Privacy Policy

1. Introduction

Acuru is operated by Examfly Limited, Suite 316, Guinness Enterprise Centre, Taylor's Lane, Dublin 8, Ireland (“we”, “us”, or “our”).

We are committed to protecting your privacy and handling personal data in a transparent and secure manner.

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use:

• Our website at https://acuru.com
• Our web application at https://acuru-app.com

Together, these are referred to as the “Service”.

2. Scope

This Privacy Policy applies to:

• Visitors to our website
• Users of our web application
• Individuals accessing Acuru through an organisation (e.g. employer or training provider)
• Individuals who contact us

3. Data Controller and Processor Roles

Depending on how the Service is used, Examfly Limited may act as:

• A data controller (e.g. for website visitors, marketing communications, and direct customer relationships), or
• A data processor (where we provide the platform to organisations and process End User data on their behalf)

Where you use Acuru through an organisation, that organisation is typically the data controller.

4. Personal Data We Collect

A. Information You Provide

When using our web application, we may collect:

• Name
• Email address
• Account credentials
• Organisation information (where applicable)
• Learning progress, activity, and assessment results

If you contact us, we may collect:

• Your name
• Email address
• Message content

B. Information Collected Automatically

When you visit or use the Service, we may collect:

• IP address
• Browser and device information
• Operating system
• Usage data and interaction metrics
• Date and time of access
• Referring URLs

This data is used for security, performance monitoring, and service improvement.

5. Analytics

Website (acuru.com)

We use Google Analytics to analyse website usage.

Where required by law, non-essential analytics cookies are used only after user consent.

Web Application (acuru-app.com)

We use Mixpanel to understand feature usage and improve product performance.

6. AI Processing of Free-Text Responses

Certain features of the Service may involve processing user-submitted free-text answers using AI service providers to generate feedback and enhance learning experiences.

We aim to minimise the personal data transmitted to AI providers and do not intentionally send directly identifying information (such as names or email addresses).

We do not enable prompt logging with our AI gateway provider.

In production environments, full user-submitted content is not retained within AI observability or monitoring systems. Limited technical metadata (such as model name, token usage, or response timing) may be retained for performance monitoring and service improvement.

7. Sub-Processors and Service Providers

We use trusted third-party service providers (“sub-processors”) to operate and support the Service. These providers process personal data on our behalf under appropriate contractual safeguards.

Our sub-processors include:

• Amazon Web Services (AWS) — cloud hosting and infrastructure (data hosted in Ireland, eu-west-1)
• Mixpanel — product analytics
• Mailchimp — email communications (where applicable)
• Knock.app — platform notifications and messaging
• Langfuse — AI observability and performance monitoring
• OpenRouter — AI gateway provider used to process user-submitted free-text responses
• Google (Gemini Flash models) — downstream AI model provider accessed via OpenRouter

Some providers may process data outside the European Economic Area. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent legal mechanisms.

8. How We Use Personal Data

We process personal data to:

• Provide and operate the Service
• Manage user accounts
• Deliver learning content and assessments
• Provide AI-generated feedback
• Improve performance and usability
• Maintain security and prevent misuse
• Comply with legal obligations

We do not sell personal data.

9. Legal Basis for Processing (EEA/UK)

Where applicable, we rely on:

• Contractual necessity
• Legitimate interests (platform improvement, security)
• Consent (for non-essential cookies and marketing where required)

10. International Transfers

Some service providers may process data outside the EEA or UK. Where this occurs, appropriate safeguards are implemented, including Standard Contractual Clauses.

11. Data Retention

We retain personal data only for as long as necessary to:

• Provide the Service
• Fulfil contractual obligations
• Meet legal and regulatory requirements
• Resolve disputes
• Maintain security

When no longer required, data is securely deleted or anonymised.

12. Your Rights

If you are located in the EEA or UK, you have the right to:

• Access your personal data
• Request correction
• Request deletion
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent (where applicable)

To exercise your rights, contact:

support@acuru.com

You also have the right to lodge a complaint with the Irish Data Protection Commission.

13. Cookies

We use cookies and similar technologies to:

• Enable secure operation of the Service
• Analyse website usage
• Improve user experience

You may manage cookies through your browser settings and the cookie banner on our website.

14. Security

We implement appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, or destruction.

No system can be guaranteed to be completely secure.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The revised version will be posted on this page with an updated date.

16. Contact