles requests is set to run in Netlify’s London (UK) region. Both checked in the Netlify settings on 7 October 2026.
Netlify may also log technical details of requests, such as IP addresses, for security and operation. This section is being finalised with a data-protection specialist before any live review opens.
Your rights
You can ask to see, correct or delete your personal data, to object to its use, and to complain to the Information Commissioner’s Office (ico.org.uk). Contact info@align-empower.com. Because team answers are not linked to individuals, they cannot be found or changed afterwards, which is the point of anonymity.
About the questionnaires
Personality uses the Mini-IPIP (Donnellan, Oswald, Baird and Lucas, 2006), a public-domain short form of the International Personality Item Pool. The motive, pressure and team scales are original to Cyfer. They are provisional and have not been validated, and there is no comparison group yet. Results describe perceptions and are not facts about a person. Cyfer must not be used to decide selection, promotion, pay or dismissal.